Secure Multi Tenancy In the Cloud
1 like734 views
The document discusses the challenges and opportunities of secure multi-tenancy in cloud environments, focusing on increased insider threats and the need for strong compliance and oversight. It outlines the complexities introduced by virtualization, including the need for security and management for heterogeneous virtual machine platforms, as well as the implications of VM mobility on privacy laws. The document details mobile VM workloads and the approaches for implementing effective security policies and resource segregation in both shared and dedicated models of multi-tenancy.
Secure Multi Tenancy In the Cloud
- 1. Secure Multi Tenancy In the Cloud Boris Strongin VP Engineering and Co-founder, Hytrust Inc. bstrongin@hytrust.com
- 2. At-a-Glance Trends Increased Insider Threat Do MORE with LESS Increasing IT spend on cloud IT budget remains almost flat 1H11 2H11 1H12 2H12 ~10-35% virtualized ~35-50% virtualized ~50-80% virtualized Major vendors: Repurpose and Aggregate Major vendors: Purpose-built - Resource constraints - Compliance - Many point solutions Pain - Lack of skills - Loss of control - Multi-tenancy - Access control - Lack of visibility - Data protection - Infrastructure/Platform (influenced by Security) - Business Application Owner (approval by Buyer - Ad-hoc Security/Compliance/Risk)
- 3. Virtualization Challenges and Opportunities The blurring line between Security and Management — Need to manage the complexity also in Security − Heterogeneous VM platforms create security complexity − Vary in approach to security and management — Unstructured physical boundaries make it harder to protect services and data − VM mobility/distribution, copying/cloning, memory protection, etc. − Where can my data migrate to? And who are my neighbors? — Unstructured time dimension challenges integrity − VM reversion can result in lost audit events, security configurations, security policies, etc. — Virtualization Servers are subject to regulatory controls − Physical systems are at greater risk as VMs share hardware − Enhanced need for segregation of duties - New level of administration is introduced with the Hypervisor / Privileged Partitions − Implication of VM mobility to privacy laws.
- 4. Virtualization Platform Effects on Security Abstraction and Collapse of switches and Faster deployment in Consolidation servers into one device shared environment • ↑ Capital and Operational • ↑ Flexibility • ↑ IT responsiveness Cost Savings • ↑ Cost-savings • ↓ Inconsistencies in • ↓ New infrastructure layer • ↓ Lack of visibility and configuration to be secured and subject control for virtual network • ↓ Physical change to compliance and storage processes ineffective • ↓ Greater impact of attack • ↓ No separation of church • ↓ Inadequate tenant or misconfiguration and state (network, segmentation security, storage administration)
- 5. Virtualization Containers Effects on Security Fuzzy time boundaries VM Mobility VM Encapsulation • ↑ Great availability / • ↑ Improved Service • ↑ Ease DR recovery mechanism Levels • ↑ Hardware Independence • ↓ Security and audit • ↓ Identity divorced from • ↓ Outdated offline systems events can be lost physical location • ↓ Unauthorized copy • ↓ Changes in time are • ↓ Policies may not • ↓ Reconfiguring virtual not visible from inside follow virtual machine hardware and console the virtual server access are over the network operations
- 6. New Security and Control Challenges in the Cloud — Investment in Cloud is growing due to agility, economic and operational benefits − Enterprises adopt private cloud first, with strategy to go to hybrid and public cloud in the future — Tenants need to retain control and audit capabilities − Tenants are ultimately responsible for compliance and standard of care of their workloads − Automation and self-service capabilities are required — Providers need to manage complexity and enforce security − Infrastructure as a service management including hypervisor and VM containers − Compliance and security management as a premium service public cloud app 3 app 3 app 1 app 1 app 2 app 3 customer 1 customer 2 customer n enterprise private cloud app 3 enterprise datacenter app 1 app 2 app 3 app 3 hyper visor app 1 app 2 app 3 hardware app1 app2 app3 hyper visor hyper visor hardwar hardwar hardwar iam e e e hardware hardware iam
- 7. Co-management Accountability • Access rules per resource; identities, credentials, roles, groups Transparency • Workload location, infrastructure segmentation and segregation Visibility • Per-tenant audit logs and reporting
- 8. Secure Multi-Tenancy — Logical infrastructure segregation to provide tenant-level separation for service providers as well as application and line-of-business multi-tenancy for enterprises — Policy labels used to provide resource-level classification (tenant, application tier, security zone, etc.) which provide compute, network and resource segregation — Persistent policy labels for mobile VM workloads (hybrid cloud) — Self service tied to tenant- and resource-level policy labels — Per-tenant audit logging for virtual infrastructure and VM- level administrative changes
- 9. Security zones and multi-tenant policies in the “shared” model Security Requirements: “Shared” Model: User can select default security policy for each instance of sandbox/template within a shared compute pool. Security Zone (non-optional) has defined security policy. Compute, storage and network resources shared as a pool with ability to offer isolation. Security Policy Enforcement: Each sandbox and VM/server instance gets classified during provisioning by applying tags. a) Tenant/departmental ownership b) Zone requirements c) Custom security posture requirements d) Real-time tags based on internal VM metadata Security policy gets enforced by HyTrust Appliance in real time based on sandbox tags (policies are global and/or tenant specific). Policy includes segmentation of resource pool/zone and network.
- 10. Security zones and multi-tenant policies in the “dedicated” model Security Requirements: “Dedicated” Model: Each Compute Pool (configured on a per-tenant basis) has a Security Zone and Policy. Complete isolation between the tenants. Security Policy Enforcement: “Dedicated” Model (higher security) - Each compute pool gets labeled based on tenant ownership and security configuration. a) Policy includes segmentation by resource pool/zone and network. b) Security policy gets enforced by HyTrust Appliance in real time based on sandbox tags (policies are global and/or tenant specific). c) The policies enforce access control and compliance (controlling privileged access to the host, separation of duties, audit reporting, etc). d) Security policies (tags) are selected by a service consumer as a part of reservation management process (low, medium, high) for the type of workload (web, database, etc.) requested.