Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitme

Transcription

1 SIE2034BE Securing your VMware Horizon Virtualized Apps and Desktop Investments with NSX Satish Yadavalli, General Manager & Global Practice Head Wipro Limited Bhanu Reddy, Practice Manager Wipro Limited Thomas Vigneron, SDDC Specialist NSX Vmware Networking and Security VCDX #220 #VMworld #SIE2034BE VMworld 2017 Content: Not for publication

2 Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitment from VMware to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new technologies or features discussed or presented have not been determined. 2

3 We believe that data is the phenomenon of our time. It is the world s new natural resource. It is the new basis of competitive advantage, and it is transforming every profession and industry. If all of this is true even inevitable then cyber crime, by definition, is the greatest threat to every profession, every industry, every company in the world. or - Ginni Rometty, IBM Chairman, CEO and President distribution 3

4 What s Keeping Your CISO Up at Night? Enterprise IT Security in the Headlines 1,935 confirmed data breaches in $3.62M average cost per security breach 2 1. Source: Verizon 2017 Data Breach Investigation Report 2. Ponemon Institute: Cost of Data Breach Study

5 Attacks and attackers have become more sophisticated Organized crime Insiders Cyber terrorists/ hacktivists Nation states ADVANCED PERSISTENT THREATS WEAPONIZATION OF CYBERSPACE 5

6 Bridging End User Computing Silos Windows Client- Server Web Mobile 6

7 Windows apps represent 50-70% of the apps today in the enterprise and are difficult and costly to secure and support % 7

8 Transforming Security with Desktop Virtualization 1 Centralized Data and Delivery 2 Trusted Images OS and App 3 Policy Based Access 4 Secure Endpoints 5 Network Security 8

9 Centralized Data and Delivery Data Center Virtual Desktops Users No endpoint data loss (device loss, theft, damage) Enterprise class datacenter safeguards Reduced branch infrastructure footprint (file/print/ servers etc.) Efficient recovery 9

10 Pristine, Trusted Images for Every Desktop ONE IMAGE VMworld 2017 Content: Not for Simplified, consistent management No patch maintenance window publication Provisioning on-demand Space efficient 10

11 Smart Polices Contextual access based on device or location VMworld 2017 Content: Not for True SSO Experience Policy-Managed Client Features publication Access Point Authentication Common Criteria / FIPS

12 Securing the Endpoints ThinOS Inherently virus resistant and extremely secure ThinLinux Hardened and optimized OS with latest Linux libraries VMworld 2017 Content: Not for Desktop All-in-one Mobile Embedded Windows Additional security layer can be added with defense software publication Extensive selection of secure, easy-to-manage clients to suit your budget, application, and performance needs. 12

13 What about security for the VDI network? DATACENTER NETWORK VMworld 2017 Content: Not for ENDPOINTS Centralized data, pristine images publication Hardened endpoints, access policies 14

14 Current Challenges in the Data Center Large attack surface within the data center Multiple, discrete east-west flows between desktops and infrastructure Data Center WWW EAST VMworld 2017 Other Users Virtual Desktop WEST SAP, Oracle Exchange, etc. Enterprise Storage User behaviors Zero-day threats Compromised internet websites Content: Not for publication Desktop-to-desktop hacking Desktop-to-server hacking 15

15 Anatomy of an Attack RECENT VDI DATA BREACH Friday, 8pm Compromised VDI Desktop VMworld 2017 Regional Pediatric Hospital Group Extensive VDI use Persistent virtual desktops follow providers from room to room, giving instant Content: Not for publication UNRESTRICTED LATERAL MOVEMENT Attacker was able to move freely between desktops and servers in the data center, gaining access to sensitive patient data and critical systems. access to critical medical information 16

16 Despite having been reported to IT when it occurred, a response to the attack was not quick enough to prevent a significant loss VMworld 2017 Friday, 11pm Sensitive Patient Data Exfiltrated Content: Not for publication Saturday, 9am Security Response Begins. 17

17 Security is needed for every desktop VM so can t we have it everywhere?? Why can t we have individual firewalls for every desktop VM? VMworld 2017 Content: Not for With traditional technology, this is operationally infeasible. Physical Firewalls Cost prohibitive with complex configurations publication Virtual Firewalls Slower performance, costly and complicated Data Center Perimeter 18

