Andy Kennedy - Scottish VMUG April 2016

ScottishVMUGApril, 2016

From untrustto zero trust…Securing what comes next for the SDDC

Andy Kennedy (@packetdiscards)

Networking & Security Business Unit, EMEA+44 7766 250030akennedy@vmware.com

• This presentation may contain product features that are currently under development.

• This overview of new technology represents no commitment from VMware to deliver these features in any generally available product.

• Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind.

• Technical feasibility and market demand will affect final delivery.

• Pricing and packaging for any new technologies or features discussed or presented have not been determined.

Disclaimer

From untrust to zero trust…Securing what comes next for the SDDC

Andy Kennedy (@packetdiscards)

Networking & Security Business Unit, EMEA+44 7766 250030akennedy@vmware.com

From Shadow IT to the Next Unit of Compute- The blind spot indicator for cyber security

CloudSilos

PublicManagedPrivate

ApplicationSilos

Traditional Applications Cloud-Native Applications

DeviceProliferation

ApplicationsContent

One Cloud Any Application Any Device

BridgingTwo Worlds

Mobile Cloud Era

Client-Server Era

High-Level Architecture

Orchestration Configuration Management

Backup & recovery

Log Management

Operations Dashboard

Virtual Domain

RBAC / AAAPolicy Management

Policy EnforcementMonitoring & Analytics

Backup & Disaster Recovery

Physical Domain Hybrid CloudInfrastructure

People & Process

Operations

App Team

3rd Platform Enables New Types of Apps in the Mobile-Cloud Era

Hardware

Application

App Team

Application

Operations

App Team

Application

1st Platform(Servers)

2nd Platform(Virtualization)

3rd Platform(Cloud)

Major NSX use cases

Intra-Datacenter Micro-Segmentation

DMZ Anywhere

Secure User Environments

SecurityIT Automating IT

Developer Clouds

Multi-tenant Infrastructure

AgilityDisaster Recovery

Metro Pooling

Hybrid Cloud Networking

Application Continuity

Microsegmentation

Topology Driven Security

Little or nolateral controlsinside perimeter

Internet

Topology Driven Security

Internet Internet

OperationallyInfeasible

Centralizedfirewalls

• Create firewall rules before provisioning• Update firewall rules when moving or changing• Delete firewall rules when app decommissioned• Problem increases with more east-west traffic

Internet

The challenge of topology driven security in the SDDC

Internet

How an SDDC Approach Makes Micro-segmentation Feasible

Security policy

Perimeterfirewalls

CloudManagement

Platform

Creating a zero trust model

Isolation Explicit allow comm. Secure communications Structured secure comms.

And align your controls to what you are protecting

Allow HTTPS

Adapting toChange

ApplicationSilos

Traditional Applications Cloud-Native Applications

Developer IT

Challenges with ContainersDifferent Units of Management

Partial Visibility Limited Security No Compatability

Containers without compromise

Container Engine

vSphereIntegrated Containers

Security

Today vSphereIntegrated Containers

Hardware Level IsolationOS Level Isolation

Container Security

Vulnerable Application

Internet

Port 80

Internalnetwork

Docker libnetwork – Options

– Bridge: Implements a way to configure new networks as isolated L2 bridges on single Docker hosts. The scope is ‘local’

– Overlay: Implements VXLAN based overlay networking to create L2 segments to attach containers running on multiple Docker Hosts.

– Remote: Implements an API to externalize network functions to 3rd party vendor / solutions.

Bridge Networking Multi-Host (Overlay) Driver

Remote (Vendor) Driver

Docker libnetwork – The Container Network Model (CNM)

• Sandbox– A Sandbox contains the configuration of a container's network stack. This includes management of the container's

interfaces, routing table and DNS settings. An implementation of a Sandbox could be a Linux Network Namespace, a FreeBSD Jail or other similar concept.

