SlideShare a Scribd company logo
Session ID:
Session Classification:
Eric Hanselman
451 Research
TECH-R33
Intermediate
The Cloud Ate My Network!
Security for Virtual Networks
► Definition is foggy
► Cloud versus virtualization
► They do some wacky things to networks.
► Obscuration is an issue
► Flexibility should be a plus
► Scale should be a plus
Clouds Are Wonderful
But Can Also be Disruptive…
► Cloud and virtual networking
► Some conflating of issues
► Traditional enterprise architecture migration
► Network security focus
► An overview of the options
► There won’t be time to cover them all in depth
► Mostly focusing on monitoring and segregation
► Might accidently talk about availability…
► Q&A
What This Session Covers
► Network Security Tasks
► Confidentiality/Access control
► Firewalls, VPN’s, ACL’s
► Integrity/Regulatory
► More firewalls, WAF
► IDS/IPS
► Monitoring, recording
► Availability
► Monitoring and recording
► Proactive
► Capacity/trending
► Reactive
► Troubleshooting
Typical Enterprise Goals
► Expectations of physical access
► Natural aggregation
► Fixed location
► Techniques have been built around cables and ports
► Access controls
► Network segmentation
► Isolation
► Monitoring and recording
► Lots of SPAN ports
Traditional Approaches
► Host-based capabilities could be simpler
► In a cloudy world
► Historic reasons still matter
► It’s independent
► It’s activity based
► It’s the only thing I own!
Why Use Network Security?
► A typical monitoring architecture
How To Replicate This
In a World Like This
► More flexible configuration
► Connection automation
► Tied to orchestration
► Locality
► Tied to compute instances
► No more span ports!
Virtual Networks Offer Hope
► There’s a gap!
► Transitioning is complex
► Physical infrastructure
► Existing tools and techniques
► Virtual networks
► Limited tools
► Limited access
► Convergence/consolidation
► Scale
What Could Possibly Go Wrong?
► Replicate capabilities locally
► Equivalent functionality
► Replicate capabilities externally
► Coverage and scale
► Push traffic somewhere else
► Reconnecting the tubes
► Change tactics
► Some answers can be found in clouds
► Or hosts…
How to Cope?
► Firewalls and ACL’s
► Finding equivalents
► Vendor specific functionality
► Managing different implementations
► Aligning policies
► Correlating events
► IDS/IPS
► Scale in virtual implementation
► More instances
► Managing different implementations
► Aligning policies
► Correlating events
Replicate Capabilities Locally
► Access networks
► Can work for external access controls
► WAF
► Some malicious behavior
► Harder to make application specific
► No internal visibility
► Cloud-based monitoring
► Might be closer (topologically)
► Potential to scale
Replicate Capabilities Externally
► Clouds
► Hard to do
► Hypervisors
► Finding virtual edges
► Physical network access
► Build conduits
► Assigned VLAN’s
► Virtual taps
Push Traffic Somewhere Else
► Long live span ports!
► Still the most universal mechanism
► Don’t forget physical network!
► Routing monitoring traffic
► VLANs
► Dedicated for monitoring
► Works at low scale
► Virtual monitoring
► Management scale
► Have to manage sprawl
► Data access monitoring
► Better filtering
► Helping to manage scale
Span Ports Are Dead!
Platform Notes
VMware VDS Span ports
Cisco Nexus 1000v SPAN, ERSPAN
Virtual Security Gateway
Juniper vGateway Kernel module
IBM 5000v SPAN, ERSPAN
Microsoft Hyper-V Extensible Switch
Open source Open vSwitch Mirroring, SPAN, RSPAN
HP vController Kernel module
NetOptics Virtual Tap Kernel module
Gigamon GigaVUE-VM VM based
Reestablishing Paths
► Where do they integrate?