18 Securing East-West within VDI Environments Organizations with focus on compliancy and risk mitigation will implement security zones to protect East-West flows within the data center. Hard to implement Lots of physical infrastructure required Complex to manage VMworld 2017 PCI Zone Remote workforce Zone Shared svcs DB Zone Corp Zone Dev Zone Eng Zone Centralized Virtual Desktops Content: Not for publication DMZ Admin Zone Financial Zone 19

19 Traditional Networking & Security is complex! Internet DMZ Remote workforce Zone Shared svcs DB Zone Centralized Virtual Desktops Corp Zone Dev Zone Eng Zone Internal Networks PCI Zone Admin Zone Financial Zone 20

20 NSX and Horizon

21 NSX Value Proposition NSX Network Virtualization and Security platform makes micro-segmentation a reality Virtual networks Network Hypervisor Virtualization Layer Network, Storage, Compute 22

22 Delivering higher levels of data center security Micro-segmentation 1 Isolation and segmentation 2 Unit-level trust / least privilege VMworld 2017 Content: Not for 3 Ubiquity and centralized control publication 23

23 More Efficient Firewalls with NSX East-West Firewalling / Same host Before NSX With NSX Before NSX Distributed Virtual Firewall Nexus 7000 Nexus 7000 UCS Fabric A UCS Fabric B UCS Blade 1 UCS Fabric A UCS Blade 1 NSX vswitch UCS Fabric B Nexus 7000 vswitch vswitch East-West Firewalling / Host to host With NSX Distributed Virtual Firewall Nexus 7000 UCS Fabric A UCS Fabric B UCS Fabric A UCS Fabric B UCS Blade 1 UCS Blade 2 UCS Blade 1 UCS Blade 2 NSX vswitch vswitch 6 wire hops 0 wire hops 6 wire hops 2 wire hops Fewer hops, more efficient and precise VM networking 24

24 NSX for Horizon VDI Deployment Micro-segmentation Edge Services Network Virtualization Internal Developer Pool External Developer Pool Desktop to Desktop control Desktop to Enterprise App control Security Services e.g. Agentless AV, NGFW, IPS Load balancing, Edge firewall NAT VPN Horizon Infra Internal Developer Network External Developer Network Allows for elasticity and agility to spin up/down new pools or expand existing 25

25 Horizon with NSX: Simplify Networking & Making it Secure! Example Order of Adoption Firewalling & Security Load Balancing Logical Switching Logical Routing Physical to Virtual 26

26 Segmentation of a Horizon Environment Protecting Horizon Infrastructure Horizon Components (Connection Servers, Unified Access Gateway, View Composer, vcenter) External world to Horizon components control VMworld 2017 Access control between various Horizon components Protecting Desktop Pools Internal Developer Pool External Developer Pool Desktop to Desktop control Desktop to Enterprise App control 3 rd party Security Services e.g. Agentless AV, NGFW, IPS User / Data based access control. Web Internal Developer Pool Content: Not for publication App 3 Tier Enterprise App AD Group Based Identity Firewall (IDFW). Data Security to identify sensitive data. DB 27

27 Protecting Infrastructure

28 VMware Horizon Architecture Overview SaaS, Mobile Apps VMware Identity Manager User Workspace Virtualized Apps (ThinApps) Unified Access Gateways Windows 10 Instant Clone VMware Horizon View Linux Clone Horizon Connection Servers Virtual Desktop Pools Windows 10 3D Desktop View Composer Hosted RDS Desktops & Apps Horizon Clients Applications (VMware App Volumes) User Environment IT Settings User Profile Core Infrastructure vrealize Operations for Horizon vcenter Server Database (SQL) Active Directory VMware vsphere + NSX + VSAN 29

