Virtualized Security: The Next Generation of Consolidation

Transcription

1 Virtualization. Consolidation. Simplification. Choice. WHITE PAPER Virtualized Security: The Next Generation of Consolidation

2 Virtualized Security: The Next Generation of Consolidation As we approach the end of the decade, it is clear that enterprise IT departments are focusing attention on any proposed cost reduction initiative. These proposals include the use of advanced productivity management tools to new technologies that allow business to reduce operational expense such as travel, energy and cooling. A number of enterprises have turned to infrastructure consolidation programs to assist with meeting business cost targets. However, network and security architects are struggling to find the right technologies that offer the strongest protection against network security threats that still guarantees network availability and performance. Virtualization technologies deployed across the data center have reduced IT costs and have efficiently maximized server and storage workloads. But, the security infrastructure has been excluded from many of these projects due to the added burden to create and manage virtual security appliances and the potential associated risks with accidental or malicious virtual machine mapping. With the advent of new Virtualized Security applications combined with Crossbeam Next Generation Security Platforms, help is now at hand to realize true cost reductions through consolidation. Virtualized Security Explained Due to the explosion of financially driven threats, increases in traffic bandwidth and the sheer diversity of users and business accessing data, IT departments have resorted to creating hundreds of security segments with ever decreasing perimeters. Although this model reduces risk and helps provide visibility between segments, it has the negative effect of dramatically increasing the number of network and security devices on the network including security rules, leading to appliance sprawl and operational complexity. Figure 1: Network Segmentation has led to appliance sprawl 2 2

3 The logical approach to solving this problem is to create a Virtualized Security System that abstracts the vast amount of hardware processing required to keep pace with the bandwidth from the security applications and the individual security segments. In order to achieve this goal and reduce cost, two important components are needed to create a Virtualized Security System: 1. The ability for a security application to run on any number of hardware based processors and still act as a single entity. 2. The ability for a security application to work as multiple independent security instances Using a virtualized security system, network managers can create hundreds of firewall or IPS instances with distinct policies per segment on a single security platform and significantly reduce the number of network and security devices. For instance, one could apply specific firewall policies and IPS rules to the print server connection and another set of IPS rules and firewall protection for the finance database zone and insure appropriate access to these resources. Large enterprises could use this technology to collapse firewall and IPS devices from remote locations into just one data center, but maintain unique security segmentation and rules for each location as represented in Figure 2. Figure 2: Introducing the Virtualized Security System 3

4 Crossbeam has introduced a Next Generation Security Platform that delivers all components for a Virtualized Security System. The Crossbeam platform delivers best-of-breed virtualized security applications and services while consolidating network and security infrastructure with significant cost advantages. A Virtualized Security System significantly reduces the amount of equipment required by supporting thousands of enterprise users in a multi domain fully virtualized platform with delegated administrative control to the individual network zone. The Crossbeam X-Series architecture is the underlying next generation security platform that provides carrier class resiliency and performance. Completely redundant hardware modules, switching fabrics, and control plane enable complete Single Box High Availability (SBHA) and Dual Box High Availability (DBHA) modes in a chassis that can provide true 40Gbps performance today and is change-ready to a massive 160Gbps. The X-Series Chassis provides 14 slots for module expansion. There are three types of modules available to support a virtualized next generation firewall; Network Processor Modules (NPM), Application Processor Modules (APM), and Control Processor Modules (CPM).Complete flexibility for module configurations are supported to insure a stable configuration for the virtualized firewalls. The Network Processor Module (NPM) is fully enabled for next generation 10 Gbit Ethernet networks and is designed to perform deep packet inspections, classifying the packets into flows that are switched through the system to the virtualized security applications. The flow switching mechanism is based on Crossbeams load balancing algorithms and Crossbeam Secure Flow Processing. These technologies provide system network managers power and control to manage many virtual security domains- matching individual policies and rules to the appropriate entity. Up to ten slots are reserved for Application Processor Modules (APM). These APMs manage the virtualized security applications applied to the traffic flows as they are switched through the system. Crossbeam Secure Flow Processing logically sequences network flows from one application to another using the application to manage the individual rules and polices set for each virtual firewall and IPS. This secure flow processing is managed at wire speeds regardless of the number of firewalls managed. 4

5 A key capability of the APM is the Virtual Application Processor (VAP) technology. A VAP clusters security applications, networking functions, and connections, allowing the XOS operating system to dynamically distribute the virtualized firewall and IPS applications to these processors. The security applications managing the virtual firewalls are automatically distributed and intelligently load balanced based on usage metrics. The result is an on-demand dynamic resource allocation for easy scaling, application redundancy, and self healing capabilities that enables redundancy inside the chassis. If one blade should fail, the system will automatically fail over to a second single or cluster of blades, insuring that all firewall entities are secured. The health and management of the X-Series chassis falls to the Control Processor Module (CPM). On the CPM, a virtual representation of the chassis is created, blade services are assigned, and chassis management policies are governed. The CPM manages failover policies, service priority and service preemption rights. For example one entity s firewall service may be provisioned so it automatically shares processing resources from a lesser used blade if data throughput should spike- insuring that all entities are always protected from attacks. The X-Series system decouples network and security service processing to allow customers to take advantage of price/ performance improvements and innovation curves within each technology. The system offers significant consolidation of security equipment while preserving security policies, resulting in a safer and simpler network for a Virtualized Security System. Figure 3: Crossbeam X-Series with Secure Flow processing Reducing costs with a Virtualized Security System Let s examine how a Virtualized Security System from Crossbeam can save significant IT operational expense. The IT department within a large US based bank manages multiple departments security policies. The bank expects network throughput to grow by 30 percent each year and has tasked the Chief Security Officer (CSO) to develop a consolidated 3 year security plan that holds operating expenses to no more than 3 percent growth per year, but provides appropriate security levels to plan for these new services. Currently the bank deploys 150 dedicated firewall appliances to manage access to branch data and ATM data. The CSO plans to add intrusion protection services (IPS) to the bank s security policies, but has discovered that the current appliances cannot support IPS. A new network security solution is needed that can meet the following objectives: Support the expected 3 year traffic growth up to 100 Mbps large packet throughput per firewall instance Support both firewall and IPS capabilities Hold operating expenses flat with a goal to reduce by 3 percent- current power, cooling, labor and maintenance costs to manage 150 distributed firewall appliances has an annual budget of $958K. 5

