Cloud Computing Security. Belmont Chia Data Center Solutions Architect

Transcription

1 Cloud Computing Security Belmont Chia Data Center Solutions Architect 1

2 Cloud Computing Security What is this Cloud stuff? Security in Public Clouds Security in Private Clouds 2

3 Defining Cloud Computing IT Resources and Services that Are Abstracted from the Underlying Infrastructure and Provided On Demand and At Scale in a Multitenant and Elastic Environment A Style of Computing Where Massively Scalable IT-Enabled Capabilities Are Delivered As a Service to Multiple External Customers Using Internet Technologies Source: Gartner Defining and Describing an Emerging Phenomenon June 2008 Anywhere, Anyone, Any Service 3

4 Why is Cloud getting so much interest? Utility Water Electricity Phone Cloud Computing can be looked as the 4 th Utility Virtualization Reduce costs Low Complexity Simplify deployment Scalability Quicker time to market Elasticity - Economies of scale 4

5 Customer Benefits Service Providers Consolidation and virtualization benefits for own use Scale across multiple customers = higher margins Economic efficiencies allowing more compelling services Enterprise/Public Sector Reduce complexity, cost and IT touch-points Improve agility/flexibility/responsiveness Enables a focus on core business vs. IT SMB / Consumer Low cost alternative to traditional IT Solutions Scale advantages without cost 5

6 Cloud Definition from NIST Visual Model of NIST s Working Definition of Cloud Computing Essential Characteristics On-Demand Self Service Measured Service Broad Network Access Rapid Elasticity Resource Pooling Service Models Software as a Service (SaaS) Platform as a Service (PaaS) Infrastucture as a Service (IaaS) Deployment Models Public Private Hybrid Community 6

7 Essential Characteristics Traditional Computing Cloud Computing Consumption Ease of Use Scalability Availability Provisioning Cost Dedicated Traditional hardware procurement New services added manually Manual repair of system failure Months Incremental CapEx purchases Shared Self service Scale on-demand Automated recovery due to integration / interoperable Minutes Pay per use 7

8 Enterprise Deployment Models Distinguishing between Ownership and Control Ownership Control Internal Resources Private Cloud All cloud resources owned by or dedicated to enterprise Cloud definition/ governance controlled by enterprise External Resources Public Cloud All cloud resources owned by providers; used by many customers Cloud definition/ governance controlled by provider 8

9 The Cloud Computing Journey Open Standards Inter- Cloud Hybrid Cloud APIs and Protocols Virtual Private Cloud Public Cloud PRESENT Private Cloud 9

10 Cloud Computing Architectures From Stand-Alone to The Inter-Cloud Phase 1 Phase 2 Phase 3 Phase 4 Internal Cloud Private Cloud Open Cloud (Federations) Stand-Alone Data Centers Virtual Private Cloud Inter-Cloud Public Cloud Public Cloud (Hybrid Cloud) Public Cloud #1 Public Cloud #2 PRESENT

11 But what about security? Challenges: Dynamic environment, static barriers are no longer sufficient Resource preservation becomes critical Compliance requirements What about auditing? Solving these issues will need dramatic changes in traditional security models, how we deploy security and how we do security management! 11

12 Cloud Computing Security What is this Cloud stuff? Security in Public Clouds Security in Private Clouds 12

13 Public Clouds - SaaS Public Cloud Architecture example Clients Thin Client Thick Client Mobile 1 Systems Management Capacity 2 Systems Provisioning 3 lications Data 4 Data Center 5 1 Client sends service requests 2 System management requests resources 3 Systems provisioning finds correct resources 4 Compute resources are found and service request is executed 5 Results of the service requests are sent to the clients 13

14 Moving to the Public Cloud What are the Security issues? BEFORE AFTER??? We Have Control It s located at X. It s stored in server s Y, Z. We have backups in place. Our admins control access. Our uptime is sufficient. The auditors are happy. Our security team is engaged.?? Who Has Control? Where is it located? Where is it stored? Who backs it up? Who has access? How resilient is it? How do auditors observe? How does our security team engage? 14

