The Evolution of Data Center Security, Risk and Compliance

Transcription

1 #SymVisionEmea

2 #SymVisionEmea The Evolution of Data Center Security, Risk and Compliance Taha Karim / Patrice Payen

3 The Adoption Curve Virtualization is being stalled due to concerns around Security and Compliance security is here this is a problem adoption is here The Evolution of Data Center Security, Risk and Compliance 5

4 Software-Defined Data Center Data Center Security Automation and Management The Vision The data center of the future is software-defined. It is dynamic and application-centric. Our mission is to support our customers as they evolve to the SDDC. Applications and Policies Software Defined Services Network Virtualization Compute and Storage Virtualization On-Prem/Private/Public Cloud Resources Drivers Cost Speed Flexibility Inhibitors Security Cost Compliance Complexity The Evolution of Data Center Security, Risk and Compliance 6

5 Software-Defined Data Center Data Center Security Automation and Management Compute and Storage Virtualization A dynamic, application-centric data center needs dynamic, application-centric security. Applications and Policies Software Defined Services Network Virtualization Compute/Storage Virtualization Dynamic, contextbased, policy-centric security Integrated security orchestration Security for hybrid networks Security for leading hypervisors 1. Drive down hardware and power costs 2. Abstract workload from hardware Hypervisor 3. Provision and monitor services By 2015, 40% of security controls used in Enterprise data centers will be virtualized, up from less than 5% in 2010 Neil MacDonald On-Prem/Private/Public Cloud Resources Support for key standards for private clouds e.g. Openstack and partner with vendors delivering those standards e.g. Amazon, VMWare, Openstack The Evolution of Data Center Security, Risk and Compliance 7

6 Little v - Virtualization Consolidation of Identical Apps Driver: Reduce Hardware and Power Costs Hypervisor Security Concerns: New Threat Surfaces Cloud Admin Hypervisor Management Plane Network Security Zones remain unchanged The Evolution of Data Center Security, Risk and Compliance 8

7 Big V - Virtualization Full Abstraction of Application from Hardware App A App B App A App A App B Driver: Agility, Speed, and Utilization Security Concerns: Motioning Security stays with workload Demonstrate Compliance Server A Server B Server C Server D Network Security Zones Static Network Zones can impede value The Evolution of Data Center Security, Risk and Compliance 9

8 Software-Defined Data Center Data Center Security Automation and Management Network Virtualization A dynamic, application-centric data center needs dynamic, application-centric security. 1. Agility and Speed Applications and Policies Dynamic, contextbased, policy-centric security 2. Abstract workload from hardware SDN Software Defined Services Network Virtualization Compute/Storage Virtualization Integrated security orchestration Security for hybrid networks Security for leading hypervisors 3. Drive down hardware costs By 2015, 40% of security controls used in Enterprise data centers will be virtualized, up from less than 5% in 2010 Neil MacDonald On-Prem/Private/Public Cloud Resources Support for key standards for private clouds e.g. Openstack and partner with vendors delivering those standards e.g. Amazon, VMWare, Openstack The Evolution of Data Center Security, Risk and Compliance 10

9 Small sdn - Software Defined Networking Mimic hardware security zones with software DMZ PCI HIPAA Driver: Agility, Speed Security Concerns: Motioning Security stays with workload Demonstrate Compliance Network Security Zones Static Network Zones can impede value The Evolution of Data Center Security, Risk and Compliance 11

10 Big SDN - Software Defined Networking Micro Segmentation by Application Sharepoint Order Processing HR Onboarding Driver: Agility, Speed Security Impacts: Motioning Firewall rules follows application Software Defined Networks Network Security Zones Large number of security zones No need to group apps by zones The Evolution of Data Center Security, Risk and Compliance 12

11 #SymVisionEmea The Growing Security Challenge The Evolution of Data Center Security, Risk and Compliance 13

