How Network Virtualization can improve your Data Center Security

Transcription

1 How Network Virtualization can improve your Data Center Security Gilles Chekroun SDDC, NSX Team EMEA 2014 VMware Inc. All rights reserved.

2 Security IT spending Security spending is number 1 on 2015 IT budget Going from $71 billion in 2014 to $155+ billion by 2019 BUT

3 Target Breach 40 million Credit Cards stolen 2 million Credit Cards sold by hackers for about $53.7 million 70 million records with name, address, address and phone number of Target shoppe 46% drop in profit for the company on that quarter Costs: $200 million for the banks to re-issue CC and $100 million to Target for updating Payment Terminals CEO Gregg Steinhafle lost his job Source:

4 SONY Pictures Data Breach Sony Pictures data breach may have been an inside job 25 gigabytes of sensitive data on tens of thousands of Sony employees including Social Security numbers, medical information and salary information Previous 2011 PlayStation Network hack: 77 million accounts affected cost the company upward of $171 million Source:

5 Breaches still occur because of perimeter-focused security Perimeter-centric network security has proven insufficient. Insufficient Little or no lateral controls inside perimeter Internet Redirect VLAN stiching Challenges Inefficient network design Server Fabric Server Fabric Physical firewalls are choke points in the network Data Center Perimeter Server Blade vswitch 6 wire hops VM-to-VM traffic must hairpin out to physical firewall Security policies tied to network topology: slows deployment

6 Other alternatives used today to try to reduce breaches... There are a few other available options today to improve internal data center security. Both have their own challenges and ultimately are not operationally feasible. Adding more internal security Requires placing more firewalls across workloads Internet Physical firewalls Cost prohibitive: thousands of firewalls needed (1 per VM) Complex configuration: security policies restricted by network topology Inefficient choke point firewalling Impractical to build lateral coverage Virtual firewalls Data Center Perimeter Similar to physical firewalls, only slower performance No micro-segmentation Limited central management Costly and complicated

7 Data Center Security with NSX Micro-Segmentation CONFIDENTIAL 7

8 The Explosion in East-West Traffic Internet North-South Client-Server traffic East-West Inter-Server traffic 70%

9 Infrastructure Provisioning today Minutes Days - Weeks VM Network Security App Environment Switch Router Firewall Load Balancer Connect Ethernet cables, configure switch port, VLANs, access control lists, assign IP addresses Configure router interface to connect to switch ports. Configure routing protocols. Connect networks to firewall appliances, configure firewall rules based on physical constructs e.g. IP address and VLANs Connect networks to load balancer appliances, create and populate load balancer pool, assign Virtual IP Address to external interface NETOPS SECOPS LOAD BALANCER ADMIN

10 Three Reasons Companies Virtualize Their Network 1 Speed On Demand Apps and Services 2 Economics Opex Efficiency & Capex Cost Savings 3 Security Re-Architect Datacenter Security

11 What is NSX? Provides A Faithful Reproduction of Network & Security Services in Software Switching Routing Firewalling Load Balancing VPN Connectivity to Physical 11

12 Compute Virtualization Internet

13 A Network Hypervisor Internet

14 The Operational Model of a VM for the Networking Internet

15 The next-generation networking model Software Network and Security Services Now in the Hypervisor Load Balancing L3 Routing L2 Switching Firewalling/ACLs Hardware

16 Services Distributed to the Virtual Switch VXLAN tunnel Tunnel End Points

17 Native Isolation Multi Tenant Identical IP addresses

18 NSX Zero Trust Model A new model for data center security STARTING ASSUMPTIONS DESIGN PRINCIPLES 1 Isolation and segmentation Assume everything is a threat 2 Unit-level trust / least privilege and act accordingly. 3 Ubiquity and centralized control

19 Simpler operations with scale-out performance Hypervisor-based, in kernel distributed firewalling High throughput rates on a per hypervisor basis Every hypervisor adds additional east-west firewalling capacity Platform-based automation Automated provisioning and workload adds/moves/changes Accurate firewall policies follow workloads as they move