• Endpoint– An Endpoint joins a Sandbox to a Network. An implementation of an Endpoint could be a veth pair, an Open vSwitch

internal port or similar

• Network– A Network is a group of Endpoints that are able to communicate with each-other directly. An implementation of a

Network could be a VXLAN Segment, a Linux bridge, a VLAN, etc.

Source: https://github.com /docker/li bnetwork /bl ob/m aster/docs/design.md

ExternalnetworkG/w

Bridge

Containers – do we still need a Hypervisor?

Privilege escalation can lead to container host compromise

Internet

Port 80

Internalnetwork

Confidential Information

Lack of isolation allows an attacker to move around

Internet

Port 80

Internalnetwork

Confidential Information

NSX provides segmentation, visibility and integration

Internet

Port 80

Internalnetwork

Physical Network Infrastructure

HONEY POT

VULNERABILITYSCANNER

Micro-segmentation Alert Connection

to data center

vSphere Integrated Containers Latest…

https://github.com/vmware/vic

http://blogs.vmware.com/cloudnative/introducing-vsphere-integrated-containers-open-source-software/

Hypervisor(ESXi &

MinionVM

vifDLR

MinionVM

Minion Mgmt. IP Stack

mgmtnetwork

Lx bridge

mgmtnetwork

Kubernetes - POC

Kubernetes – POC

to data center

Benefits of NSX and containers

to data center

• Micro-segmentation to establish clear boundaries

• Stop compromises at container or application level

• Central visibility into connectivity across the data center

• Per-flow tracking• Alerts for suspicious

behavior• Virtual taps at a per-

container level

• Integration with the rest of your IT infrastructure

• Monitoring, incident response, forensics

• Access to databases, backup, system updates

CloudSilos

PublicManagedPrivate

Public Cloud – The New Silo Infrastructure?

The Challenge: Connectivity Across Multiple Clouds

Data CenterIT Administrator

Internet

AWS CloudDeveloper

Ubiquitous Securityfor Public Cloud Workloads

NSX + Public Cloud + Containers

Sydney

Hong KongPalo Alto

Chicago

Dallas Virginia

Seattle

500 Web Servers7 data centers3 continents2 public clouds + 1 on premise…in 5 minutes

https://www.youtube.com/watch?v=RBJ-KoAM-OQ

Operational Focus

EMC Smarts for NSX – Virtual + Physical TopologyVirtual Network

Physical Network

Logical Switch

Logical Router

Leaf01Spine01

Hypervisor

Hyper-V On-Premises Data Center

Public Cloud

3rd Gen Applications

Virtual Desktop

Mobile Devices

Design for the New &Accommodate The Old

Network Virtualization Next Steps with VMware NSX

virtualizeyournetwork.com

The online resource for the people, teams and organizations that are adopting network virtualization

communities.vmware.com

Connect and engage with network virtualization experts and fellow VMware NSX users

vmware.com/go/NVtraining

Build knowledge and expertise for the next step in your career

labs.hol.vmware.com

Test drive the capabilities of VMware NSX

Technology Previews

https://youtu.be/RBJ-KoAM-OQ https://youtu.be/bjodui_ZhM8

Containers & Public Cloud Tech Preview

Distributed Network Encryption Tech PreviewKubernetes & NSX

Tech Preview

Andy Kennedy - Scottish VMUG April 2016

Technology

Vmug da-wm-vplex-vmware

Vmug cloud-sept2010-convert

VMUG - Falconstor Presentation

Application Services Providence VMUG

Dutch VMUG Event 2012 - Get Certified!

Welcome to the DFW VMUG

VMUG 6 Program

San Diego VMUG Oct 2009

VMware - VMUG Montreal

Nimble Storage – VMUG Success Story

Halifax VMUG

Power Cli Workshop London Vmug

Charleston SC VMUG 8/14/13

Vision dt solutions vmug leeds

vCloud NE VMUG Presentation

Toronto VMUG - November 13, 2013 - CiRBA

2011 q1-indy-vmug

St. Louis VMUG Meeting - 09292015

London VMUG July 2011

INDY VMUG DEMO DAYS 3