Etisalat Digital Enhancing Security in the Cloud

Transcription

1 solution brief Telecommunications Secure Cloud Services Etisalat Digital Enhancing Security in the Cloud To improve the security of public, private, and hybrid cloud services, Etisalat Digital designed and developed a robust, resilient platform, reinforced against data breaches and hypervisor attacks. Through collaborative work with Intel, Etisalat Digital has developed a strong, secure cloud service offering the Etisalat Digital OneCloud* Platform that features deeper, hardware-level protection capable of meeting the more rigorous requirements of government entities and enterprises operating across geopolitcal boundaries. Miguel Angel Villalonga Vice President/Cloud & Data Center Etisalat Digital Executive Summary Etisalat Digital is a business unit of Etisalat helping to drive digital transformation by enabling enterprises and governments to improve decision-making and efficiency through the use of the latest technologies. The unit focuses on providing digital solutions in various domains, including cloud, cybersecurity, digital marketing, mobile commerce, Internet of Things (IoT), and big data and analytics. In today s virtualized computing environments, where breaches in the security of IT infrastructures present a substantial challenge, the reinforcement of platforms against hypervisor attacks and other intrusions is essential. Etisalat Digital has responded to this challenge by engineering its cloud services with multiple layers of security, centered on Intel Trusted Execution Technology (Intel TXT). Etisalat Digital is collaborating with Intel and providing cloud infrastructure powered by Intel Xeon processors and Intel technologies. Etisalat Digital plans to expand its catalog offerings of public cloud offerings and target a number of industry verticals in the competitive UAE marketplace and surrounding regions. Etisalat Digital s expanding involvement with government bodies and global enterprises has also heightened the need to ensure data sovereignty to comply with privacy laws and regulations in force within the country in which the data resides. That requirement and the need for stronger hardware-based security protection led Etisalat Digital to integrate Intel TXT capabilities into its latest service offerings. Intel TXT delivers stronger security by verifying vital system components at startup, including the system BI, firmware, and hypervisor operation. As an integral feature of select Intel Xeon processors in the E3, E5, and E7 families, Intel TXT helps establish trusted compute pools, protecting the cloud environments of virtualized data centers against external attacks. The result is improved platform integrity through a verifiable hardware root of trust and greater visibility into operations and auditing of virtualization components. Through this and other cloud computing technologies from Intel, Etisalat Digital can deliver and maintain secure, proven, optimized cloud solutions for customers. This paper discusses the advanced technologies helping Etisalat Digital expand into new markets, the National Election Voting Project in which Etisalat Digital was engaged, and the Intel technologies that Etisalat Digital has integrated into its infrastructure to enhance the performance, security, and reliability of its service offerings.