20 Granularity to the VM with Distributed FireWall DVS Every Virtual Machine has it s own firewall If the Virtual Machine moves, the firewall moves with it If the Virtual Machine goes away, so does the firewall

21 The Operational Model of a VM Hypervisor-based, in kernel distributed firewalling Platform-based automated provisioning and workload adds/moves/changes Security Policy Cloud Management Platform Internet Perimeter Firewalls 21

22 Micro-segmentation Options Isolation Segmentation Advanced services No communication path between unrelated networks No cross-talk between networks Overlay technology assures networks are separated by default Controlled communication path within a single network Fine-grained enforcement of security Security policies based on logical groupings of VMs Advanced services: addition of 3 rd party security, as needed by policy Platform for including leading security solutions Dynamic addition of advanced security to adapt to changing security conditions

23 Advanced Services Insertion Example: Palo Alto Networks NGFW Security Admin Security Policy Traffic Steering Internet

24 Security Extensibility in the Guest Vulnerability Management Gain previously impossible vulnerability intelligence based on application purpose, data class and user roles to drive rich, policy-driven response, including in-place quarantine. Malware/AV Protection Real-time, dynamic threat response that follows applications as they migrate between hosts, data centers and cloud environments. 24

25 Automated Security in a Software Defined Data Center Quarantine Vulnerable Systems until Remediated Policy Definition Standard VM Policy Anti-Virus Scan Quarantined VM Policy Firewall Block all except security tools Anti-Virus Scan and remediate Security Group = Web Tier Security Group = Quarantine Zone Members = {Tag = ANTI_VIRUS.VirusFound, L2 Isolated Network} 25

26 Cross-vCenter with NSX

27 NSX Logical Networking and Security (6.1 and earlier) NSX Controller Cluster NSX Controller Cluster NSX Controller Cluster vc with NSX Manager vc with NSX Manager vc with NSX Manager vcenter A vcenter B vcenter C Local VC Inventory Local VC Inventory Local VC Inventory Distributed Logical Router Distributed Logical Router Distributed Logical Router Logical Switch Logical Switch Logical Switch Single NSX Domain can span more than one site CONFIDENTIAL 27

28 Cross-VC Logical Networks (NSX 6.2) Universal Object Configuration (NSX UI & API) Universal Configuration Synchronization Universal Controller Cluster vcenter & NSX Manager A Primary vcenter & NSX Manager B Secondary vcenter & NSX Manager H Secondary Local VC Inventory Local VC Inventory Local VC Inventory Universal Distributed Logical Router Universal Logical Switches Universal DFW CONFIDENTIAL 28

29 Cross-VC NSX Use Cases Increase the span of NSX logical networks to enable: Capacity Pooling across multiple vcenter Servers Non disruptive migrations Cloud and VDI deployments vcenter Server A vcenter Server B vcenter Server C DB App Web App Web DB Web App DB CONFIDENTIAL 29

30 NSX as a Service Insertion Platform: Service Categories and Partners NSX Partner Extensions Physical-to-Virtual Services Operations and Visibility Application Delivery Services Security Services

31 Cross-VC NSX Use Cases Centralized security policy management One place to Manage FW rules Rules enforced regardless of VM location and VC Universal Firewall Policy CONFIDENTIAL 31

32 Cross-VC NSX Use Cases NSX 6.2 supports new mobility boundaries in vsphere 6 Enable Cross VC and Long Distance vmotion On existing networks, with no new hardware required vcenter-a vcenter-b <= 150ms RTT VDS-A VDS-B VXLAN Transport (L3) & vmotion Network (L3) CONFIDENTIAL 32

33 VMware NSX Summary and Takeaways Network provisioning time is reduced from days to minutes Operational efficiency is achieved through automation Place and move workloads independently of physical topology Integrate third-party network and security solutions through standard APIs Non-disruptive deployment over existing physical networks or next generation topologies Faithful reproduction of L2 L7 network & security services Logical Switching Logical Routing Logical Firewall Logical Load Balancer Logical VPN NSX Edge P-V Gateway Services are designed for scale-out All NSX components are designed with resiliency Multi-Data Center spanning with

34 Thank You