vevirtualization_for_infosec_pros_12feb2009

1、Virtualization for InfoSecurity ProfessionalsWarren WuVMware Product ManagementTamir Hardof Check Point, Group Manager, Product M2009 Check Point Software Technologies Ltd. All rights reserved.RestrictedONLY for designated groups and individualsINTERNAL ONLYThe Virtua

2、lization TrendOrganizations looking to:Cut costs,Better utilize assetsReduce implementation/management time and complexity.Virtualization addresses these concernsGartner recommends organizations openly evaluate and implement virtualization at both server and desktop level to save money and remain co

3、mpetitiveRestrictedONLY for designated groups and individuals22009 Check Point Software Technologies Ltd. All rights reserved.The Virtualization OpportunityFrom 2009 to 2013 the server virtualization software market will grow with a compound annual growth rate of 28 percent rising from US$1.8bn to U

4、S$6.2bn*Selling solutions for virtualization requires:New Technology: Understanding virtualization and its benefits New Terminology: Speaking the language of virtualizationNew Customers: Knowing how to identify different decision- makers and influencers*Gartners Top 10 Predictions for 2009Restricted

5、ONLY for designated groups and individuals32009 Check Point Software Technologies Ltd. All rights reserved.Virtualization for Infosecurity ProfessionalsWarren WuVMware Product Management AgendaIntroduction to Virtualization for Security ProfessionalsHow Virtualization is Used in the DatacenterSecuri

6、ty Issues and ChallengesVirtsec:New Technologies and SolutionsAggregateAutomateCapacitySelf-ManagingComputing Clouds On On DemandDatacenterand Off Premise Evolution of a Virtualized IT EnvironmentSeparateConsolidateManagementHypervisorHypervisorTest and DevelopmentServerConsolidationLiberate VMware

7、ESX and ESXi for Datacenter ServersBare-metal hypervisor (no underlying Windows, Linux/UNIX)Purpose-built software Acts like firmwareESXi - 32MB footprint:Increased security and reliabilityFrom server boot to running VMs in minutes CapEx - Server Consolidation and ContainmentServers Storage NetworkF

8、acilitiesServers Storage NetworkFacilities1,000Direct attach 3000 cables/ports200 racks400 power whips80Tiered SAN and NAS 400 cables/ports10 racks20 power whips Consolidation Existing servers avg 20% utilization, P2V, 6:1 ratios or higher New hardware - $7 of SAN for every $1 of virtualization soft

9、ware, 10GigE Network I/O convergence, virtual networking VMware Datacenter Product Line ESX, VC, and the Rest VMware VirtualCenter VMware Converter VMware Lifecycle Manager VMware Update Manager VMware Site Recovery Manager VMware Capacity Planner VMware Virtual Desktop Manager VMware ACE VMware Lab

10、 Manager VMware Stage ManagerIT Service DeliveryIT Service ContinuityInfrastructure OptimizationDesktop Management VMware DRS with DPM VMware High Availability VMware Consolidated Backup VMware Storage VMotion VMware VMotion VMware ESX VMware ESXi VMware Virtual SMP VMware VMFSComputing Clouds On an

11、d Off Premise Evolution of a Virtualized IT EnvironmentSeparateConsolidateAggregateAutomateAutomationDistributed VirtualizationDistributed VirtualizationManagementManagementManagementHypervisorHypervisorHypervisorHypervisorTest and DevelopmentServerConsolidationCapacity On DemandSelf-ManagingDatacen

12、terLiberate Live Migration with VMotionDynamic migration of VMs across disparate hardware with no downtime or disruption to applications or usersIntroduced in 2003Trusted by 62% of customers in productionEssential to greater flexibility and availability in a virtualized environmentVMotionStorage VMo

13、tionVMware InfrastructureAppOSAppOSAppOSAppOSAppOS OpEx:Low Cost High Availability for All AppsVirtualization is inherently more reliable for backup and recoveryVMware virtual machines automatically restart when a server or OS failsNo need for dedicated stand-by hardware None of the cost and complex

14、ity of clustering XVMware InfrastructureAppOSAppOSAppOSAppXOSAppOSAppOSAppOSAppOS OpEx:Rapid VM Provisioning and Lifecycles Document Lifecycle Management Virtual Machine Lifecycle ManagementCut provisioning workflow for new servers from 4 months to 1 dayDelete VMRequest for VMProvisioningRoute VM fo

15、r ApprovalMonitor & Adjust ResourcesPower-On or Suspend VMDeploy VM from TemplateArchive VMDisposeRequest DocumentPublish or RetractApproveCreateAudit UsageRetain AgendaIntroduction to Virtualization for Security ProfessionalsHow Virtualization is Used in the DatacenterSecurity Issues and Challenges

16、Virtsec:New Technologies and Solutions No Free Lunch for Security In Virtual Environments15Virtualization BenefitsVirtualization RisksSecurity and Compliance IssuesEasy machine creation“VM sprawl”Rapid change accelerates configuration driftMobility enables high availability, dynamic resource optimiz

