Cloud Security Axians Carrier & Broadband Days. Christof Jungo C1, Public (Axians Carrier Days) September 15 Darmstadt

Transcription

1 Cloud Security Axians Carrier & Broadband Days Christof Jungo C1, Public (Axians Carrier Days) September 15 Darmstadt

2 C1, public use (Axians Carrier Days) Cloud 2002 Expo.02 artificial physical cloud in Yverdon (Switzerland) 2

3 Swisscom Cloud A unified approach to build a 360 Cloud 3 IaaS Enterprise Cloud IT Architect Used by everybody: For consuming services, building services, building platforms Open Standards: no lock-in Cloud Workload SaaS Service Cloud PaaS Application Cloud End user Application Developper Scalable: based on requirements, time and budget Simple: a standardized platform Location independent: in Tier 3 / 4 datacenters as well as on customer premises

4 Swisscom Security Our Aspiration: «We build security for people in a connected world always and everywhere» 4 Download our Cyber Security Report Basis Innov. detection English Deutsch Simple security Français Italiano

5 Cloud - Overview Security Architecture 5 Access Security Monitoring Internet Perimeter SEPs Orchestration Security Metering Cloud Workload Server Virtualisation Network Virtualisation Security Reporting Identity & Access Management Policy & Config Management Secure Software Dev. Life Cycle Security Services Trusted Computing User centric encryption Infrastructure Management Perimeter SEPs Cloud Hosting SEPs Self encrypting drives

6 What is SDN and how to get there? Defintion and chosen path to SDN 6 SDN is an approach to computer networking that allows network administrators to manage network services through abstraction of lower level functionality 1 Swisscom chose the path of decoupling and abstracting the network layer using overlay implementing VXLAN technology Build and buy (development and integration) The following use cases are in focus: IaaS, PaaS and SaaS Services in our datacenter pcloud in our datacenter and on customer premise 1

7 WL A WL A WL A WL B WL C WL B WL B WL C WL D WL D WL E WL F The power of virtualisation Flexibility first 7 DC 1 DC2 Customer DC 1 2 Layer 2 topology WL A Workload A Customer 1 WL A Workload A Customer 2 WL A Workload A Customer 3 A B C D E F 3 Layer 3 topology Hypervisor Hypervisor Hypervisor SDN C / S N C / S N C / S N A B C D E F 1 Dynamic moving of workloads 2 Dynamic sizing of workloads (Openstack) 3 Deployment of L2 or L3 network topologies

8 Securing the cloud stack with SDN Workload and perimeter protection 8 Security Appliance Security Appliance (Domain) vrouter 4 (Domain) Network virtualisation SDN vdomain A vdomain B With the cloud, and the Internet of things the network perimeter disappears. The existing security dispositive, which today is designed to protect the perimeter, is supplemented by a content-based dispositive. vswitch Security Appliance (Stack) Host (EXSi) vswitch Security Appliance (Stack) Host (KVM) Protecting the workload (Customer) 2 Protecting the stack (Provider) 3 Protecting the virtual domain (Customer) 4 Protecting the perimeter (Customer) (Guest) WL WL WL WL Intrastack Interstack (Guest) Host virtualisation Interdomain 1 SDN supports security in creating adaptive and chainable traffic channels to insert security services in order to respond to changing threats

9 SDN NFV Definition of Network Function Virtualisation 9 NFV Network Services in VM format (also valid for security services) Benefits of virtual appliances Costs Better hardware utilization Replacing hardware with software subscription Pay-as-you-go model Deployment Increased flexibility: deploy any service on a generic pool of compute resources Reduce time-to-deployment (no hardware provisioning) favors the service chaining (better reaction to changing threat landscape) Drawbacks New technology (missing standards & horse races) Increased complexity (more software, more API, more virtualization) Performance & latency Introduction of new security issues

10 Securing the workloads in SDN Comparing virtual to physical security appliances 10 WL SDN Virtual security appliance (NFV in most cases) Benefits Increased flexibility (deployment of new vendors) Replacing hardware with software subscription Reduce time-to-deployment (no hardware provisioning) Drawbacks (by today) Network performance Fixed resource allocation (e.g. 2 CPU, 1GByte) Latency in the case of service chaining Uncomprehensive license model (CPU/Mem) Multi- tenancy: Missing separation Not feasible for VM2VM encryption Orchestration WL SDN Physical security appliance (if fully integrated in SDN) Benefits Network performance Low latency in case of service chaining Feasible for VM2VM encryption Drawbacks (by today) license model not feasible (pay per use) Not feasible for IDS services Hardware deployment (vendor lock-in) WL Benefits SDN Mixed Mode The mixed mode is a cooperation / coexistence between physical and virtual security appliances. Goal is to eliminate the drawbacks of scenario A and B. Drawbacks (by today) Joint development between Swisscom and Fortinet Integration work needs to be done

11 Pay per use Comparing billing models 11 License (nbr) License(avg.) Fixed license model Used in predictable environments like enterprise networks with determined set of devices (router, switches, firewalls) t (year) License (nbr) License(avg.) Quarterly reviewed licenses model License (nbr) Q1 Q2 Q3 1 Q1 Q2 Q3 2 Q1 Q2 Q3 3 t (year) License(avg.) Typically used in provider environments for enterprise client/server services (software licenses like client access licence, security endpoint protection) Pay per use model Q1 Q2 Q3 1 Q1 Q2 Q3 2 Q1 Q2 Q3 3 t (year) Use in unpredictable environments like cloud provider areas. Billing on inspected traffic for security services

12 12