This document discusses using Red Hat OpenStack Platform and micro-segmentation to securely deploy financial services clouds. It covers common OpenStack security challenges, how Red Hat OpenStack Platform addresses these challenges through automation and templates, and how micro-segmentation provides isolation and strict access controls. The presentation then demonstrates micro-segmentation using virtual domains to separate workloads and apply fine-grained security policies in a demo.

1. Design and Deploy Secure Clouds
for Financial Services – Use Cases
August 18, 2016

2. Copyright © PLUMgrid, Inc. 2011-2015
Introduction
Speakers
2
Principal Solutions Architect
Justin Moore
Sr. Solution Architect – OpenStack Tiger Team
Joe Antkowiak
PLUMgrid
Red Hat

3. Copyright © PLUMgrid, Inc. 2011-2015
Agenda
What’s will be covered today
3
1 OpenStack Infrastructure Security
- Addressing Common Security Challenges using
Red Hat OpenStack Platform
Security and compliance through automation and
micro-segmentation with OpenStack and SDN
Micro-Segmentation Demo3
2

4. OpenStack Infrastructure Security
Addressing Common Security Challenges
using Red Hat OpenStack Platform
Joe Antkowiak
Sr Solution Architect
August 18, 2016

5. Agenda
 Common OpenStack Infrastructure Security Challenges
 Addressing Challenges with Red Hat OpenStack Platform Director
 Addressing Challenges with Red Hat CloudForms

6. OpenStack Infrastructure Security
Common Challenges
 Many Manual Tasks
 Infrastructure Secured Post Deployment
 Detecting Change and Enforcing Policy
 Maintaining Secure Configuration and Policy
When Upgrading and Scaling

7. <footer>
OPENSTACK PLATFORM DIRECTOR
DAY 1 + SCALING/UPGRADING
Director is included in Red Hat OpenStack
Platform
CLOUDFORMS
DAY 2 + LIFECYCLE
CloudForms is included in Red Hat
OpenStack Platform

8. <footer>
Red Hat OpenStack Platform Director
DEPLOYMENTPLANNING OPERATIONS
Updates and upgrades
Scaling up and down
Change management
Deployment orchestration
Service configuration
Sanity checks
Network topology
Service parameters
Resource capacity
OpenStack Orchestration

9. OpenStack Platform Director (OSPd)
Advantages for OpenStack Security
USES OPENSTACK TO DEPLOY OPENSTACK
Concepts applicable to workloads running on OpenStack
are applicable to OpenStack itself
IMAGE BASED
Nodes installed from a customize-able source image
TEMPLATE BASED
Customize-able, reusable, repeatable use of Heat
templates (YAML) to install, scale, and upgrade

10. OSP Director Image Customization
Image Customization Examples for Security
KERNEL
Deploy a custom kernel build, or hardened kernel (with
validation)
PACKAGES
Deploy specific package versions or additional packages
LOCAL ACCOUNTS AND POLICIES
Define custom local accounts and SELinux configuration

11. OSP Director Template-Based Deployment
Template-Based Configuration Examples for Security
SSL/TLS ENABLED CONTROL PLANE AND ENDPOINTS
Enable transport encryption on all control plane
communication using your certificates
AAA INTEGRATION
Integrate with your AAA infrastructure (LDAP, Kerberos,
etc)
SERVICES CONFIGURATION
Configure Logging, NTP, Monitoring Tools

12. <footer>
Red Hat CloudForms
UNIFIED
MANAGEMENT
AND
OPERATIONS
COMPLETE
LIFECYCLE
MANAGEMENT
VISIBILITY
AND
ANALYTICS
COMPLIANCE
AND
GOVERNANCE
INTEGRATION AND
COMPOSABILITY
Unified Management for OpenStack

13. CloudForms Compliance and Governance
ANALYZE
Automatically perform SmartState Analysis on
OpenStack Nodes and Instances (agent-less)
TRACK AND ALERT
Report on changes and drift, automatically alert based
on defined policy
REMEDIATE
Automatically kick off defined remediation or deeper
inspection actions
Example Functions

14. CloudForms SmartState Analysis
Examples of Items Tracked
PACKAGES AND FILES
Package versions, new/changed files
LOCAL USERS AND ACTIONS
User actions/commands, users and groups added or
changed
COMPONENT CHANGES
Added or changed network interfaces, storage attached,
new instances or containers running

15. Thank you!
Please Post Questions in Webinar
Visit Red Hat at OpenStack East
August 23-24, NYC
red.ht/openstack
red.ht/cloudforms

