Securing virtual workload and cloud
Download as PPTX, PDF1 like480 views
The document discusses cloud security in virtualized data centers, identifying flaws in traditional security approaches and proposing multi-layered security solutions, particularly with VMware NSX. It emphasizes the importance of visibility, monitoring, and automation in securing workloads, with specific focus on micro-segmentation and dynamic security policies. The ideal security solution should encompass a comprehensive approach that includes both layer 4 to layer 7 security measures, proactive threat detection, and streamlined logging for effective breach analysis.
Securing virtual workload and cloud
- 1. Cloud security and virtualized data center Himani Singh Feb 2017
- 2. Agenda • Cloud security domains • Flaws in security approaches • Data center requirement • VMware NSX • Good to have • Functions of the Ideal Solution • Smart Solution • Micro-segmentation • Assessment of micro-segmentation
- 3. Data Center Concerns • Cloud security can be divided into four categories Cloud data protection Cloud Data Governance Cloud access policy and intelligence Cloud workload Security audit and Management • Cloud Application security concerns – Cloud access policy and intelligence – Cloud Data protection – Cloud Data Governance Categories : CASB Gap1: CASB doesn’t address workload security or infrastructure! Only focuses on - User account and Data in the SaaS application - Web and mobile • Workload security concerns – Protecting of work loads – Web, App and data-at-rest
- 4. Flaws in the security approaches Next slides are going to address the security short coming cloud security. • Traditional approach in deployment Deployment approach • Protection is on perimeter • Visibility inside data center • Distributed security
- 5. Flaws in the security approaches • Traditional approach in deployment • Cloud Deployment – Most people will add a set of VMs’ with firewall and so on. – VFW’s shares same hypervisor with another servers • The above approach is same as a physical data center LB VNGFW Server LB App Web Server DB Server FW With SDN and virtualization when workloads (VMs) are dynamically created, moved between hypervisors, We need a differed security solution
- 6. Flaws in the security approaches • Type of traffic North-South vs East-West – North-South traffic is defined by traffic from enterprise to SaaS application /cloud – East-west traffic is defined as traffic inside the data center between different work loads • Protection is on perimeter – Most security emphasis is on North-South traffic • All security devices are focused on perimeter – App to App traffic monitoring is been ignore – Once a breach is inside the data center, it is very hard to detect. It is like lateral moment
- 7. Flaws in the security approaches • Monitoring and tracking – Traffic • Monitor the east-to-west between App to App • Apply L4 and L7 rules between traffic • Insufficient logging and access control between traffic. In OWSP 2017, a new new category was added called as “Insufficient logging and traffic” – Workload VMs • Remember VM’s are dynamically created, moved or destroyed • Tracking and protecting a new instance of workload – What about the logs • For Elasticity the new VM’s are create and automatically teardown • The logging history is lost – VFW session • When a VFW is been destroyed, the VFW sessions are lost. – Drawback: Current solution don’t retain the history for breach detection and analysis
- 8. Flaws in the security approaches • What logs are important – SIEMs have too much logs to process – It is hard to collect the correct solution – Some solution needs the end-point agent – Some solution only send alert but doesn’t send block it
- 9. Flaws in the security approaches • Monitoring, Visibility and access control – Visibility is the biggest issue in the data center – VFW’s performance issues, VFW’s performance is depends on the vCPUs – Since most of the VFWs’ functionality is based on traditional ones, they are not designed for modern data center. – Such as they are based on layer4 or applications, but not on container or Docker • VFWs has many flavors – VFW vendors like PAN, Checkpoint and Fortinet, have released based on public or private cloud provider, like different FW for AWS, Azure, VmWare and more