15 Trust & Security : Foundations of Cloud Before the Economics of Cloud Computing Can Be Considered, Trust and Security Must Be Addressed: Security Control Service-Level Management Compliance 15

16 Earning trust TRUST The A6 (Automated Audit, Assertion, Assessment, and Assurance API) Working Group: Allow Cloud Providers to automate the process of Audit, Assertion, Assessment, and Assurance Also, allow authorized consumers of their services to do the same! For more information and to participate in this work, see 16

17 Cloud Computing Security What is this Cloud stuff? Security in Public Clouds Security in Private Clouds 17

18 Private Clouds Virtualized & Automate the Data Center Database V V V V V V V V V V V V V V V V Virtual DesktopsBut what Custom happened to my security? Web 18

19 Security issue #1: VM Mobility now you see it 19 19

20 Security issue #1: VM Mobility now you see it now you don t 20 20

21 The old perimeter was static. 21 Security issue #2: Static barriers are no longer sufficient

22 Security issue #2: Static barriers are no longer sufficient The new perimeter is dynamic. 22

23 Security issue #3: VM Security BEFORE Equipment is Physical Wires and cables. Routers and switches. Servers on racks. Storage arrays and disks. Memory and CPUs. Machines stay put. Security is in place. AFTER????? Equipment is Virtual How do we watch the network? Where are VMs located?. Are they moving around? What s our change control policy? Are VMs patched? Is the hypervisor secure? Who s responsible for security? 23

24 Security issue #4: Consolidation - Before lication Software Virtual Machine Storage VSwitch Compute Access Aggregation Core Edge & SAN IP-NGN Backbone Fabric-Hosted Storage Virtualization Virtual Device Contexts Firewall Services Virtual Device Contexts Internet Storage Media Encryption Secure Domain Routing IP-NGN Service Profiles Port Profiles & VN-Link Virtual Machine Optimization Port Profiles & VN-Link Fibre Channel Forwarding Fabric Extension Intrusion Detection Line-Rate NetFlow Partners lication Control (SLB+) Service Control Virtual Contexts for FW & SLB 10G Ethernet 10G FCoE 4G FC 1G Ethernet VM to vswitch vswitch to HW to HW / VM Cisco and Third-Party lications VMWare Xen Hyper-V Nexus 1000v MDS Consolidated EMC Storage Arrays Unified Computing System Intel 5500 series Nexus 5000 w/ Nexus 2000 Fabric Extender Nexus 7000 (w/ Cat 6500 as Services Chassis) Nexus CRS CRS-1 ASR 9000 ASR

25 Security issue #4: Consolidation - After lication Software Virtual Machine Compute & Access Storage & SAN Aggregation Core Edge IP-NGN Backbone Virtual Machine Optimization Service Profiles Fabric-Hosted Storage Virtualization Virtual Device Contexts Virtual Device Contexts Internet Storage Media Encryption Secure Domain Routing Load Balancing IP-NGN Firewall SSL Termination Intrusion Detection Line-Rate NetFlow Partners Cisco and Third-Party lications VMWare Xen Hyper-V Unified Computing System MDS Consolidated EMC Storage Arrays Nexus 7000 Nexus CRS CRS-1 ASR 9000 ASR

26 Private Cloud Security How to ensure that Security models are maintained in a virtual environment especially when everything is virtualized! Monitoring and maintenance: Troubleshooting Security event monitoring Maintaining Isolation and separation of resources Between Services Between Users/Customers 26

27 The Cloud Strategy Delivering products, solutions & services that enable trusted Clouds Enabling Service Providers to offer trusted Cloud solutions & services to their customers Advancing the market for Cloud via service and technology, innovation and open standards and ecosystem development 27

28 Where is Cloud Standards work being done? CSA DMTF OASIS SNIA OGF ITU-T IETF IEEE CCIF OCC NCOIC OCM ISOC TMF LA MEF And More. 28

29 Trusted Cloud: The Best Of Both Worlds Trusted Control Reliable Secure Flexible Dynamic On-demand Efficient Virtualized Data Center Virtualization Governance & Security Information & lications Cloud Computing Network Platform 29

30