12 Software-Defined Data Center Data Center Security Automation and Management Benefits of Virtualization A dynamic, application-centric data center needs dynamic, application-centric security. Applications and Policies Software Defined Services Network Virtualization Compute/Storage Virtualization Dynamic, contextbased, policy-centric security Integrated security orchestration Security for hybrid networks Security for leading hypervisors VM 1. Centrally apply and attach policies to workloads 2. Automate workflows across services 3. Provision and monitor services By 2015, 40% of security controls used in Enterprise data centers will be virtualized, up from less than 5% in 2010 Neil MacDonald On-Prem/Private/Public Cloud Resources Support for key standards for private clouds e.g. Openstack and partner with vendors delivering those standards e.g. Amazon, VMWare, Openstack The Evolution of Data Center Security, Risk and Compliance 14

13 What customers are still concerned about Threats how do I continuously combine updated VM 1. Centrally apply and attach policies to workloads 2. Automate workflows across services 3. Provision and monitor services? threat and vulnerability intelligence with workload context to optimize security response? Security Consistency how do I ensure consistent security across my virtual and physical infrastructure so I can move workloads from to physical to virtual. Compliance how do I make sure adequate controls are in place at all times to ensure and demonstrate regulatory compliance? Policy how do I make sure I have the right menu of policies available for orchestration and how do I continuously adapt these across multiple products in response to the changing threat environment? Segregation of Duties how do I ensure the integrity of my data center security in the face of converging admin roles? Security Tax how do I optimize security to minimize the performance and operational cost to my data center? The Evolution of Data Center Security, Risk and Compliance 15

14 #SymVisionEmea Symantec Data Center Security The Evolution of Data Center Security, Risk and Compliance 16

15 Server Security Date Store Security VDI Security Unified Assessment Symantec SDDC vision 1 Embed Security into the platform 2 Integrate across point technologies 3 Automate and orchestrate security Security Orchestration Platform The Evolution of Data Center Security, Risk and Compliance 17

16 1 2 Embed security into the platform Integrate across point technologies Data Store Security UA PAN Threat Protection Data Protection DSS CSP/ SEP Server Hardening DLP CSP Encryption PGP VSM Hypervisor Hardening/SOD Integration with SDN/SDDC Platform Security via the Hypervisor Frictionless agents to deploy higher controls Bring together multiple controls into a single offering Integrate across policy and deployment Easily allow security to scale up based on the policy of the workload The Evolution of Data Center Security, Risk and Compliance 18

17 3 Automate and Orchestrate Security Automate key processes to ensure workloads stay secure - Deployment and Provisioning - Updating security baselines to respond to external threats - Implementing new security profiles as workloads change - Remediating workloads through their lifecycle Server Security Software Defined Security Service SDN/SDDC Platform Data Store Security Firewall Ongoing validation and continuous monitoring The Evolution of Data Center Security, Risk and Compliance 19

18 SDDC Security Workflow Orchestration Sample The Evolution of Data Center Security, Risk and Compliance 20

19 How Does Symantec and Vmware NSX Work The Evolution of Data Center Security, Risk and Compliance 21

20 Symantec Data Center Security (DCS): Server/Server Advanced DCS: Server Advanced offers security and compliance capabilities in a single agent, as well as agentless AV for VMware infrastructures Security Definition-less host-based security solution, i.e. policy-based Network protection capabilities Administrator/root de-escalation Registry lock-down Application sandboxing NEW Agentless anti-malware capability for VMWare NSX enabled systems Compliance File integrity monitoring Registry monitoring Event log monitoring Failed/successful login monitoring Privilege escalation monitoring The Evolution of Data Center Security, Risk and Compliance 22

21 #SymVisionEmea Demo and Case Studies The Evolution of Data Center Security, Risk and Compliance 23

