Protecting the un-protectable Addressing Virtualisation Security Challenges Paul Hogan, Technical Director, Ward Solutions November 11, 2010
Top Cloud Security Challenges Secure Virtualisation Need secure virtualisation as virtualization vulnerabilities grow Threats / vulnerabilities / configurations Every new virtual machine is: a new hacking target a new source of infection across a network. Out-of-date security makes offline images more vulnerable. It is more cost-effective to include security in an initial vm deployment than to add it later. Virtualisation changes the definition of an endpoint No longer system now data Virtual images built of fly redefine the notion of an asset Virus Spam Trojan Worms DDoS Vulnerabilities Virtual Machine Apps Virtual Machine Apps Hypervisor Out-of-date offline images Offline Virtual Image Apps
Through 2012, 60% of virtualized servers will be less secure than the physical servers they replace, dropping to 30% by 2015 And Survey data in late 2009 indicated that about 40% of virtualization deployment projects were undertaken without involving the information security team in the initial architecture and planning (Gartner 2009)
Virtualisation Security What to consider 1) Hypervisor Security Hardening hypervisors Securing Virtual Infrastructure consoles 2) Offline virtual images Virtual Machine Virtual Machine Offline Virtual Image Rogue VMs, Stale VMs Apps Apps Apps Patching and keeping up to date 3) Intra VM traffic Multi Tenancy in the Cloud 4) Storage Security Authentication Hypervisor Audit logging Encryption
Thus, the task is not so much to see what no one yet has seen, but to think what nobody yet has thought about that which everybody sees (Arthur Schopenhauer (19th Century Philosopher)
McAfee Approach Broad Secure Virtualisation Support ToPS for Virtualization VirusScan Enterprise (VSE) VirusScan Enterprise for Offline Virtual Images Host Intrusion Prevention Network Access Control epolicy Orchestrator Network Security Platform Firewall Enterprise/Virtual Appliance Vulnerability Manager Policy Auditor Remediation Manager Email and Web Security Appliance McAfee meets your secure virtualization needs
And now a warning (Isabella Rossellini, Death Becomes Her )
The Virtualisation Security Challenge How to strike the right balance KEY CHALLENGE How to provide operationally-friendly security that does not hinder server performance or VDI deployment THE PAIN For Servers, performance is crucial. Classic AV is seen as sub-optimal, and therefore sparingly deployed Leaving servers susceptible to Malware Insider attacks Data breaches - For VDI deployment, classic AV processes will reduce device density below planned levels Confidential McAfee
I love it when a plan comes together (Hannibal, The A Team )
McAfee MOVE enables Security for Virtualization VM Applications MOVE VM Applications MOVE MOVE Service VM Off-load Processing Hypervisor epo McAfee epo Client Virtual Desktop Client McAfee MOVE Provides off-loading of security processing Allows for context aware security regardless of where provisioned in the environment Consistent security management from physical to virtual system with e-policy Orchestrator Virtual Desktop Testing with Citrix has shown 3x improvement in virtual machine density achieved when using MOVE AV for VDI MOVE AV for Virtual Servers Scan based on load of hypervisor VM-tagging for security mgmt. Offline Scanning (OVI)
We're gonna need a bigger boat (Chief Brody, Jaws )
Using the Cloud - Global Threat Intelligence Delivering the Most Comprehensive Intelligence in the Market Threat Intelligence Feeds Endpoints Appliances Servers Firewalls Other feeds & analysis McAfee Labs File Reputation Engine Email Reputation Engine Web Reputation Engine Network Reputation Engine Vulnerability Information epo IPS Firewall Email Web AV AWL DLP Mobile
How does GTI work? Internet 1 User receives new file via email or web 2 No detection with existing DATs, but the file is suspicious 6 VirusScan processes information and removes threat Artemis 3 4 Fingerprint of file is created and sent using GTI GTI reviews this fingerprint and other inputs statistically across threat landscape 5 GTI identifies threat and notifies client Collective Threat Intelligence 13 November 19, 2010