► Switch port taps
► Switch integration
► VM integration
► Hypervisor kernel
► Deployed footprint
► Management VM’s
► Per host
► Hypervisor support
► IPv6 support…
General Concepts
► Simple capabilities
► vShield provides screening functionality
► No traffic mirroring
VMware
vSphere Distributed Switch Details
Type Switch integration
Support RSPAN, ERSPAN
Sources VLAN, port
► Nexus 1000v
► Supported on vSphere, announced support for Hyper-V
► Virtual Security Gateway
► Independent control VM
► Dedicated VLANs required
Cisco
Virtual Security Gateway Details
Type Nexus 1000v VEM integration
Support Internal traffic routing
Sources VEM connections
Nexus 1000v Details
Type Mirroring switch integration
Support RSPAN, ERSPAN
Sources VLAN, port
► Security Design VM for management
► Security VM and kernel module per ESX host
► Physical/virtual support
► Support on vSphere
► IPv6 support
Juniper
vGateway Details
Type Hypervisor kernel module
Support Traffic redirection, ERSPAN
Sources Firewall filtering
► Separate controller VM
► Support on vSphere
IBM
Distributed Switch 5000V Details
Type Switch integration
Support SPAN (mirror), ERSPAN
Sources VLAN, port
► Rules per instance
► Only port to port
► Not mobile
► IPv6 support
► Future possibilities with extensions, Nexus 1000v
Microsoft
Hyper-V Extensible Switch Details
Type Hypervisor integration
Support Simple mirroring
Sources port
► Xen and KVM support
► Basic mirroring
Open vSwitch
Open vSwitch Details
Type Switch integration
Support SPAN, RSPAN
Sources VLAN, port
► VM per ESX host
► External monitoring support
► Supported on vSphere
HP
vController Details
Type Kernel module, control VM
Support RSPAN, ERSPAN
Sources VLAN, port
► Better for existing users
► Gigamon release expected soon
Data Access Approaches
NetOptics Details
Type Hypervisor module
Support Redirection
Sources Filtering
Gigamon Details
Type Monitoring VM
Support Redirection
Sources Filtering
► Infrastructure statistics
► Clouds allow agentless monitoring
► Instrument hosts
► Integration concerns
► Overlay networks
► Have to be designed in
► Shift to activity-based (logs)
► A more dramatic change
Change Tactics
► Cloudy networks
► Amazon
► Fully virtual
► Google Compute Engine
► Rackspace et al
► Mixed possibilities
► VMware-based clouds
► See below
► OpenStack
► Virtual platforms
► VMware
► Citrix/Xen
► Microsoft
► KVM/Red Hat
What’s Out There Today?
► Virtual Private Cloud offers the best options
► Network segmentation
► Multiple interfaces per instance
► Virtual appliance support
► Firewalls
► IDS
► APM
► Recording not practical
Through the Amazon
Capability Options
Network segmentation Within VPC
Firewall
ACL Security Groups in VPC for egress
Traffic inspection (IDS) Appliance-based
Traffic capture Statistics through CloudWatch
Host agents
Amazon Overview
► Google Compute Engine holds promise
► Similar to early VPC
► Four network segments
► Inbound firewalling
► Still in “limited preview”
► No appliance support
Google
► Cloud and managed hosting
► Cloud is evolving with OpenStack and Nicira support
► Promise of more flexible future
► Cloud Networks just rolling out
► Instances perform routing
► 3 networks with 64 servers each
► Hardware front ends
► F5 LTM
► Cisco ASA
► Software, too
► Zeus ADC
Rackspace
Capability Options
Network segmentation Cloud Networking only
Firewall Physical Cisco, virtual option
ACL Inbound
Traffic inspection (IDS) Limited
Traffic capture Host agents
Rackspace Overview
► Software Defined Networking could help
► Someday…
► Automated packet replication
► Automated identification and forwarding
► Better scale than virtual SPAN ports
► Different technology platforms
► OpenFlow
► OpenStack/CloudStack/Quantum
► Networking vendors
► Cisco ONE, onePK
► Arista DANZ
A Shiny SDN Future
► Many goals can be achieved
► Access tools are available
► Isolation can work
► Within scaling considerations
► Monitoring
► Full recording remains a challenge
► SDN could help
► Where available…
Seeing Through the Mists
Questions?
eric.hanselman@451research.com
@e_hanselman

More Related Content

PDF
Security Practitioners guide to Micro Segmentation with VMware NSX and Log In...
PDF
Si fa presto a dire SDDC: come, quando e perché?