22 Symantec Data Center Security The Evolution of Data Center Security, Risk and Compliance 24

23 Case Study #1 Domain Controller Lockdown Vertical Financial Industry Compelling Event/Challenge A breach of the company s domain controllers caused them to rebuild their entire AD environment (750+ DCs). To prevent their new environment from being recompromised, DCS:SA was to be utilized in a full lockdown scenario. Actions Deployed agent to all domain controllers in less than 2 weeks. Created VERY restrictive white-list policy over the course of 2 months. Integrated DCS:SA events with third party SIEM solution for alerting/analysis. Results Cut-over to rebuilt environment occurred on schedule with no complications. All known indicators of compromise were successfully blocked by the policy. The Evolution of Data Center Security, Risk and Compliance 25

24 Case Study #2 Active Breach Response Vertical Government/Manufacturing Compelling Event/Challenge Organization notified that traffic originating from them was terminating in China. Company was already in the process of deploying DCS:SA for monitoring capabilities. Company needed a way to immediately terminate the malicious activity without jeopardizing functional aspect of the compromised systems. Actions Completed deployment of agent to inscope systems. Developed targeted prevention policy to block only malicious activity. Results Company was able to affirmatively block all malicious activity. Company now looking to proactively lock down DCs and other critical applications to prevent further breaches. The Evolution of Data Center Security, Risk and Compliance 26

25 Case Study #3 Legacy OS Lockdown Vertical Retail - SCADA Compelling Event/Challenge A company received a audit notification due to failure to patch operating systems. Operating system had been end-of-life d by manufacturer, but application was not supported on newer versions of OS. Actions Deployed agent to legacy OS systems. Created strict white-list policy to fully lock down OS on in-scope systems. Configured detection policy for FIM, failed login, and successful login monitoring. Integrated with 3 rd party SIEM for correlation and alerting. Results Auditors accepted DCSS as configured as a valid compensating control for audit item. Organization was able to continue running application on protected OS. The Evolution of Data Center Security, Risk and Compliance 27

26 #SymVisionEmea Product Strategy and Roadmap The Evolution of Data Center Security, Risk and Compliance 28

27 Any information regarding pre-release Symantec offerings, future updates or other planned modifications is subject to ongoing evaluation by Symantec and therefore subject to change. This information is provided without warranty of any kind, express or implied. Customers who purchase Symantec offerings should make their purchase decision based upon features that are currently available. The Evolution of Data Center Security, Risk and Compliance 29

28 Protecting the DC at each layer 3 Application/Data Plane 2 Workload Information Protection Focus Designed for key applications in the data center Threat Protection Focus Workload Server Centric Security Orchestration Platform Operations Director Security Service Assessment / Discovery Data Store Security Server Security VDI Security 1 Infrastructure SVA SVA VM Backplane vcenter (Management) AWS Infrastructure Software Defined Networks Infrastructure Protection Backplane Hardening SDN Integration The Evolution of Data Center Security, Risk and Compliance 30

29 Data Center Security : Server The first of the new offerings to ship from Symantec! Symantec Data Center Security: Server Frictionless AV Protection Hypervisor-based security virtual appliance Low OPEX Fully integrated with VMware NSX Always On Anywhere Protection Utilizing Symantec Best in Class AV and Insight Reputation What s Next: Guest Network Threat Protection Security Response Insight Reputation Virtual Data Center Integrated with CSP Scale up to Full Lock Down Wizard Driven Simplified Hardening Protected Application Whitelisting and Control What s Next: Application Centric Protection Data Center Security Service for VMWare NSX The Evolution of Data Center Security, Risk and Compliance 31

30 Data Center Security : Data Store Symantec Data Center Security: DataStore Unified Protection Security Response Insight Reputation Threat Protection -Content Filtering DLP Integration Data Insight Encryption Unified Policy and Administration Across Critical Applications & Data Messaging (Exchange) NAS Filers NetApp SharePoint Cloud Apps DSS Deployed across Virtual & Cloud The Evolution of Data Center Security, Risk and Compliance 32

31 #SymVisionEmea Thank you! Copyright 2014 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. The Evolution of Data Center Security, Risk and Compliance 33