CSP 2017 Network Virtualisation and Security Scott McKinnon

Transcription

1 CSP 2017 Network Virtualisation and Security Scott McKinnon Security Lead, Northern EMEA Network & Security, VMware

2 Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitment from VMware to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new technologies or features discussed or presented have not been determined. CONFIDENTIAL SHARED UNDER NDA 2

3 Session Overview 1 Digital Transformation 2 Transforming Security with VMWare 3 Future Capabilities: Project Goldilocks 4 Future Capabilities: Distributed Network Encryption 5 Product Accreditation 6 Summary 3

4 Digital Transformation 2017 VMware Inc. All rights reserved.

5 Nimble innovation. Better ways of working. Inventive business models. New customer experiences. 5

6 Why Business Leaders Are Embracing Digital A Dramatic Shift in a Year 28% 32% 31% 26% 31% 9% 12% 14% 11% 12% Innovate in agile ways Predict new opportunities Demonstrate transparency and trust Deliver unique and personalized experiences Enable always-on, real-time operations Source: Vanson Bourne and Dell Technologies, Embracing a Digital Future, October

7 2017 Digital Transformation Agenda BUSINESS OUTCOMES Business Agility and Innovation Exceptional Mobile Experiences Protection of Brand and Customer Trust Modernize Data Centers Integrate Public Clouds Empower Digital Workspaces Transform Security STRATEGIC IT PRIORITIES 7

8 Transform Security 8

9 Cybersecurity Remains a Top Priority The more digital the business, the more critical cybersecurity % Of organizations report a data breach due to employees using mobile devices Data breaches are on the rise Verizon Data Breach Investigations Report (2011, 2012, 2013, 2014, 2015, 2016) 2. Ponemon Institute, The Economic Risk of Confidential Data on Mobile Devices in the Workplace, February

10 Yet Enterprise IT Security Spend Is Relatively Low Overall Median IT Budget and Percentage Allocated to Security by Year $500K 1M $500K 1M $500K 1M 4 6% 4 6% 7 9% (Projected) Source: SANS Institute, IT Security Spending Trends, Barbara Filkins, February

11 Security Is an Architectural Issue

12 The World We Must Secure Devices Apps Traditional Apps Cloud-Native Apps SaaS Apps Typical App Connects to 7 Cloud Services Infrastructure Private Clouds Hybrid Clouds Public Clouds Virtualized Compute, Storage, Networking, Security 12

13 From Yesterday s Simple Stack To Today s Reality: The Application Is a Network Then: Now: COMPUTE NETWORK STORAGE COMPUTE NETWORK STORAGE Monolithic Stack Complexity Is the Enemy of Security 13

14 An Amazing Array of Security Innovation 14

15 We need an architecture for security. 15

16 Without an Architecture for Security, Organizations Cannot Take Advantage of Security Innovations Security Policies 16

17 Architecture for Security A Shift in Mindset from How Do I Secure Virtualization? to Use Virtualization to Secure Security Policies Virtualisation Layer Alignment, Ubiquity 17

18 Micro-Segmentation: Ubiquitous Enforcement and Universal Control Ecosystem of Innovators Cross-Industry Customer Adoption 18

19 An Architecture to Transform Cybersecurity As We Know It Least Privilege Automation Ubiquitous Virtualisation Layer Context 19

20 How VMware Helps What makes cybersecurity so challenging? Transform Security New apps and delivery models can t be easily protected with perimeter-centric Secure Application network Infrastructure security. Proliferating and diverse endpoints access a range of apps and IT services. Secure Identity and Endpoints Increasingly complex regulatory compliance requires more of organizations. Streamline Compliance Intrinsic Security from Data Center to Device 20

21 Enabled with VMware s Integrated Architecture Empower Digital Workspaces Any Device F VMware Workspace ONE Desktop Mobile Identity Integrate Public Clouds Modernize Data Centers Any Application Traditional Apps Cloud-Native Apps SaaS Apps VMware Cross-Cloud Architecture Private Cloud Hybrid Cloud Public Cloud VMware Cross-Cloud Services Transform Security Any Cloud VMware vrealize Cloud Management Software-Defined Data Center VMware Cloud Foundation VMware vcloud Air Network VMware vcloud Air The information in this presentation is intended to outline our general product direction. It is for informational purposes only. 21