2 Solution Brief Etisalat Digital Enhancing Security in the Cloud 2 Etisalat Background From its headquarters in Abu Dhabi, Etisalat actively provides services for more than 300,000 organizations in the United Arab Emirates (UAE), ranging from small-to-midsize businesses (SMBs) to large enterprises and government organizations. As the leading telecommunications operator in the UAE, Etisalat continues to expand its focus on enhancing the customer experience, moving ahead to further differentiate its service offerings. Recent initiatives have focused on optimizing performance, improving reliability, and strengthening security across its infrastructure. Growth through Digital Transformation Etisalat Digital has a skilled team of digital experts, solution architects, project managers, and digital engineers. Available digital assets and platform technologies include data centers, cloud platforms, big data and analytics engines, digital and mobile payments platforms, security operation centers, IoT platforms, and command and control centers. Etisalat Digital combines the scale, strength, and robust network of the leading regional telco with deep expertise in digital technologies. The company is well positioned to provide end-to-end solutions, applying the latest digital technologies to enhance education, healthcare, city government, smarter transportation, resource management, and the cashless economy. Etisalat is also a member of the Intel Network Builder ecosystem, working collaboratively to advance the key technologies used by communications services providers and to help enhance technology integration and high-volume networking development. Protecting Data Sharing In response to the evolution and rising importance of cloud computing, the Dubai Data Law has been implemented to streamline data sharing between government organizations and the private sector. The intention is to expand the opportunities for collaboration, innovation, and entrepreneurial ventures, but the law also lays down strict measures for retaining data within specific geographical boundaries and protecting sensitive data. To avoid breaches and software attacks that could violate regulations, the security of the cloud infrastructure is vital and ongoing auditing and tracking of infrastructure components must be accomplished in a visible, accessible manner. Etisalat Digital is responding to these developments by ensuring that all necessary protections are incorporated into its cloud computing infrastructure and that security audit trails can be established to demonstrate compliance. On a larger scale, the Smart Dubai initiative, instituted by Sheikh Mohammed bin Rashid, vice president of the UAE in 2014, is moving toward making Dubai the smartest city in the world by 2017, by employing Internet of Things (IoT) technologies and other technological advances. Etisalat Digital is exploring opportunities that are opening as new technologies are needed to foster the goals of this initiative. Use Case: National Election Voting Project The National Election Voting Project has been a key, high visibility project for Etisalat Digital during 2015, elevating the importance of security protection to ensure the integrity and legitimacy of the voting process. This engagement with the UAE government emphasized the necessity of preventing any breaches of the cloud-based infrastructure engineered by Etisalat Digital, maintaining continuous tracking and auditing of all server activities and minimizing the risks of illicit software hacking that could compromise voter registration or the voting results. The National Election Voting Project was launched to develop an advanced, secure platform for country-wide voting. Etisalat s OneCloud* solution was selected to be the main platform, an Infrastructure as a Service (IaaS) offering built on Intel architecture components. The platform met all necessary requirements of the Ministry of Federal National Council Affairs (MFNCA). The MFNCA issues certified personal identification for voters, which is linked to the e-voting system. Voters can visit the MFNCA s website to ensure they are listed and can then vote during an early voting period or on Election Day. Without the traditional guarantees of physical separation of workloads granted by a non-virtualized infrastructure, shared infrastructures residing in the cloud need to maintain the isolation of workloads across the virtualized environment. A key aspect of this requirement is ensuring that multiple workloads within a multi-tenant environment cannot tamper or interact with each other in any way. The MFNCA required a solution in which a trusted launch with defined platform policy could be established, preventing unauthorized software from running on the platform and isolating and protecting process execution from data. A means of providing full platform and network attestation was also required to protect against unauthorized network access. The MFNCA implementation favored a number of characteristics of the OneCloud solution, including the security provisions, high availability, system performance, disaster recovery, and certification compliance with industry standards. As the UAE marketplace for cloud services has grown and evolved, greater emphasis has been placed on security and data sovereignty, requiring new technologies to support regulatory compliance, conduct automated security review and audits, and provide a protected environment for cloud infrastructures. Intel Trusted Execution Technology (Intel TXT), a key component of the Etisalat OneCloud solution, establishes a trusted platform that encompasses hardware, software, and firmware. The Intel TXT-enabled platform deployed by Etisalat Digital measures the execution environment to shield vital data against software-based attacks and enables attestation, operating in combination with a trusted platform module (TPM). Intel TXT provides the root of trust for measurement and the TPM, an industry standard device for secure archiving, provides the root of trust for reporting and storage. Together, these components represent the foundational elements of fully realized platform trust.

3 Solution Brief Etisalat Digital Enhancing Security in the Cloud 3 Implementing the Solution Working closely with a team at MFNCA, the engagement went through these distinct phases: Analyze and design phase. The high-level design, to be deployed in the new data center, encompassed dedicated servers, storage, backup, a local area network, infrastructure, and security. Infrastructure deployment. As part of the infrastructure deployment, these tasks took place: Configuration of the data center server, storage backup, LAN, infrastructure, security, and the OneCloud Platform. Installation of the Oracle Real lication Clusters* (RAC) engine with provisioning for virtual machines. Collaboration with the MFNCA operational teams to physically construct the design environment. Testing carried out in cooperation with MFNCA to confirm operational integrity, user acceptance, and system performance. During the early development of the OneCloud Platform, Intel served as technical advisor, ensuring alignment of the Intel Xeon processor roadmap with the roadmap for the Etisalat OneCloud Platform. Technology demonstrations presented by Intel highlighted the capabilities of many of the key technologies used in OneCloud, including Intel TXT, Intel Data Center Manager, Apache Hadoop*, as well as others. Early access to Intel technology and reference architectures also proved valuable in the design and development stages of the project, giving Etisalat Digital a blueprint for integrating the latest Intel Xeon processors, as well as Intel-based network interface cards and solid-state drives. The project demonstrated the effectiveness of the OneCloud solution for handling very secure transactions in a consistent, reliable way to meet the high standards of MFNCA and the requirements and acceptance of the voting public. The inclusion of Intel TXT as part of the solution strengthens the overall security of the cloud services and ensures a root of trust for measurement, reporting, and storage. Intel TXT identifies any code that has been modified or compromised so that immediate measures can be taken to correct the problem or intrusion before a server launch is completed. Etisalat OneCloud Platform Solution Components The Etisalat OneCloud Platform, shown in Figure 1, functions as both a cloud broker and orchestration service. Built on an Intel architecture framework, OneCloud provides support for three cloud-service models: public, private, and hybrid. The digital transformation taking place globally across enterprises and government organizations calls for agile hybrid cloud management, easily provisioned within a secure multi-tenant computing environment, and the capability of scaling to a wide range of workloads from small-scale pilot projects to massive application server clusters. The OpenCloud Platform supports open standards and runs on a combination of advanced Tier 1 vendor hardware and standard high-volume servers from Intel powered by the Intel Xeon processor family. To provide highly scalable platform security in physical and virtual infrastructures, Intel Self-Service, Governance, Orchestration, Reporting Super Admin Admin Full Service Integration Security Networking Servers Anti-DDoS Anti-Virus NLBs VPN Windows PXE Firewall WAF SDN WAN Linux Customer A Customer B Customer C Hybrid Customer A Users Storage Block Backup Object Archive Shared Servers Shared Storage Dedicated Servers Dedicated Storage Ready to use from different UAE Datacenters (DR Ready) Subscription model from monthly to daily resource consumption Different performance QoS and SLAs Available in Etisalat DC or Customer Premises Remotely Managed and Custom sizing Integrates with Public for Unified Hybrid Cloud deployment Figure 1. Components of the Etisalat OneCloud* Platform Public Cloud Private Cloud

