} Ellucian is ACC s current student system. } The student system is comprised of 5

Transcription

1

2 } Ellucian is ACC s current student system } The student system is comprised of 5 servers: Microsoft SQL Server Application Server running Unidata Web Server Staff User interface via Brower Web Server Student Access via WebAdvisor Web Server E-Commerce

3 } The servers were at end of life. } Difficulty finding replacement parts. } Server software needed upgrading. } Security threats required a new approach for how sensitive data was being accessed.

4 } Test Test Test } Active Directory } Ellucian } Learning the VDC environment

5 } Active Directory Integration Poor } Ellucian IP communications failed due to NAT } Inadequate firewall

6

7 } Its all Mark s fault! Merit VirtualDataCenters has its own IP space that can be assigned to virtual servers VDC Service was not originally scoped to have member assigned IP space routed into the virtual environment } Merit decided that expanding the scope of the VDC service to include the routing of member IP space into the VDC would be helpful for other member organizations wishing to virtualize portions of their IT infrastructure } This is the key to extending the local domain into the Cloud

8 } Active Directory Integration } Ipsec to protect SIS } Student Information Systems Had to be protected Needed to talk with Ellucian Needed to talk with public facing web servers } Web Servers WebAdvisor and E-Commerce Publicly available but still well protected Granular control of firewall rules

9 } A VPN tunnel can be established from a local IPsec device to the VDC Edge Gateway This allows the virtual servers in the VDC to be a part of the local domain Encrypts traffic so that Student Data or other PII can not be compromised in transit Allows virtual devices hosted in remote VDC to remain behind the local firewall Maintains tight control over which networks and systems can send traffic into the virtual environment

10 } Critical systems moved to a Virtual Datacenter will likely still need to be a part of the local domain } Local systems need to be able to readily access the cloud systems as if they were local } IT administrators need to be able to administer the virtual systems with ease } Public use systems like Web Servers may need to have limited access to the secured critical systems

11

12

13

14

15 } Pfsense is an Open Source firewall built on FreeBSD } Easy to Use-most configurations done through the management webpage } Fine grained firewall rules } Routing, NAT, DHCP, DNS, NTP and most other common network services built in } Ping, traceroute, tcpdump and other troubleshooting utilities available through web interface as well as the shell } Functionality can be extended through packages, including a Snort, freeradius, mailscanner, and many others

16 } Cisco ASA 1000V } Juniper vsrx } Fortinet FortiGate Virtual Appliances } PaloAlto VM Series } CheckPoint Security Gateway VE

17

18

19 } Bulk blocking of undesirable traffic at vcloud Edge Gateway } NAT Rules, and Static Routing at the Edge Gateway } Fine-grained firewall control at the Public Web Firewall } Very tight firewall rules at the WebBridge Firewall to allow the Web Servers to access necessary information in the VPN protected systems, without having to go out of the VDC to Alpena, into the VPN tunnel and back to the VDC in Southfield

20

21 } Merit VirtualDataCenters Has an Edge Gateway device For Production Virtual Machines Can have internet traffic routed to them VMs available via RDP or SSH if configured for that } Michigan Cyber Range and the Secure Sandbox service No Edge Gateway device unreachable from the internet Logically Isolated No data leakage possible Interact with VMs from vcloud Web Interface only Perfect for Cyber Security Classes or Security Testing of servers before they go into production