Catbird 6.0: Private Cloud Security

Transcription

1 WHITE PAPER Catbird 6.0: Private Cloud Security and agile infrastructure that is exposing weaknesses in legacy perimeter-based network controls and leaving applications vulnerable to advanced threats. Virtual networks now comprise the majority of all networking in data centers 1 At the same time, highly automated cloud systems have given us the opportunity to rethink how we can use the business initiatives. Until recently, security within the data center was applied in one location the perimeter. While still a valid place to protect against external threats, the ideology of perimeter security leaves security policy and compliance within private clouds largely static, a dusty three-ring binder in a world of big data. Organizations 2 the data center infrastructure and mobile devices routinely bypass the perimeter. Catbird traditional perimeter protections to detect and enforce the policies put in place to address these threats. Catbird 6.0 is designed from the ground up to address the security and compliance challenges of the private cloud, enabling an automated approach to protecting assets that is aligned with IT priorities. TRUST. Safely enable sensitive and mission-critical workload migration to private clouds by extending perimeter-based VLAN isolation with additional controls while enabling virtual situational awareness with all SANS Top 20 network controls; deploy and maintain security policies through the entire VM lifecycle, adapting dynamically to change events. VERIFY. controls against hardening requirements and best practices. Unburden scarce IT personnel from manual audit processes by automating event capture and mapping to standards such ENFORCE. Mitigate attacks by reducing the threat footprint and applying targeted security and insider threats. dramatically improving incident response times and reducing audit costs.

2 Empowering you with the ability to dynamically create security policies, on demand and in real-time, our enterprise security platform applies those virtualized policies to individual or groups of VMs, actively monitoring and enforcing them from inception to retirement. A unique feature of our product is the use of security policy containers called Catbird TrustZones tainers can be used to extend your current perimeter isolation, incorporate new virtual controls operating inside the virtual switch fabric, while validating your security posture and expediting your audit process. TRUST: sensitive data using Catbird TrustZones. TrustZones security policy utilizes existing VLAN isolation and can policies from inception to retirement, assuring control through the entire VM lifecycle independent of all change events. VERIFY: Continuous monitoring against leading standards. Trust, but verify is a cardinal rule, especially for report an ROI of less than a year by reducing preparation for assessments, ensuring evidence of control, controlling audit scope creep, and eliminating costly audit disruptions. ENFORCE: Automated mitigation at machine-speed. Events that violate TrustZones policy result in automated alerts. Alerts may also trigger optional automated mitigation to enforce policy and maintain or power down VMs. Essentially, we observe and present to you a detailed view of your virtual infrastructure, 100% perfect inventory of all VMs and how they are interconnected. Having a complete context of your network activity, helps ensure trust in your private cloud, improves your security posture, accelerates incident response and reduces your audit and compliance burden. PAGE 2

3 WHITE PAPER The policy decisions that you choose to execute are highly dependent on the context of your infrastructure. objects complete with orchestrated network controls. Catbird is uniquely positioned in the logical switching see assets announcing themselves and see what the hypervisor is reporting. Running right alongside work- topology, adds another contextual element that allows for more accurate policy assignment. A rich set of Mandiant s 2 between and within TrustZones in the private cloud. Catbird PAGE 3

4 Across the data center you can verify and enforce VLAN isolation. The most common mechanism for isolating converged infrastructure is thru logical isolation with VLANs. Given the risks associated and security standards are calling attention to the need to verify, validate and mitigate. This requires change events and network controls. Any violations can be mitigated through session management, Access to total visibility of your private cloud network with a perfect inventory of all VMs and automatic ment. With powerful security protection in place, IT and business groups can make more informed decisions, deploy new applications quickly and closely manage their policies. - hindering your business. Today, risk reduction in the private cloud can safely enable any workload to share - Assure the appropriate policy is applied to all VMs through automatic TrustZone membership based on common naming conventions. Select a standard compliance class for each TrustZone for automated measurement for events that violate policy.

5 WHITE PAPER TrustZones ensure that your VMs are fully isolated throughout their lifecycles, detecting and mitigating against rogue VMs, continuously monitoring to verify controls, and delivering enforcement via optional mitigation to protect your business from threats. Use cases include: as assuring that all access to vcenter console occurs through the HypervisorShield TrustZone Using TrustZones to assure consistent security policy is applied to all tiers within a given application, i.e. UI, application and database back end. of the management and provisioning system. - rules are enabled based on results from the most recent vulnerability scans. Security policy violations will VM Perfect Inventory and Lifecycle Control. Assure full controls of all VMs, continuously apply appropriate policy, regardless of change events, to all VMs from inception to retirement. Real time event and alert visualization supports operator response to change control management and mitigation. Additional Control for VLAN (Layer2) Isolation. Assure the integrity of your VLAN isolation VLAN Isolation Policy: Any attempt to violate VLAN isolation would be detected and blocked as Catbird PAGE

6 Verify Controls. Continuously monitor and diagnose security and hypervisor events against the TrustZone security policy. Security Threat Visibility: Real-time Compliance Posture. Catbird utilizes security and hypervisor events to measure and map the control state of each TrustZone and individual VM against the leading control frameworks such as Machine-speed mitigation for Compliance Enforcement. PAGE 6

7 WHITE PAPER Your Catbird deployment is managed via the Catbird Control Center, a web management console and central compliance are provided by the Control Center, giving you an enterprise-wide view of all TrustZones and VMs across your infrastructure. The Control Center provides a party management and provisioning tools. The Control Center is responsible for Virtual updates. Polic y Enforcement Point s: Catbird VMAs VMAs are Catbird s policy enforcement point and are deployed on the virtual network itself one per virtual switch or hypervisor. The VMA is a Linux-based hardened appliance with no listeners enabled. By operating inside the virtual infrastructure, VMAs secure from within, leveraging contextual information available through Reporting and Logging Logging. Reporting. Supported Platforms: Catbird will also now extend support for both VMware hypervisors, and Cisco and VMware VMware NSX and Cisco Application Centric Infrastructure Footnotes 1 Rob Randell and Malcolm Rieke, SANS Top 20 Critical Controls, Catbird PAGE 7

8 Catbird 1800 Green Hills Road Suite 113 Scotts Valley CA USA Tel Copyright 2014 Catbird Networks, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. Catbird products are covered by one or more patents. Catbird and vsecurity are registered trademarks of Catbird Networks, Inc. in the U.S. and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.