17、ationMobility can break static securityMaintain isolation and network controlsHypervisor enables consolidationNew privileged layer to be securedAccess to sensitive data in VM Automation and Dynamism Challenge Static ProcessesIntelligent infrastructure dynamically manages machinesVirtual machines go

18、online/offlineVirtual machines move in the cluster (VMotion) Virtual machines are cloned and multiplyComputing resources mobile and elasticDRS and Power Management in the datacentervCloud integration of on-premise datacenters with off-premise clouds Check-in/check-out of virtual desktops from the da

19、tacenter Specific Challenges with Network SecurityPhysical firewalls require external gateways that require dedicated hardwareDisrupts vision of seamless internal cloudLack of inter-VM visibility for monitoring and enforcementDue to rich virtual networking, not from consolidating serversAligning sta

20、tic policies with fast VM sprawl and mobilityIncreased dynamism a consequence of greater admin efficiencyMaintaining network session state with live migration (VMotion) or liver failover (FT)Software firewall on 2nd ESX host doesnt have VM state from first ESX hostMisconfiguration risk due to easier

21、 VI admin access to virtual servers and virtual networkingLoss of SOD between server admin and network/security teams Key Network Security Use CasesVirtualizing the datacenter DMZ serversCollapsing DMZ boundary using virtual firewallsPrescriptive firewalls for PCI complianceFirewalls for DMZ, untrus

22、ted networks, wirelessIntrusion prevention, web app firewalls, other network securityNetwork isolation for multi-tenant cloudsConsistent network security policies for replicated environmentsFailover and high availability backups Remote office/branch officeDatacenter-in-a-box to simplify the SMB expe

23、rience AgendaIntroduction to Virtualization for Security ProfessionalsHow Virtualization is Used in the DatacenterSecurity Issues and ChallengesVirtsec:New Technologies and Solutions Virtual AppliancesHW appliances already movinginto VMsLoad-balancers, IDS, Firewalls, Backup, Dedupe, Virtualization

24、helps manageability and capabilityPartners plug into common service interfaceTodays Examples: SRM, VCB, VMSafe Unique Security Through Virtualization - VMsafe Security VMHIPSFirewall IPS/IDSAnti-VirusSecurity APIESXNew security solutions can be developed and integrated into VMware virtual infrastruc

25、tureProtect the VM by inspection of virtual components (CPU, Memory, Network and Storage)Complete integration and awareness of VMotion, Storage VMotion, HA, etc.Provides an unprecedented level of security for the application and the data inside the VM Use Case: VI-integrated Inline Network SecurityS

26、ecurity VMSecurity VMVMotion and Cluster- aware inline network security productSecurity VMView Inter-VM traffic regardlessof Virtual networking setupCompatible with all forms of virtual switching including Cisco Nexus 1000V (Distributed Virtual Switch) Virtual datacenter OS from VMwareWeb 2.0.NetWin

27、dowsLinuxJ2EEGridSaaSMake applications more scalable, secure and resilient in a virtual environment than physical.Application vServicesAvailabilitySecurityScalability.vCenterVMware Infrastructure - virtual datacenter OSCloud vServicesInfrastructure vServicesvComputevStoragevNetworkOn-premise Infrast

28、ructureOff-premise Cloud23 Addressing Virtualization Security ConcernsAwareness of virtual network activityVisibility into inter-VM traffic for monitoring and enforcementMaintaining network session state with live migration (VMotion) or live failover (FT)Misconfiguration risk due to easier VI admin

29、access to virtual servers and virtual networkingVirtualization Security: VPN-1 VEProvides virtual applications the same best-in- class security as applications on physical serversBased on NGX R65 Designed for VMware ESXSeparates virtual machines for security Protects against inter-VM threats Protect

30、s against external threatsNo need for physical appliances and switchesMain Differences between VPN-1 and VECustomized for VMware ESX environment Optimized performancePre-packaged and pre-configured for quick and easy deploymentLicensingThe only security gateway certified as a Virtual Appliance by VM

31、ware for ESX serverRestrictedONLY for designated groups and individuals252009 Check Point Software Technologies Ltd. All rights reserved.Thank You!First Point of Contact:You local Check Point Sales OfficeRestrictedONLY for designated groups and individuals262009 Check Point Software Technologies Ltd

32、. All rights reserved.AppendixRestrictedONLY for designated groups and individuals272009 Check Point Software Technologies Ltd. All rights reserved. OVF: Self-Describing and Self-Managing VMsvApps are multiple virtual machines that together deliver an IT servicePackaged and delivered together with m

33、eta-data based on OVF standard that describe required configuration and service levelsPlug-and-play vServices transparently fulfill contracts and SLAsInstructionsApp + Infrastructure VMs1.2.eCommerce AppSecurity: Only open on port 80Ensure 1 ms web response SLA Backup every 30 min Recover within1 ho

34、ur3.4.5.OracleTomcatFirewallVMware Infrastructure Towards Application-Centric Security PolicyBeforeApp-specific FW policies hard or impossible to set without interior visibilityIIS #1Static, HW appliances cannot be dynamically re- configured based on topology changesFixed-capacity appliances forces over-provisioningLoad BalancerFirewallFirewallTomcat App ServerOracleII