29 vmware-horizon-7-end-user-computing-network-ports.pdf 30

30 Easy Service Definition 31

31 Micro-Segmentation Sample Configuration Infrastructure Rules Desktop and Application Rules 32

32 Identity Based Firewall Policy driven micro-segmentation of the user

33 VMware NSX - Identity Based Firewall Rules (IDFW) DFW offers Identity Based Firewall (IDFW) functionalities: Specific AD security groups of users can be used to create DFW rules DFW rules are defined based on Active Directory (AD) membership (e.g. doctors or surgeons group): Define a NSX Security Group that contains an AD security group and apply it as the source of the DFW policy rule Users can use physical or virtual systems that have been joined to the AD Domain as the source - Destination system must be a VM. Policy Rule: Source Destination Service Action Doctors (security group) Patient Record Servers Any Allow Any Any Any Deny 34

34 VMware NSX - Identity Based Firewall Rules & EUC Before NSX All Desktops on a VLAN can communicate freely. Once one Desktop is compromised, lateral movement cannot be restricted. With NSX Micro-segmentation can granularly control desktops even on shared VLAN. User/Group based Access Control Control VDI to Apps access using NGFW redirection when needed. VMworld 2017 Files HR Finance SharePoint Network Content: Not for publication Bob (HR) Human Resources Jennifer (Finance) Finance 35

35 Secure Just in Time Desktops Sales Admin Developer Stateless desktop Single Pool Role-Based Desktop Creation & Customization Sales Developer Sales Sales Developer Developer Sales Dev. Sales desktop Developer desktop Admin Admin Admin Admin Admin desktop Network Policy from NSX Application Layers from App Volumes Personalization from UEM 36

36 Extensibility: Partner Dynamic Service-Chaining NSX Ecosystem Partner AV scan on desktop NSX Manager / Control Plane Partner AV scan detects virus/malware NSX places Desktop VM under network lock-down Ex: Trend Deep Security McAfee MOVE Tags Desktop VM for NSX No traffic in or out 37

37 AirWatch Per-App VPN and VMware NSX Device Level VPN App Level VPN App Level VPN Micro Segmentation 38

38 Wipro-VMware 360º Partnership Overview Accelerate Clients IT Transformation to the Next Generation Data Center Wipro 30+ years in-depth experience in infrastructure services Cloud advisory, Cloud Migration, DevOps, and Cloud Security Wipro and VMware Alliance Strategic partnership Wipro s transformation services plus VMware s disruptive technologies VMware Premier Partner Wipro VMware Wipro and VMware Alliance Wipro as a VMware Customer VMware Leading cloud infrastructure and business mobility provider Wipro as a VMware Customer VMware AirWatch deployment of 150,000+ employees 4,000 VDI instances VMware virtualization 39

39 Boundary-less ODCs for Wipro Environment Scope Solution Benefits ~4,000 Users 6 Regions Users spread across 6 regional centers in India 100% VDI Windows & Linux Persistent Desktops End points 100% Thin Clients Full VMware stack NSX for micro segmentation, Horizon for VDI, AppVolumes for real time app delivery Software Defined Storage Boundary-less ODCs Physical desk/port is not tagged to any project/odc 30% reduction In overall costs 40

40 Wipro Environment 4000 Virtual Desktops Leveraging clones, AppVolumes VMworld 2017 Content: Not for 50 ESXi Vsphere 6.0 servers publication 2 vcenters NSX Distributed firewall 41

41 Security Benefits VMworld 2017 Content: Not for Secure access to desktops from anywhere, at any time Rapid, centralized updates and patching OS updates through clones Application updates through AppStacks publication Instant recovery in the event of crashes, malware proliferation Micro-segmentation for each development center 42

42 Case Study: Largest Women only University Client is the World s largest women only university with a capacity to enroll over students, faculties Campus has a 700-bed hospital equipped with state-of-the-art facilities Technology Implemented VMware Horizon View 6.0 Number of Virtual desktops / Users VDI concurrent license 5000 Hardware Operating System Support Model Client Profile Infrastructure 152 X UCS B250 M2 and 16 x UCS B200 M2 Hypervisor : ESXi 5.5 Server OS : Windows 2012 R2 Desktop OS : Windows 7 Onsite Support Manage VDI Infrastructure used by Students and Faculty Enable seamless access to University applications and internet browsing. Roll out additional thin clients Year-on-Year Single point of ownership Project Scope Business Benefits Service and Technology transformation Streamlined operations Standardization of Services and policy based service management Repeatability and scalability Central governance towards compliance and policies 43

43 Learn More Hands on Labs: Web:

44

45