Enterprise Cloud Use Cases and Security Considerations

Transcription

1 Enterprise Cloud Use Cases and Security Considerations Carson Sweet! CEO, CloudPassage!

2 For This Discussion We re talking about cloud infrastructure! Cloud-oriented infrastructure delivery Infrastructure for any workload, not just web apps Everything from the bricks through the app delivery stack We generally consider cloud-oriented as! Virtualized servers, networking, & application stacks Self-service infrastructure provisioning Utility billing / cost structure (pay for what s used) Highly automated management / orchestration Public, private, or hybrid infrastructure models

3 Survey: 2013 Cloud Server Plans % of respondents anticipating use of cloud environments for delivery! Public CSP Private Cloud or SDDC Hybrid Cloud Temporary workload / big data / analytics 30% 19% 40% E-commerce applications 34% 15% 40% Public content hosting (news, blogs, video) 32% 23% 33% Hosting development and testing environments 48% 19% 38% Externally-facing applications 50% 25% 38% Non core-business apps (HR, CRM, ERP, ) 43% 19% 23% Source: 2012 CloudPassage Survey of information technology, security and compliance managers (n=201)!

4 Dev/Test in Public Clouds production-01 production-02 production-03 production-04 production-05 production-06 dev-01 dev-02 dev-03 qa-01 qa-02 qa-03

5 Dev/Test in Public Clouds qa-03 dev-01 dev-02 production-01 production-02 production-03 production-04 production-05 production-06 dev-03 qa-01 qa-02

6 Dev/Test in Public Clouds qa-03 dev-01 dev-02 production-01 production-02 production-03 production-04 production-05 production-06 production-07 dev-01 production-08 dev-02 production-09 dev-03 production-10 qa-01 production-11 qa-02 production-12 qa-03 dev-03 qa-01 qa-02

7 Dev/Test in Public Clouds Drivers / Benefits Decreases IT workload Self-sufficient BU developers Opens datacenter capacity Reduces configuration efforts Security Considerations Public cloud server exposures Visibility into misconfigurations Production data in test/dev Tracking server launches/clones

8 Big Data Analytics production-01 production-02 production-03 production-04 production-05 production database cluster analytics slave cluster map-reduce (e.g. hadoop) quant-1 quant-2 quant-3 quant-(n) data pump

9 Big Data Analytics Drivers / Benefits Massive new capabilities Leverage yrs of collected data Previously unattainable intel Product enhancements, risk intelligence, BI, BPM Cloud analytics = scalable! Security Considerations Your data, public cloud Analytics engine contains IP Geographic data hosting Integrity is paramount

10 Private IaaS / PaaS Clouds Drivers / Benefits Increased hardware utilization Self-service provisioning Decreases IT workload Rapid scalability / elasticity Security Considerations Limited-to-no change control Flattened network architecture Not everyone knows security Cloud-capable security tools Raw tech & ops scaling issues

11 Cloud Infrastructure Security Pain Meeting Compliance & Best Practices! PCI, HIPAA, ISO 27002, SOC2, SANS Top 20, NIST Too many systems & high velocity of change! Dynamic is core to cloud, is the new mode of operation Security orchestration & automation are underserved needs Rounding out public CSP security basics! Customers are responsible for the bulk of security Very different operating environment Existing products don t work well (or at all)! Technology was designed for a different time, operating model Do not match up to dynamic cloud operational models

12 Existing Approaches Fall Short www-4 www-5 www-6 Dependence on Hardware and Network Control No Usage-based, Metered Licensing www-7 www-8 www-9 www-10 Cloud Provider B Cloud Provider A www-4 www-5 www-6 Cannot Handle Elasticity or Automatic Provisioning Scenarios Cloud Provider A www-1 www-2 www-3 Not Portable to Multiple Cloud Environments Private Datacenter

13 Architecting Next-Gen Cloud Security (U.S. Patent No. 8,412,945) Daemon! Ultra light-weight agent Installed on server images Automatically provisioned! www-1 www-1 Grid! Elastic compute grid Hosted by CloudPassage Diverts 95% or more of analytics cycles from VM daemons

14 www-1 Daemons installed via CloudPassage scripts or server management tools like Chef, Puppet, or RightScale.! www-1 Lightweight Daemon! https! https! User! Portal! RESTful! API Gateway! Policies,! Commands, Reports! Compute! Grid! CloudPassage

15 www-1 Server policies & commands are retrieved securely from the Grid.! Policy templates can be copied & customized to specific user needs.! www-1 https! https! User! Portal! RESTful! API Gateway! Policies,! Commands, Reports! Policies & Commands! Compute! Grid! CloudPassage

16 www-1 Daemon runs commands, applies policies, returns results and status to Grid.! www-1 Examples: server account data, configuration details, network changes, new servers, etc.! https! https! User! Portal! RESTful! API Gateway! Policies,! Commands, Reports! Results & Updates! Compute! Grid! CloudPassage

17 www-1 Grid analyses data sent by Daemon & issues commands to update security controls.! www-1 Grid provides > 95% of analytics compute power to preserving server VM resources.! https! https! State and User! Event Analysis! Portal! RESTful! API Gateway! Policies,! Commands, Reports! Compute! Grid! CloudPassage

18 www-1 Users receive alerts, reports, etc. via , Portal, or REST API.! www-1 https! https! User! Portal! RESTful! API Gateway! Policies,! Commands, Reports! Compute! Grid! CloudPassage

19 www-1 Daemons automatically deployed to servers created via cloud-bursting or server cloning.! This ensures consistent security by making it part of the cloud stack itself.! www-1 www-2 www-3 www-4 https! https! User! Portal! RESTful! API Gateway! Policies,! Commands, Reports! Compute! Grid! CloudPassage

20 Example of Operation (Cloud Web Server) Continuously verify application code is current and un-tampered Orchestrate network access control and multi-factor auth FW Data! App Code! App Framework! Operating System! Cloud Server VM! FW Monitor sensitive data and prevent egress Ensure application stacks locked down, meet compliance & security standards Verify compliance and harden server configurations Result: Fully automated, portable, scalable security & compliance

21 Why Is This Architecture Better? Portable, built-in security & compliance automation! Self-service infrastructure provisioning (private IaaS) Controls that transparently move across cloud environments (hybrid) Secure, compliant use of cloud service providers (PCI, ISO-27002, SOC2) Technically, financially, operationally scalable! Grid architecture = low impact to systems, massive horizontal scalability Metered usage = pay for what s used (hourly licensing, volume discounts) Automation = built-in controls with zero provisioning or configuration Consistency, efficiency through automation! Security is built directly into the stack; changes, removal instantly detected REST API and toolkit for extensive integration with existing tools, processes One central point of visibility and control for systems across multiple clouds

22 This architecture works anywhere

23 and it enables multiple functions. Cloud Firewall Automation Multi-Factor Authentication System & Application Config Security Vulnerability & Patch Scanning File Integrity Monitoring Server Account Managements Security Event Alerting REST API Integrations HALO PLATFORM Security moves with distributed workloads and achieves massive horizontal scalability

24 Key Takeaways Hybrid / multi-cloud infrastructure and constant change will be the norm! Hardware-driven perimeter security models don t scale, can t keep up! Security that s horizontal scalable and are tied to cloud workloads is critical! Whether it s this approach or another, figure it out and be ready!

25 Questions & Discussion!