PDF
VMworld 2013: Virtualized Network Services Model with VMware NSX
PDF
VMworld 2013: Real-world Deployment Scenarios for VMware NSX
PDF
Secure SDN
PDF
Does Hypervisor matter in OpenStack
PDF
NSX: La Virtualizzazione di Rete e il Futuro della Sicurezza
PDF
VMworld 2013: Advanced VMware NSX Architecture
Security Practitioners guide to Micro Segmentation with VMware NSX and Log In...
Si fa presto a dire SDDC: come, quando e perché?
VMworld 2013: Virtualized Network Services Model with VMware NSX
VMworld 2013: Real-world Deployment Scenarios for VMware NSX
Secure SDN
Does Hypervisor matter in OpenStack
NSX: La Virtualizzazione di Rete e il Futuro della Sicurezza
VMworld 2013: Advanced VMware NSX Architecture

What's hot (20)

PDF
VMUG - NSX Architettura e Design
PPTX
NSX 9 Core Use Cases
PPTX
VMUGbe 21 Filip Verloy
PPTX
nsx overview with use cases 1.0
PDF
Commonsense Linux sysad and scaling of webapps in the cloud
PDF
The Future of Cloud Networking is VMware NSX (Danish VMUG edition)
PPTX
Nsx security deep dive
PDF
VMware NSX for vSphere - Intro and use cases
PDF
The Vision for the Future of Network Virtualization with VMware NSX (Q2 2016)
PPTX
VMworld 2016: Migrating from a hardware based firewall to NSX to improve perf...
PPTX
IaaS with Software Defined Networking
PDF
VMware NSX + Cumulus Networks: Software Defined Networking
PDF
The Vision for the Future of Network Virtualization with VMware NSX
PDF
Serverless security for multi cloud workloads
PDF
SDN, Network Virtualization, and the Right Abstraction
PDF
Atf 3 q15-6 - solutions for scaling the cloud computing network infrastructure
PDF
VMworld 2013: Bringing Network Virtualization to VMware Environments with NSX
PPTX
VMWare NSX Components
PPTX
VMworld 2015: VMware NSX Deep Dive
PDF
VMworld 2013: Operational Best Practices for NSX in VMware Environments
VMUG - NSX Architettura e Design
NSX 9 Core Use Cases
VMUGbe 21 Filip Verloy
nsx overview with use cases 1.0
Commonsense Linux sysad and scaling of webapps in the cloud
The Future of Cloud Networking is VMware NSX (Danish VMUG edition)
Nsx security deep dive
VMware NSX for vSphere - Intro and use cases
The Vision for the Future of Network Virtualization with VMware NSX (Q2 2016)
VMworld 2016: Migrating from a hardware based firewall to NSX to improve perf...
IaaS with Software Defined Networking
VMware NSX + Cumulus Networks: Software Defined Networking
The Vision for the Future of Network Virtualization with VMware NSX
Serverless security for multi cloud workloads
SDN, Network Virtualization, and the Right Abstraction
Atf 3 q15-6 - solutions for scaling the cloud computing network infrastructure
VMworld 2013: Bringing Network Virtualization to VMware Environments with NSX
VMWare NSX Components
VMworld 2015: VMware NSX Deep Dive
VMworld 2013: Operational Best Practices for NSX in VMware Environments
Ad
Ad

Similar to Tech r33 (20)

PDF
Технологии ЦОД. Virtual Chassis Fabric
PDF
Presentation cloud computing and the internet
PPTX
CCNA4 Verson6 Chapter7
PDF
Net1674 final emea
PDF
Network virtualization seminar report
PDF
DEF CON 23 - Ronny Bull and Jeanna Matthews - exploring layer 2
PPTX
Cloud101-Introduction to cloud
PPTX
Midokura OpenStack Day Korea Talk: MidoNet Open Source Network Virtualization...