6 The bank has used virtualized data servers and has found that they have helped reduce IT operating expense. The bank s CTO is interested in determining if virtualizing network security can help reduce network security operating expense, without compromising in line security. One approach from Vendor A uses an appliance that can manage up to 150 virtualized firewall instances on a single platform. However, the IPS solution proposed lacks support for virtualizing the IPS through multiple policies for different network segment. Up to six IPS appliances would need to be added to Vendor A s proposal to meet the IPS requirement. The total proposal carries a capital expenditure cost of $2,850,000 and with an annual operating expense of $265K per year. After amortizing the capital expense over three years, the total IT budget need to support Vendor A s proposal is about $1,215K per year- well over the current IT budget. Figure 4: Proposal comparisons With Virtualized Security applications installed on one Crossbeam chassis, the capital expense comes to $1,556,920. However, the operating expense is significantly reduced both for both labor and power and cooling. Using the Crossbeam proposal, the IT budget will only need an estimated $613K - a reduction of about 36 percent as compared to the current budget. Virtualized Security Applications Check Point VPN-1 Power VSX: Check Point VPN-1 Power VSX deployed on the Crossbeam X-Series next generation security platform provides a fully virtualized firewall that embraces network, application, and policy virtualization. Check Point VSX enables the creation of up to 150 virtual security systems per APM firewall, VPN, and content filtering, all resident in a highly resilient, scalable chassis. Each virtual system represents a unique routing and security domain, with its own security and VPN policies, configuration parameters, interfaces and links, and secure internal communication certificates. These virtual systems can be easily configured and provisioned using virtual system creation templates and creation wizards. Crossbeam and Check Point also support virtual systems in Layer 2 mode; creating transparent firewalls for easy deployment into existing networking infrastructures. VSX is also supported by Check Point SmartDefense service, which provides real-time updates and configuration advisories for defenses and security policies. 6

7 Virtualized IPS Application: IBM ISS Proventia IBM Proventia Network IPS deployed on the Crossbeam X-Series enables organizations to add another level of security with Proventia Intrusion Protection rules and policies. Proventia Network IPS stops Internet threats before they impact a business, using virtualized IPS policies to protect multiple network segments. ISS Proventia allows for multiple rule configurations defending multiple zones and eliminating the need for many IPS devices securing various network zones. IBM ISS Proventia allows establishment of network zones for dynamic deployment of IBM Proventia Network IPS-based security services to specific assets or network segments. Individual rules and policies can govern specific entities to provide targeted security for different entities and departments. Proventia will create and support multiple policies for different network segments in a single solution, while sharing protection policies across multiple blades. Both Check Point VSX and IBM ISS Proventia leverage Crossbeam Secure Flow Processing to insure each application inspects each entity s network flows using the unique parameters and rules established for each of the hosted entity. Benefits of a Virtualized Security System All of these systems were designed to create order of magnitude improvements within the operational efficiency of running multiple data center security infrastructures. Benefits of using these combined solutions as a virtualized next generation firewall include: Strategic Reduces the risk of technology investments, anticipates future risks. The rate of security threats and new security software development is accelerating, so enterprises want to preserve the ability to switch to new vendors quickly as needs change. Allows for core installation in lights out environments, scaling multiple, complementary applications, and multiple software instances all in a % uptime platform Operational Requires significantly fewer personnel to manage existing firewalls, reduce appliance sprawl. Instead of adding a firewall and IPS device to each subnet, use Check Point VSX and IBM ISS Proventia on a Crossbeam X-Series platform to host up multiple virtual next generation firewalls. One solution, one platform: multiple cost and resource savings. Figure 5: Virtualized Security with Crossbeam s Solution 7

8 Summary Crossbeam, Check Point, and IBM have developed a comprehensive, total solution for enabling cost effective security deployment for large enterprises. The X-Series Next Generation Security Platforms provides the highest hardware scaling and high availability solutions for VSX and IBM ISS Proventia deployments. The end result for is a high performance, scalable virtual service delivery platform that provides revenue generation and cost reduction opportunities through a competitive managed service offering. This promotes competitive differentiation and reduces the total cost of deployment and management of infrastructure. About Crossbeam Crossbeam transforms the way enterprises, service providers and government agencies architect and deliver security services. Its Next Generation Security Platform facilitates the consolidation, virtualization and simplification of security services delivery, while preserving the choice of best-of-breed security applications. Customers choose the Next Generation Firewall and Secure Web Gateway to intelligently manage risk, accelerate and maintain compliance, and protect their businesses from evolving threats Corporate Headquarters Crossbeam Systems, Inc. 80 Central Street Boxborough, MA Tel: +1 (978) Fax: +1 (978) Crossbeam, Crossbeam Systems, any logos associated therewith are trademarks or registered trademarks of Crossbeam Systems, Inc., in the U.S. Patent and Trademark Office, and several international jurisdictions. All other company, product or service names not owned by Crossbeam mentioned in this document are the property of their respective owners. Copyright 2009 Crossbeam Systems, Inc. All Rights Reserved. WP_VIRTUALIZING_NGFW_