16. Security and compliance through automation and
micro-segmentation with OpenStack and SDN
Justin Moore

17. Copyright © PLUMgrid, Inc. 2011-2015
• Regulatory Compliance
• PCI
• SOX
• Security
• Separation of concerns
• Minimize attack surface
• Strict enforcement of access control
• Operations
• Reduce manual effort through automation
• Protect against misconfiguration
• Dev/Test pointed to Prod
• Incorrect or invalid firewall rule
• Server placed on wrong network
• Rapidly scale
Technology Challenges in FSI

18. Copyright © PLUMgrid, Inc. 2011-2015
• Too slow
• Ticket based manual workflows take days or weeks
• New methodologies demand on-demand
infrastructure, and tight integration with the SDLC
• Agile
• CI/CD
• Micro-services
• Error prone
• Lack of automation and standardization leads to
errors
• Incomplete or inadequate de-comission processes
• Too expensive
• Scale-up Access Control devices/Forklift upgrades
• Highly skilled and highly paid engineers performing
trivial ticket based activities
Traditional Approaches No Longer Work
18

19. Copyright © PLUMgrid, Inc. 2011-2015
• Cloud!
• Ok – it’s not really that simple. What about all of
that security stuff?
• SDN!
• Again – it’s not really as simple as buying an
SDN.
• How will we design the system to ensure that
security is baked into the end-to-end environment?
• Micro-segmentation
• Great – another buzzword!
• Micro-segmentation is the process of controlling
access to and from a service based on the
combination of security boundary and attack foot-
print
• Don’t we already do that?
• Not really!
So How Do We Keep Up?
19

20. Copyright © PLUMgrid, Inc. 2011-2015
Virtual Domains
Your Private Virtual Data Center
20
• Tenant Virtual Domains
• Isolation & segmentation of workloads
• Self-service provision of all functions
• Service Virtual Domains
• Owned by Cloud Operator
• Used to apply common services or security
policies
• Hosts external connectivity
• Virtual Domain Chaining
• Decouple changes from physical
infrastructure
• Fully distributed within IO Visor layer on
each compute node
DNS
Service Virtual Domain
Tenant Virtual Domains

21. Copyright © PLUMgrid, Inc. 2011-2015
PLUMgrid Virtual Domains
Components of a Virtual Domain
21
Virtual Domain
DistributedPolicy
EnforcementZone
Edge Policy
Enforcement Point
Virtual Domain (VD) — ISOLATION
• Secure Tenant Isolation for multi-tenant clouds
Contains all Network definitions for that Project
• Rich set of analytics and monitoring
• Option to encrypt traffic on a per VD basis
Topology — Overlay based fully
Distributed Network Functions
• Network topology view
• DVS/DVR/NAT/DNS/DHCP functions
• Fully Distributed (No hairpin or network nodes)
• Integration with external VTEP Gateways
• Topology based Service Insertion (FW/LB/IPS)
Policy boundary — SEGMENTATION
• Group Based Policies & Micro-segmentation
• All traffic in-out of VD goes through Policy Engine
• Used for Security Groups (L2-4 stateless or state-
full security)
• Policy based VTAP (traffic capture)
• Policy based Service Insertion (FW/LB/IPS)
• Support for Service Chains or single Service
Function

22. Copyright © PLUMgrid, Inc. 2011-2015
PLUMgrid ONS Components
22
Internet
IO Visor Gateway
IO Visor Edges (Compute Nodes)
PLUMgrid Directors
VXLAN-based
Overlay
PLUMgrid CloudApex & OpsVM

23. Copyright © PLUMgrid, Inc. 2011-2015
Example Application – Customer Service Tool
23
DNS
Global Cloud Policy
Prod CSTDev CST

24. Copyright © PLUMgrid, Inc. 2011-2015
Three-Tier Architecture
Presentation tier
Logic tier
Data tier
Database Storage
GET LIST OF ALL SALES
MADE LAST YEAR
ADD ALL SALES
TOGETHER
> GET SALES
TOTAL
> GET SALES
TOTAL
4 TOTAL SALES
QUERY
SALE 1
SALE 2
SALE 3
SALE 4

25. Copyright © PLUMgrid, Inc. 2011-2015
PLUMgrid Policy Path
25
Group
Classification
(source &
destination End
Point classification)
Packets
- sMAC / .1Q
- src_IP/dst_IP
- Application / Ports
- Protocols
Meta Data
- Tenant ID / App ID
- VM UUID / Name
- End Point Type / Group
- Location / physical Server
Behavior
- Traffic Profile
- Sys Call profile
- Storage Access Profile
Stateful
Security
Groups
Security
Logs &
Alerts
Policy
based
VTAP
Traffic
mirroring
Policy
based
Service
Insertion
VNF
1
VNF
2
VNF
3
- Service Chains
- Distributed Service Insertion
- Local Affinity

26. Micro-Segmentation Demo
26

27. Q&A
Please use the Q&A panel to ask questions

28. Copyright © PLUMgrid, Inc. 2011-2015
THANK YOU!