Cloud Architecture and Mobility

Transcription

1 Cloud Architecture and Mobility Anil Karmel, NNSA M&O Chief Technology Officer RightPath Chief Architect A Partnership between the Office of the Chief Information Officer and the National Nuclear Security Administration 1

2 RightPath focuses on People, Processes, and Technology to deliver: powered by Immersive Collaboration and Social Networking tools Virtual Servers and Desktops hosted in your Secure Hybrid, Community Cloud 2

3 3

4 Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources 4

5 Cloud Computing Organizations are faced with large existing technology investments and dwindling budgets { US Data Centers consume between % of the energy budget 5

6 Cloud Portal Virtual Desktops Enterprise Services (e.g. ONEvoice) Servers Service Catalog M&O Cloud DOE IE Cloud NNSA 2NV Cloud Other Federal Gov t Clouds YOURcloud Enclaves M&O / DOE Site(s) Commercial Cloud Service Providers Other Government Sites 6

7 Secure Hybrid Community Cloud LANL s Infrastructure on Demand is the first Infrastructure-as-a-Service secure hybrid cloud to automatically request and provision virtual servers Value Added Features: GreenIT Smart Meter Dynamic Cost Calculator LifeCycle Management Chargeback / Showback Requestor Responsibility: Enclave Security Plan System Administration Maintenance of operating system and applications Awards: SANS National Cybersecurity Innovators Award: Cloud Security InformationWeek 500 Top IT Government Innovators 7

8 Secure Hybrid Cloud 8

9 Security Journey TRADITIONAL SECURITY Complex Multiple provisioning interfaces Overlapping admin roles Multiple point solutions Rigid Agents in each VM, AV storms No granular segmentation Rigid Policies tied to servers Labor Intensive Compliance Not change-aware, data leaks Manual assessment Manual remediation VIRTUALIZED SECURITY Simple Single interface for provisioning Separation of duties Firewall policy reduction Virtual security appliances Adaptive Agentless Adaptive trust zones, compromised apps quarantined Virtualization aware firewall Automatic Compliance Discover sensitive data Continuous assessment Automated remediation, programmable 9

10 Physical Security Architecture Internet Load Balancer Load Balancer Unclassified A Unclassified B Service A Service B Service C Service D Service E 10

11 Cloud Security: Protect the VDI Clients 11

12 Cloud Security: Quarantine the Compromised Virtual Machines 12

13 Secure Hybrid Cloud Computing Service A VDC Service B VDC Service B VDC Secure VPN On Premise Private Cloud Commercial Cloud Service Provider 13

14 Cross Cloud Management Makes Hybrid Cloud Real Visualize resources across hybrid clouds Copy and operate resources across clouds Deliver enterprise level security Hybrid Cloud Private Clouds Federation & Choice Public Clouds 14

15 Elastic Compute Benefits: Elastic VDC vshield Edge Elastic VDC Cross cluster mobility within or across datacenters On demand networks without physical network configuration 15

16 LANL IoD Elastic Compute VXLAN On Premise Private Cloud Commercial Cloud Service Provider 16

17 17

18 18

19 19

20 20

21 21

22 22

23 23

24 24

25 25

26 26

27 27

28 28

29 SustainIT 29

30 30

31 SustainIT Integrated Capabilities Data Center High-Level View Data Center Detail View DC Pro Analysis Sustainable Portfolio Project Manager Facility TCO Modeling Real-time Energy Monitoring and Management 31 31

32 Mobility Delivering a comprehensive platform for on-the-go worker capabilities 32

33 Challenge Deploying modern wireless technology is incredibly difficult within government Multiple federal approvals are required that slow speed to impact or block progress all together Customers demand devices they are most familiar with yet show little interest in devices we are comfortable with securing True wireless automation and a connected government are years, if not decades away 33

34 The Enterprise Mobility project takes a field of dreams approach to infrastructure 34

35 To make mobility real We must make data available everywhere, yet limit where it goes 35

36 Rethink Mobility Data There are two main strategies for data security: Virtualization and Containerization. Secure the data not the device. Location Employees must be able to work wherever they are at on the device of their choosing. Transport You don t truly understand your risk until you understand your transport. 36

37 Future Cycles of Innovation Today s investments create a target rich environment for future cycles of innovation Interactive Intelligence Business Social Cyber Enabling VForce21 NextGen Cybersecurity 37

38 Begin with the end goal in mind Rapid results Focus on real business solutions Low risk Take a lean, agile approach to technology Low cost 38

39 Anil Karmel M&O Chief Technology Officer, NNSA RightPath Chief 39