VMworld 2014: The Goldilocks Zone
•
1 recomendación•688 vistas
The document discusses the opportunities and challenges of securing modern IT infrastructure and applications in the software-defined data center (SDDC). It outlines three key architectural issues: 1) the need for logical segmentation around application boundaries, 2) orchestrating security policies across multiple controls, and 3) providing the right context and isolation for security tools. The document argues that virtualization provides the "Goldilocks zone" to address these issues by placing security controls and services into the virtualization layer to enable micro-segmentation, advanced context sharing between tools, and policy orchestration across applications and infrastructure. It presents a case study of how one company addressed these challenges through a virtualization-based security approach.
Recomendados
Recomendados
Más contenido relacionado
La actualidad más candente
La actualidad más candente (20)
Similar a VMworld 2014: The Goldilocks Zone
Similar a VMworld 2014: The Goldilocks Zone (20)
Más de VMworld
Más de VMworld (20)
Último
Último (20)
VMworld 2014: The Goldilocks Zone
- 1. The Goldilocks Zone: Security and Architectural Implications of the SDDC SEC1959-S Tom Corn SVP, VMware, Inc. – Security Products
- 2. Securing the Data Center 2 NETWORK STORAGE INFRASTRUCTURE MANAGEMENT & ORCHESTRATION COMPUTE IT INFRASTRUCTURE APPLICATION INFRASTRUCTURE NETWORK DFW, IDS/IPS, NGFW, WAF, AMP, SWG, DDoS STORAGE Encryption, Key Management, Tokenization GOVERNANCE/COMPLIANCE Vulnerability Mgmt, Log Mgmt, GRC, PUAM, Security Posture Management, DLP COMPUTE AV, HIPS, AMP, Encryption, Execution & Device Control SOC SIEM, Security Analytics, Forensics SECURITY INFRASTRUCTURE IDENTITY CONTROLS IAM, IAG, Authentication, Access Control, Federation/SSO APP/DATABASE CONTROLS App/DB Activity Mon, App/DB Encryption, Fraud Analytics
- 3. A Picture of Diminishing Returns 3 The Only Thing Outpacing Security Spend… Is Security Losses IT Spend Security Spend Security Breaches
- 4. Kill Chain: Anatomy of a Modern Attack 2 Attack Vector R&D 1 Human Recon 3 Delivery Mechanism 1 Prep 2 Intrusion 3 Recon 4 Recovery 5 Act on Intent 6 Exfiltration
- 5. 5 Install Command & Control I/F 4 Compromise Primary Entry Point Strain B Dormant Strain A Active 2. Intrusion
- 6. 8 Install C2 I/F Wipe Tracks Escalate Priv 7 Lateral Movement 6 Escalate Privileges on Primary Entry Point 8 8 Strain A Active 3. Recon
- 7. 9 Wake Up & Modify Next Dormant Strain Attack Identified Response Strain B Active Strain A Active Strain C Dormant Strain D Dormant 4. Recovery
- 8. 11 Parcel & Obfuscate 10 Break into Data Stores 12 Exfiltration 13 Cleanup 5. Act on Intent 6. Exfiltration
- 9. Modern Attack: targeted, interactive & stealthy 9 1 Human Recon 2 Attack Vector R&D 3 Delivery Mechanism 5 Install Command & Control I/F 4 Compromise Primary Entry Point Strain B Dormant Strain A Active 8 Install C2 I/F Wipe Tracks Escalate Priv 7 Lateral Movement 6 Escalate Privileges on Primary Entry Point 8 8 Strain A Active 9 Wake Up & Modify Next Dormant Strain Attack Identified Response Strain B Active Strain A Active Strain C Dormant Strain D Dormant 11 Parcel & Obfuscate 10 Break into Data Stores 12 Exfiltration 13 Cleanup Stop Infiltration Lack visibility & control to stop exfiltration shift from… • Perimeter-centric • In-line prevention • Managing compliance to... • Application & user-centric • Analytics/Out-of-band mitigation • Managing risk
- 10. 3 Architectural Issues 10 As a ubiquitous abstraction layer between the applications and the infrastructure it provides the “Goldilocks Zone” for security. Virtualization is the Key Logical Segmentation Problem Lack ability to segment around application boundaries 1. Segmentation Compound Policy Problem Lack mechanisms to orchestrate policy across controls 2. Policy Context/Isolation Tradeoff Lack the right telemetry / “handles” for security controls 3. Context Common Thread: The Application
