Securing the Journey to the Private Cloud. Dominique Dessy RSA, the Security Division of EMC

Transcription

1 Securing the Journey to the Private Cloud Dominique Dessy RSA, the Security Division of EMC June 2010

2 Securing the Journey to The Private Cloud The Journey IT Production Business Production IT-As-A-Service Lower Costs Improve Quality Of Service Improve Agility % Virtualized 85% 95% 50% 30% 15% Platinum Gold

3 Securing the Journey to The Private Cloud Security: An Afterthought? Why Question is this bad? Restricted Does your IT security potential address value the risks associated with virtualization and private cloud before Increased potential for data breaches they are implemented? 24% 43% 22% 11% Yes, in all cases In some cases, but there are gaps No, security is brought in after the fact The business moves ahead without security Source: Live EMC Forum pole conducted in 5 cities across N. America, 10/09

4 Voice of the customer Business Objective (CISO): Manage risk and compliance while virtualizing mission critical apps Business Objective (CIO): Accelerate/start virtualization of business critical apps to continue optimizing costs Pain: Security technologies and professionals have not kept up with virtualization. Have to resort to physical isolation which restricts server consolidation Pain: High cost and difficulty of responding to compliance audits for virtual environments Pain: Lack of consistency in physical and virtual security increases cost and complexity of virtualization Pain: Maintaining separation of duties and managing risk of privileged user abuse despite convergence of infrastructure layers. Pain: Perceived vulnerability of the hypervisor Pain: Mistakes can be amplified due to rate and ease of change in virtual environments Pain: Security teams are not growing, required to do more with less and to focus on advanced analysis instead of operational tasks Opportunity: Leverage virtualization to improve security enforcement and management

5 Security Considerations for the Journey Network admin Security admin Host admin Visibility into external service providers Secure multitenancy concerns Trustworthiness Virtualization administrator IT-as-a- Service Separation of duties is challenged Need to retrain and reorient ops teams Opportunity to improve security operations People, Processes Technology Apps Guest OS Virt. FW Virt. switch Hypervisor Hardware Virtual host Hyperconsolidation of IT infrastructure on top of a new software layer below the OS layer that is a vantage security enforcement point

6 Better Security with Virtualization Trusted zone DMZ Deep visibility and unified reporting (e.g. RSA envision, RSA Archer support for ) End to end chain of trust and visibility (Physical and Virtual) APP OS Compute APP OS VM layer APP OS Virtual Infrastructure (including hypervisor) Network Storage Logical security zones that move with virtual machines (e.g. vshield Zones virtual firewall) Unified Point of Control Unified Security controls embedded deep within virtual Reporting infrastructure (e.g., VMsafe APIs for deep security introspection) Efficient, Flexible Integrity monitoring for hardware and hypervisor to ensure a trusted computing environment (e.g., Intel,, RSA PoC)

7 Securing the Journey to The Private Cloud Stage 1 Securing Infrastructure IT Production Business Production IT-As-A-Service Lower Costs Improve Quality Of Service Improve Agility % Virtualized 85% 95% 50% 30% 15% Platinum Gold Visibility into virtualization infrastructure, privileged user monitoring, access mgmt network security, endpoint security, infrastructure compliance

8 Stage 1 - Securing Infrastructure: Checklist Build a solid foundation by extending existing security controls to the new virtualization infrastructure Platform hardening (e.g., vsphere hardening guides) Strong authentication and role separation for administrators Privileged user monitoring and security event reporting Change and configuration management Leverage unique capabilities enabled by virtualization Firewall policies associated with logical groups of VMs instead of network addresses Antivirus protection at the hypervisor layer instead of in-guest (e.g., using VMsafe APIs)

9 Vblock Security Guidance

10 Threat-based approach to Vblock security Threat Administrator impersonation, privilege abuse Network attacks Breach of tenant isolation Component vulnerability Countermeasure Use LDAP or Windows AD authentication for all Vblock components Use least privilege roles. Minimize use of root accounts. Stream all logs to a security incident and event management system such as RSA envision. Disable access or require strong authentication such as RSA SecurID for ESX console Enable secure network protocol options only Disable optional and unsecure network protocols Separate management traffic from data path traffic Separate VMotion traffic from data path traffic Enable recommended, Cisco network security options. Isolate tenants using VLANs, vshield Zones virtual firewall, VSANs, storage LUN masking and zoning Mature security engineering and vulnerability response practices of, Cisco and EMC