4 Solution Brief Etisalat Digital Enhancing Security in the Cloud 4 TXT works in concert with the servers and the software stack installed on top of the server systems. The trusted, compliant cloud infrastructure offered by Etisalat Digital delivers reliable on-demand subscription services well suited to a wide range of enterprise and government applications. With multi-layered security and the agility to respond rapidly to changing business needs and workload demands, the OneCloud platform effectively supports the growth of digital businesses across mobile, social, and big data implementations. The Security Value of Intel Trusted Execution Technology Threats to the integrity of IT infrastructures and the potential risks of security breaches pose a challenge that chief security officers (CSOs) and chief information security officers (CISOs) must address to protect cloud-based data centers. To this end, Intel developed Intel TXT to help strengthen platforms against hypervisor attacks, root kit installations, and firmware attacks. The physical isolation that is provided by traditional hardware infrastructures is no longer available in virtualized environments. Enhancements available through Intel TXT help ensure virtual machine (VM) isolation and protect applications and data from evolving security threats. Intel TXT also provides a hardware-based means of verifying and complying with industry regulations and government standards that apply to data protection. Building a Chain of Trust, Visibility, and Control The foundation of trust and security in a cloud-based IT infrastructure starts with the servers and systems in use. To ensure optimal security, Intel TXT includes the basic building blocks of the infrastructure encompassing hardware, firmware, and software to create a balance between functionality and protection against intrusions. During the initial system boot, Intel TXT creates an environment for comparing each of the vital start-up elements against a verified baseline reference. This reference is known as the Measured Launch Environment (MLE). A unique identifier cryptographically based is assigned to every approved component involved in the launch. Any code that attempts to run that does not match the approved code in the baseline is blocked by the hardware. Because this mechanism is grounded in hardware, it helps establish a trusted foundation that protects against a variety of software attacks that can occur in the earliest stages of the system boot process. Avoiding this type of attack minimizes the risk and expense associated with data breaches and helps prevent the need for system shutdown and remediation. The Intel TXT processes that take place at system launch are: Verified Launch. The chain of trust based on the hardware enables launch of the MLE if a known good state can be confirmed. If changes to the MLE are detected through cryptographic analysis, the system start-up is blocked. Launch Control policy. The Launch Control policy maintains lists of approved executable code and uses a policy engine to enforce rules and control the launch sequence. Secret Protection. Hardware mechanisms purge residual data in the event of an improper MLE shutdown. This measure helps protect data from memory-snooping software and reset attacks. Attestation. Platform measurement credentials are sent to local or remote users or systems, completing the verification process and providing an audit trail of the process to better support regulatory mandates and compliance. Ensuring Customer Confidence in the Cloud In a number of mission-critical sectors including financial services, government services, and healthcare end-to-end security in the cloud is an absolute necessity. Several specific Intel solutions help provide security in cloud environments: Enhancing data protection efficiency. Intel Advanced Encryption Standard New Instructions (Intel AES-NI) are instructions in the processor that accelerate encryption based on the widely used Advanced Encryption Standard (AES) algorithm. These instructions enable fast and secure data encryption and decryption, removing the performance barrier to allow more extensive use of this vital data protection mechanism. With this performance penalty reduced, cloud providers are starting to embrace Intel AES-NI to promote the use of encryption. Enhancing data protection strength. Intel Data Protection Technology with Intel AES-NI and Secure Key is the foundation for cryptography without sacrificing performance. These solutions can enable faster, higher quality cryptographic keys and certificates than pseudorandom, software-based approaches in a manner better suited to shared, virtual environments. Protecting the systems used in the cloud or compute infrastructure. Intel TXT is a set of hardware extensions to Intel processors and chipsets with security capabilities such as measured launch and protected execution. Intel TXT provides a hardware-enforced, tamper-resistant mechanism to evaluate critical, lowlevel system firmware and /Hypervisor components from power-on. With this, malicious or inadvertent code changes can be detected, helping assure the integrity of the underlying machine that the data resides on. Financial services customers, government organization, communications service providers, and other organizations around the world are incorporating these solutions into their systems to provide added security at both the platform and data level in public, private, and hybrid cloud deployments. Learn more about the capabilities of Intel TXT in this white paper: Intel Trusted Execution Technology: Hardware- Based Technology for Enhancing Server Platform Security