- 11. The Logical Segmentation Problem CONFIDENTIAL 11 Hyper-connected Computing Base Lateral Movement Complex/Comingled Policy Enforce segmentation around application boundaries versus the perimeter, physical zones or machines The Solution We have no mechanism that maintains the relationship between the applications & the infrastructure. The Obstacle
- 12. The Compound Policy Problem CONFIDENTIAL 12 C1 C2 C3 Right Place Right Order Share State Choke Points / Scalability A mechanism to insert and order security controls and policy around logical boundaries, and a mechanism for them to publish and share state The Solution No such mechanism exists. We can insert on physical boundaries, and share state via point integrations and correlation. The Obstacle Complex Distributed Policy ? Sharing State
- 13. The Context/Isolation Tradeoff CONFIDENTIAL 13 Policy è ç Analytics Context Isolation Endpoint Network êé ê é HTTP://192.163.8.10:8080 HTTP://192.159.2.10:8080 HTTP://192.162.5.8:8080 Poor Handles/Telemetry for Policy/Analytics 10.20.2.14 09:00:02:A3:D1:3D 10.18.3.13 08:00:03:A4:C2:4C A ubiquitous mechanism for communicating telemetry with security controls that has the isolation properties of a network control point and the context of an endpoint agent. The Solution No such mechanism exists. We are forced to make the tradeoff. The Obstacle
- 14. 3 Architectural Issues CONFIDENTIAL 14 1 Common Thread: The Application Virtualization is the Goldilocks Zone for Security • Segment along application boundaries and compliance scopes • Provision and order controls along those boundaries • Share context to and among controls If we could… • Reduce our attack surface • Simplify our policies • Improve the effectiveness of all our controls …then we can dramatically… Logical Segmentation Problem Lack ability to segment around application boundaries 1. Segmentation Compound Policy Problem Lack mechanisms to orchestrate policy across controls 2. Policy Context/Isolation Tradeoff Lack the right telemetry/”handles” for security controls 3. Context
- 15. Putting Security Controls into the Virtualization Layer 15 Context Security/Telemetry Security Service Provisioning & Orchestration Built-in Controls Isolation/Segmentation/Access Virtual Infrastructure NETWORK DFW, IDS/IPS, NGFW, WAF, AMP, SWG, DDoS STORAGE Encryption, Key Management, Tokenization GOVERNANCE/COMPLIANCE Vulnerability Mgmt, Log Mgmt, GRC, PUAM, Security Posture Management, DLP COMPUTE AV, HIPS, AMP, Encryption, Execution & Device Control SOC SIEM, Security Analytics, Forensics SECURITY CONTROLS
- 16. Micro-segmentation CONFIDENTIAL 16 Logical segmentation around application boundaries App DMZ Services DB Perimeter firewall AD NTP DHCP DNS CERT App 1 App 2 App 3 Inside firewall
- 17. Micro-segmentation CONFIDENTIAL 17 Isolation Explicit Allow Comm. (Default Deny) Secure Communications Structured Secure Communications NGFW IPS IPS NGFW WAF IPS
- 18. Advanced Context 18 The hypervisor can bridge the context / isolation gap Context Isolation Endpoint Agent Virtualization êé é Network Device ê é é
- 19. Policy Orchestration 19 Advanced Malware Protection à DEFCON Security Group = DEFCON 1! Members = {Tag = ‘AdvancedMalware.Suspicious’, DEFCON Network} ! Security Group = Web Tier! Policy Definition Standard Web Policy þAdvanced Malware Protection DEFCON 1 Policy þ Gateway Authentication 1 à 2 Factor þ Ratchet back Access Controls þ Increase Logging
- 20. Case Study WestJet Airlines Richard Sillito Solution Architect, IT Security WestJet Airlines
- 21. The Call to Action A Once in Wave Opportunity 1st Wave Mainframe | Terminal Millions of Users Thousands of Apps 2nd Wave PC | Client/Server | LAN/Internet Hundreds of Millions of Users Tens of Thousands of Apps 3rd Wave Cloud/SDDC | Mobile | Social | Big Data Billions of Users. Millions of Apps. Trillions of Devices Security Teams Security Vendors Virtualization The Goldilocks Zone for Security
- 22. Thank You
- 23. Fill out a survey Every completed survey is entered into a drawing for a $25 VMware company store gift certificate