11 Securing Infrastructure Example: Controlling user access vsphere (ESX) Stakes are higher if privileged user accounts are compromised RSA SecurID secures administrative access to ESX and vsphere Management Assistant View Anywhere, anytime, any device access to virtual desktops must increases risk of unauthorized access View enforces strong RSA SecurID authentication for remote access to virtual desktops Authentication Manager 11

12 12 Securing Infrastructure Example: Privileged user monitoring for

13 Securing Infrastructure Example: Logical / dynamic vs. perimeter security Security solutions based on physical network perimeters are ineffective in the private cloud Security policies must remain effective when VMs move Zone1 Zone2 Zone3 vshield Zones allows zones to be constructed by grouping arbitrary sets of VMs and protects traffic to and from zones using state-full firewalling INTERNET VSphere VSphere VSphere Network VSphere 13

14 Securing the Journey to The Private Cloud Stage 2 Securing Mission Critical Apps IT Production Business Production IT-As-A-Service Lower Costs Improve Quality Of Service Improve Agility 85% 95% 50% 30% 15% Platinum Gold Information-centric security, risk-driven policies, IT and security operations alignment, information compliance Visibility into virtualization infrastructure, privileged user monitoring, access mgmt network security, endpoint security, infrastructure compliance

15 Stage 2 - Securing Critical Apps: Checklist Extend existing application security controls to the virtualized applications Ensure that your security vendors support your applications when they are virtualized Apply information-centric security policies at the virtual layer to protect applications and data without security agents Use virtual desktop infrastructure to offer access to applications rapidly, flexibly and securely 15

16 Securing Critical Apps Example: Content-aware, logical zones Overview PoC that leverages the capabilities of vshield Zones to deploy RSA Data Loss Prevention as a virtual application monitoring data traversing virtual networks Zone1 Zone2 Zone3 Uses a centrally managed policies and enforcement controls to prevent data loss in the virtual datacenter Security benefits Pervasive protection VSphere VSphere VSphere Network VSphere Persistent protection INTERNET Improved scalability 16

17 Securing Critical Apps Example: Secure Virtual Desktops Ionix SCM for security configuration and patch management Infrastructure RSA DLP for protection of data-in-use RSA SecurID for remote authentication Microsoft Active Directory View Manager vcenter Clients RSA SecurID for ESX Service Console and vma RSA envision log management for vcenter & ESX View Ionix SCM RSA SecurID RSA Data Loss Prevention Microsoft Active Directory Cisco UCS EMC Storage

18 Securing the Journey to The Private Cloud Stage 3 Establish trust IT Production Business Production IT-As-A-Service Lower Costs Improve Quality Of Service Improve Agility 85% 95% 50% 30% 15% Platinum Gold Secure multitenancy, verifiable chain of trust Information-centric security, risk-driven policies, IT and security operations alignment, information compliance Visibility into virtualization infrastructure, privileged user monitoring, access mgmt network security, endpoint security, infrastructure compliance

19 Secure Multitenancy Isolation with Vblock Preventive controls Vblock Detective controls ESX/ESXi VM isolation, resource reservation / limits vsphere Firewall for traffic into and between tenant networks Dedicated tenant VLANs, anti-spoofing Dedicated Service Profiles, virtualized n/w adapters Dedicated tenant VSANs Vmware vshield Zones Cisco Nexus 1000v, vswitch Cisco UCS Cisco MDS RSA envision Comprehensive and real time security event monitoring and alerting with RSA envision ensures that any change in isolation configuration is detected Dedicated LUNs, LUN masking, port zoning, dedicated NAS file share exports per tenant EMC Symmetrix, CLARiiON

20 Establishing Trust Example: Compliance dashboard for the private cloud

21 Thank you!