PPTX
Virtualization and cloud computing
PDF
Security & Virtualization in the Data Center
PDF
ACM-CTO-Roundtable
PDF
Cloud Network Technology Development & Deployment Trends
PDF
Integrated-Security-Solution-for-the-virtual-data-center-and-cloud
PPTX
VMware Networking, CISCO Nexus 1000V, and CISCO UCS VM-FEX
PPTX
Windows Server 8 Hyper V Networking
PPTX
Network virtualization
PPTX
Reference design for v mware nsx
PDF
Windows server 8 hyper v networking (aidan finn)
PDF
App to Cloud: Patrick Kerpan's DataCenter Dynamics Converged Keynote
PDF
VMware and AWS Together - VMware Cloud on AWS
Технологии ЦОД. Virtual Chassis Fabric
Presentation cloud computing and the internet
CCNA4 Verson6 Chapter7
Net1674 final emea
Network virtualization seminar report
DEF CON 23 - Ronny Bull and Jeanna Matthews - exploring layer 2
Cloud101-Introduction to cloud
Midokura OpenStack Day Korea Talk: MidoNet Open Source Network Virtualization...
Virtualization and cloud computing
Security & Virtualization in the Data Center
ACM-CTO-Roundtable
Cloud Network Technology Development & Deployment Trends
Integrated-Security-Solution-for-the-virtual-data-center-and-cloud
VMware Networking, CISCO Nexus 1000V, and CISCO UCS VM-FEX
Windows Server 8 Hyper V Networking
Network virtualization
Reference design for v mware nsx
Windows server 8 hyper v networking (aidan finn)
App to Cloud: Patrick Kerpan's DataCenter Dynamics Converged Keynote
VMware and AWS Together - VMware Cloud on AWS

More from SelectedPresentations (20)

PDF
Длительное архивное хранение ЭД: правовые аспекты и технологические решения
PDF
Трансграничное пространство доверия. Доверенная третья сторона.
PDF
Варианты реализации атак через мобильные устройства
PDF
Новые технологические возможности и безопасность мобильных решений
PDF
Управление безопасностью мобильных устройств
PDF
Современные технологии контроля и защиты мобильных устройств, тенденции рынка...
PDF
Кадровое агентство отрасли информационной безопасности
PDF
Основное содержание профессионального стандарта «Специалист по безопасности и...
PDF
Основное содержание профессионального стандарта «Специалист по безопасности а...
PDF
Основное содержание профессионального стандарта «Специалист по технической за...
PDF
Основное содержание профессионального стандарта «Специалист по безопасности т...
PDF
О профессиональных стандартах по группе занятий (профессий) «Специалисты в об...
PDF
Запись активности пользователей с интеллектуальным анализом данных
PDF
Импортозамещение в системах ИБ банков. Практические аспекты перехода на росси...
PDF
Обеспечение защиты информации на стадиях жизненного цикла ИС
PDF
Документ, как средство защиты: ОРД как основа обеспечения ИБ
PDF
Чего не хватает в современных ids для защиты банковских приложений
PDF
Об участии МОО «АЗИ» в разработке профессиональных стандартов в области инфор...
PDF
Оценка состояния, меры формирования индустрии информационной безопасности Рос...
PDF
Об угрозах информационной безопасности, актуальных для разработчика СЗИ
Длительное архивное хранение ЭД: правовые аспекты и технологические решения
Трансграничное пространство доверия. Доверенная третья сторона.
Варианты реализации атак через мобильные устройства
Новые технологические возможности и безопасность мобильных решений
Управление безопасностью мобильных устройств
Современные технологии контроля и защиты мобильных устройств, тенденции рынка...
Кадровое агентство отрасли информационной безопасности
Основное содержание профессионального стандарта «Специалист по безопасности и...
Основное содержание профессионального стандарта «Специалист по безопасности а...
Основное содержание профессионального стандарта «Специалист по технической за...
Основное содержание профессионального стандарта «Специалист по безопасности т...
О профессиональных стандартах по группе занятий (профессий) «Специалисты в об...
Запись активности пользователей с интеллектуальным анализом данных
Импортозамещение в системах ИБ банков. Практические аспекты перехода на росси...
Обеспечение защиты информации на стадиях жизненного цикла ИС
Документ, как средство защиты: ОРД как основа обеспечения ИБ
Чего не хватает в современных ids для защиты банковских приложений
Об участии МОО «АЗИ» в разработке профессиональных стандартов в области инфор...
Оценка состояния, меры формирования индустрии информационной безопасности Рос...