- 10. VMware NSX(till 2017 Jan) VMware NSX provides NFV and layer 2-4 security. It automatically keeps track of workload creation and moves. NSX solution – Provide security tagging for workloads inside the data-center – Automatically tracks the workload creation, movement and deletion – Layer2-4 security policies are inbuilt – Layer7 security such as statful FW, NGFW, DLP, IDS are provided by external vendors such as PAN, Fortinet, Juniper and Checkpoint • The VM is created and associated with a group of VM’s • When any new member is added to that security group, those policies is applied automatically. • Any FW deployed on NSX has the maximum throughput of 650 Mbps
- 11. Flaws in the security approaches • Private cloud, most of security vendors still depend on VMware’s NSX for creating the new VFW instance when a workload is created, moved and destroyed – NSX = l4 + PAN (L7) – NSX has started offering its own Application security solution • Multi-layer security solution – Need to use different VM for security protection. • Some vendors have one product for each solution: – Mail, Web, ADC, Auth and Gateway • Some vendors product for all security services in one service – Different flavor for AWS, Azure, ESXi, NSX , KVM, ZEN, Hyper-V, Xen
- 12. Good to have An ideal solution should have • Visibility • Monitoring (Tracking and logs ) • Prevention • Automation of security profile when new workload is provisioned • Layer4 to Layer7 security • Focused approach to filter out unnecessary alerts • Ideal combination of signature based and behavior based solution
- 13. Functions of the Ideal Solution • Prevention – Reduce the potential attack surface: • Firewall policies, IPS, user segmentation, patch management, and infrastructure design – Apply the policies inside the data center between workloads based on security tags • Automation of security profile when new workload is provisioned – Dynamic Security profile creation when workloads are moved, created or deleted • For layer 2- layer 7 – AWS • Has inbuilt security for LaaS • Marketplace is used to buy security solutions • Single vendor security solution for correlation between events – It would be nice to have one vendor who can protect from layer4 to layer7 for the workloads – Centralized logs
- 14. Functions of the Ideal Solution • Independent • Maintain one flavor for Virtual Security solution rather than vIPS, vNGFW, vMAIL • Solution that is independent of underlying technology such as ESXi , Rackspace, KVM... • Workload – Works for all kind of workload such as webserver, http server – Only relevant functionality should be unzip and active • DETECT – IDS, WAF, anomaly detection, NIDS, HIDS, • RESPOND – report and communication to stack holders by email, alert, text – Immediate Isolation of the workload • PREDICT – Regular scans, penetration testing – Dynamically and continuously change the policy – Updating the methods
- 15. CheckPoint vSEC(datasheet bases on 2016 Dec) • Public Cloud • AWS gateway R77.30 – vSEC NGTP (Firewall + IPS + Application Control + URL Filter + Anti-Virus + Anti-Bot) • c4.8xlarge (36 virtual core) :: estimation 1600 Mbps • c4.4xlarge (16 virtual core) :: 1000 Mbps • Private cloud – vSEC for VMware NSX,Cisco ACI, openStack • No published data
- 16. PAN V-100 (datasheet bases on 2016 Dec) • Capacities – VM-300: Max sessions 250,000 – VM-200: Max sessions 100,000 – VM-100: Max sessions 50,000 • Too many solutions for different requirements: – VM-Series for AWS, Citrix, KVM & OpenStack – VM-Series for Microsoft Azure, Microsoft Hyper-V – VM-Series for VMware NSX, ESXi/vCloud Air – VM-1000-HV, VM-300, VM-200 and VM-100
- 17. micro segmentation • Agent approach – A software that sits on top of Hypervisor – Provide the monitoring, security control and logging – Deeper level security module based on workload, i.e. if workload is Linux/https the only web related service module should be loaded DC SLB App Web Server DB Server Virtual UTM Hypervisor SLB App Web Server DB Server Virtual UTM Hypervisor Single management plane for Security points
- 18. Micro-Segmentation • Ubiquity – Apply to all workloads – Different security levels based on VM type, such as webserver, db, application server, mailserver • Zero-attack prevention – No trust between workloads – IPS, DLP, agentless malware protections, SD distributed FW • Suppress the noise – All logs /events are not useful
- 19. Assessment of Micro-segment • Throughput • Detection • App based FW • IPS • Malware • Threat protection • Compliance • Ubiquity