5 Solution Brief Etisalat Digital Enhancing Security in the Cloud 5 Enabling a Trusted Public or Private High- Performance Cloud Cloud infrastructure powered by Intel Xeon processors and Intel technologies helps enable trust in cloud servers by improving visibility into virtualized components and providing greater control of resources. Strengthening Cloud Security With data security a prime consideration security for telecommunications service providers worldwide, enhancements built into select Intel Xeon processors and chipsets help establish an infrastructure that meets rigorous security policies. These enhancements contribute to greater acceptance and adoption of cloud technologies, helping overcome misperceptions about privacy and data protection. Public cloud usage has been somewhat slow to gain momentum, partially because of misperceptions around security, as illustrated in Figure 2. 1 Ongoing Collaboration The collaboration between Etisalat Digital and Intel makes a number of opportunities available for expanded cloud services with stronger security, enhanced reliability, and proven industry acceptance. The combination of Etisalat s market leadership in the Middle East and cloud infrastructure powered by Intel Xeon processors create a winning situation for both companies to strengthen market reach and extend the customer base into new geographies. Factors Preventing More Pervasive Public Cloud Usage Security concerns 48% Data protection concerns/challenges 33% Performance concerns 29% Figure 2. Factors preventing more pervasive public cloud usage

6 Solution Brief Etisalat Digital Enhancing Security in the Cloud 6 The complexities of today s cloud infrastructures create challenges that must be met if overall trust in security and data integrity are to be ensured. Visibility into processes across virtualized environments, integration with existing IT systems, and automated security reviews and audits are all necessary to build trust. Etisalat Digital, working closely with Intel, has developed an exceptionally secure cloud infrastructure, using hardware-based security and platform attestation to protect the data privacy and integrity. - Miguel Angel Villalonga, Vice President/Cloud & Data Center, Etisalat Digital Learn More Learn more about Etisalat: Learn more about Intel Cloud Technology: Explore the features and capabilities of Intel Trusted Execution Technology Discover the best practices for securing the cloud in the Intel Trusted Execution Technology Deployment Guide. 1 Source: I Intel technologies features and benefits depend on system configuration and may require enabled hardware, software or service activation. Performance varies depending on system configuration. No computer system can be absolutely secure. Check with your system manufacturer or retailer or learn more at intel.com. INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED, BY ESTOPPEL OR OTHERWISE, TO ANY INTELLECTUAL PROPERTY RIGHTS IS GRANTED BY THIS DOCUMENT. EXCEPT AS PROVIDED IN INTEL S TERMS AND CONDITIONS OF SALE FOR SUCH PRODUCTS, INTEL ASSUMES NO LIABILITY WHATSOEVER, AND INTEL DISCLAIMS ANY EXPRESS OR IMPLIED WARRANTY, RELATING TO SALE AND/OR USE OF INTEL PRODUCTS INCLUDING LIABILITY OR WARRANTIES RELATING TO FITNESS FOR A PARTICULAR PURPE, MERCHANTABILITY, OR INFRINGEMENT OF ANY PATENT, COPYRIGHT OR OTHER INTELLECTUAL PROPERTY RIGHT. UNLESS OTHERWISE AGREED IN WRITING BY INTEL, THE INTEL PRODUCTS ARE NOT DESIGNED NOR INTENDED FOR ANY APPLICATION IN WHICH THE FAILURE OF THE INTEL PRODUCT COULD CREATE A SITUATION WHERE PERSONAL INJURY OR DEATH MAY OCCUR. Intel may make changes to specifications and product descriptions at any time, without notice. Designers must not rely on the absence or characteristics of any features or instructions marked reserved or undefined. Intel reserves these for future definition and shall have no responsibility whatsoever for conflicts or incompatibilities arising from future changes to them. The information here is subject to change without notice. Do not finalize a design with this information. The products described in this document may contain design defects or errors known as errata which may cause the product to deviate from published specifications. Current characterized errata are available on request. Contact your local Intel sales office or your distributor to obtain the latest specifications and before placing your product order. Copies of documents which have an order number and are referenced in this document, or other Intel literature, may be obtained by calling , or by visiting Intel s Web site at Copyright 2016 Intel Corporation. All rights reserved. Intel, the Intel logo, and Xeon are trademarks of Intel Corporation in the U.S. and/or other countries. * Other names and brands may be claimed as the property of others. 1116/MH/MESH/PDF