Об угрозах информационной безопасности, актуальных для разработчика СЗИ

Tech r33

  • 1. Session ID: Session Classification: Eric Hanselman 451 Research TECH-R33 Intermediate The Cloud Ate My Network! Security for Virtual Networks
  • 2. ► Definition is foggy ► Cloud versus virtualization ► They do some wacky things to networks. ► Obscuration is an issue ► Flexibility should be a plus ► Scale should be a plus Clouds Are Wonderful
  • 3. But Can Also be Disruptive…
  • 4. ► Cloud and virtual networking ► Some conflating of issues ► Traditional enterprise architecture migration ► Network security focus ► An overview of the options ► There won’t be time to cover them all in depth ► Mostly focusing on monitoring and segregation ► Might accidently talk about availability… ► Q&A What This Session Covers
  • 5. ► Network Security Tasks ► Confidentiality/Access control ► Firewalls, VPN’s, ACL’s ► Integrity/Regulatory ► More firewalls, WAF ► IDS/IPS ► Monitoring, recording ► Availability ► Monitoring and recording ► Proactive ► Capacity/trending ► Reactive ► Troubleshooting Typical Enterprise Goals
  • 6. ► Expectations of physical access ► Natural aggregation ► Fixed location ► Techniques have been built around cables and ports ► Access controls ► Network segmentation ► Isolation ► Monitoring and recording ► Lots of SPAN ports Traditional Approaches
  • 7. ► Host-based capabilities could be simpler ► In a cloudy world ► Historic reasons still matter ► It’s independent ► It’s activity based ► It’s the only thing I own! Why Use Network Security?
  • 8. ► A typical monitoring architecture How To Replicate This
  • 9. In a World Like This
  • 10. ► More flexible configuration ► Connection automation ► Tied to orchestration ► Locality ► Tied to compute instances ► No more span ports! Virtual Networks Offer Hope
  • 11. ► There’s a gap! ► Transitioning is complex ► Physical infrastructure ► Existing tools and techniques ► Virtual networks ► Limited tools ► Limited access ► Convergence/consolidation ► Scale What Could Possibly Go Wrong?
  • 12. ► Replicate capabilities locally ► Equivalent functionality ► Replicate capabilities externally ► Coverage and scale ► Push traffic somewhere else ► Reconnecting the tubes ► Change tactics ► Some answers can be found in clouds ► Or hosts… How to Cope?
  • 13. ► Firewalls and ACL’s ► Finding equivalents ► Vendor specific functionality ► Managing different implementations ► Aligning policies ► Correlating events ► IDS/IPS ► Scale in virtual implementation ► More instances ► Managing different implementations ► Aligning policies ► Correlating events Replicate Capabilities Locally
  • 14. ► Access networks ► Can work for external access controls ► WAF ► Some malicious behavior ► Harder to make application specific ► No internal visibility ► Cloud-based monitoring ► Might be closer (topologically) ► Potential to scale Replicate Capabilities Externally
  • 15. ► Clouds ► Hard to do ► Hypervisors ► Finding virtual edges ► Physical network access ► Build conduits ► Assigned VLAN’s ► Virtual taps Push Traffic Somewhere Else
  • 16. ► Long live span ports! ► Still the most universal mechanism ► Don’t forget physical network! ► Routing monitoring traffic ► VLANs ► Dedicated for monitoring ► Works at low scale ► Virtual monitoring ► Management scale ► Have to manage sprawl ► Data access monitoring ► Better filtering ► Helping to manage scale Span Ports Are Dead!
  • 17. Platform Notes VMware VDS Span ports Cisco Nexus 1000v SPAN, ERSPAN Virtual Security Gateway Juniper vGateway Kernel module IBM 5000v SPAN, ERSPAN Microsoft Hyper-V Extensible Switch Open source Open vSwitch Mirroring, SPAN, RSPAN HP vController Kernel module NetOptics Virtual Tap Kernel module Gigamon GigaVUE-VM VM based Reestablishing Paths
  • 18. ► Where do they integrate? ► Switch port taps ► Switch integration ► VM integration ► Hypervisor kernel ► Deployed footprint ► Management VM’s ► Per host ► Hypervisor support ► IPv6 support… General Concepts
  • 19. ► Simple capabilities ► vShield provides screening functionality ► No traffic mirroring VMware vSphere Distributed Switch Details Type Switch integration Support RSPAN, ERSPAN Sources VLAN, port
  • 20. ► Nexus 1000v ► Supported on vSphere, announced support for Hyper-V ► Virtual Security Gateway ► Independent control VM ► Dedicated VLANs required Cisco Virtual Security Gateway Details Type Nexus 1000v VEM integration Support Internal traffic routing Sources VEM connections Nexus 1000v Details Type Mirroring switch integration Support RSPAN, ERSPAN Sources VLAN, port
  • 21. ► Security Design VM for management ► Security VM and kernel module per ESX host ► Physical/virtual support ► Support on vSphere ► IPv6 support Juniper vGateway Details Type Hypervisor kernel module Support Traffic redirection, ERSPAN Sources Firewall filtering
  • 22. ► Separate controller VM ► Support on vSphere IBM Distributed Switch 5000V Details Type Switch integration Support SPAN (mirror), ERSPAN Sources VLAN, port
  • 23. ► Rules per instance ► Only port to port ► Not mobile ► IPv6 support ► Future possibilities with extensions, Nexus 1000v Microsoft Hyper-V Extensible Switch Details Type Hypervisor integration Support Simple mirroring Sources port
  • 24. ► Xen and KVM support ► Basic mirroring Open vSwitch Open vSwitch Details Type Switch integration Support SPAN, RSPAN Sources VLAN, port
  • 25. ► VM per ESX host ► External monitoring support ► Supported on vSphere HP vController Details Type Kernel module, control VM Support RSPAN, ERSPAN Sources VLAN, port
  • 26. ► Better for existing users ► Gigamon release expected soon Data Access Approaches NetOptics Details Type Hypervisor module Support Redirection Sources Filtering Gigamon Details Type Monitoring VM Support Redirection Sources Filtering
  • 27. ► Infrastructure statistics ► Clouds allow agentless monitoring ► Instrument hosts ► Integration concerns ► Overlay networks ► Have to be designed in ► Shift to activity-based (logs) ► A more dramatic change Change Tactics
  • 28. ► Cloudy networks ► Amazon ► Fully virtual ► Google Compute Engine ► Rackspace et al ► Mixed possibilities ► VMware-based clouds ► See below ► OpenStack ► Virtual platforms ► VMware ► Citrix/Xen ► Microsoft ► KVM/Red Hat What’s Out There Today?
  • 29. ► Virtual Private Cloud offers the best options ► Network segmentation ► Multiple interfaces per instance ► Virtual appliance support ► Firewalls ► IDS ► APM ► Recording not practical Through the Amazon
  • 30. Capability Options Network segmentation Within VPC Firewall ACL Security Groups in VPC for egress Traffic inspection (IDS) Appliance-based Traffic capture Statistics through CloudWatch Host agents Amazon Overview
  • 31. ► Google Compute Engine holds promise ► Similar to early VPC ► Four network segments ► Inbound firewalling ► Still in “limited preview” ► No appliance support Google
  • 32. ► Cloud and managed hosting ► Cloud is evolving with OpenStack and Nicira support ► Promise of more flexible future ► Cloud Networks just rolling out ► Instances perform routing ► 3 networks with 64 servers each ► Hardware front ends ► F5 LTM ► Cisco ASA ► Software, too ► Zeus ADC Rackspace
  • 33. Capability Options Network segmentation Cloud Networking only Firewall Physical Cisco, virtual option ACL Inbound Traffic inspection (IDS) Limited Traffic capture Host agents Rackspace Overview
  • 34. ► Software Defined Networking could help ► Someday… ► Automated packet replication ► Automated identification and forwarding ► Better scale than virtual SPAN ports ► Different technology platforms ► OpenFlow ► OpenStack/CloudStack/Quantum ► Networking vendors ► Cisco ONE, onePK ► Arista DANZ A Shiny SDN Future
  • 35. ► Many goals can be achieved ► Access tools are available ► Isolation can work ► Within scaling considerations ► Monitoring ► Full recording remains a challenge ► SDN could help ► Where available… Seeing Through the Mists