22 How Virtualisation Can Aid Better Security Hygiene

23 The Modern Kill Chain Intrusion Propagation Extraction Exfiltration Attack vector/malware Delivery mechanism Entry point compromise Escalate privileges Install C2* infrastructure Lateral movement Break into data stores Network eavesdropping App-level extraction Parcel and obfuscate Exfiltration Cleanup Stop infiltration 80% of the investment is focused on preventing intrusion The attack surface is simply too wide Customers often left to deal with a lot of ambiguity during this phase Stop exfiltration 20% of the investment is focused on What happens after intrusion Organizations lack visibility and control inside

24 Unique Properties of Virtualization Alignment Context Automation Isolation 24

25 Unique Properties of Virtualization Alignment Context Automation Isolation Intended State Runtime State 25

26 Unique Properties of Virtualization Alignment Context Automation Isolation 26

27 Unique Properties of Virtualization Alignment Context Automation Isolation 27

28 Software Defined Security PREVENT DETECT Micro-segmentation Application Application Application Detection & Response Network Compute Data Network Security Controls Compute Security Controls Data Security Controls Governance, Risk & Compliance Security Stack Correlation/Analytics 28

29 Endpoint Monitoring

30 Extending Detection and Response PREVENT DETECT Micro-segmentation Application Detection & Response Needle From our current model That focuses on finding malicious activity Complex: Too much noise and complexity Manual: Lack actionable alerts or orchestrated response Exposed: Limited authoritative context. Untrusted monitoring To a new model That first implements app-centric least privilege More secure: Smaller attack surface Better Signal to Noise: Improves detection. Actionability: Leveraging behavior and architecture to assess relevance, urgency and response alternatives 30

31 Shrinking the Unknown What they do Where we can help Auth, User Provisioning, Config/Patch Management, etc. Known Good Least Privilege Across Network, Compute and Data SIEM, Endpoint/Network Detection and Response, Behavioral Analytics, Incident Response, etc. Unknown Incident Response Automation Better context for security analytics and behavioral detection. Firewalls, UTM, Anti-Virus, IPS, Vulnerability Management, etc Known Bad 31

32 How Can Virtualisation Solve this Challenge? Authoritative Intended State Virtualisation has a unique horizontal vantage point across the datacenter It has intimate knowledge of runtime state across endpoints and networks It has explicit understanding of grouping and applications Virtual infrastructure is also highly automated allowing integration into that process to determine intended state Trusted Monitoring Mechanism Virtualisation has an extremely unique capability to evaluate runtime state from a trusted position in the hypervisor This allows delivery of agentless collection of security signals and protect collection mechanisms Other security technologies do not have this advantage Orchestrated Incident Response The virtual infrastructure and security policy can be programmed Detection can be paired with a rich set of security remediation another very difficult thing to do for most security vendors 32

33 Architecture Leveraging the Hypervisor as a Virtual Enclave Application Untrusted Zone (Guest) App Agents OS App Agents OS App Agents OS Context Service Attestation Service Secure Context Store Remediation Broker Trusted Zone (Kernel) Virtual Enclave PARTNER ECOSYSTEM

34 Preventing Data Exposure

35 Extending Prevention to Data PREVENT DETECT Micro-segmentation Application Detection & Response Encryption Protect the confidentiality and integrity of the data flowing across the network between application components WEB APP APP DB DB 35

36 Traditional Encryption Challenge WEB APP APP APP DB DB DB 36

37 Virtual and Distributed Encryption No Application Changes Most customers will use application level encryption when dealing with sensitive data This places a burden on developers to have expertise in encryption controls It also leaves the management of keys and other sensitive material during execution in the hands of the developer Virtualisation solves these challenges by building encryption directly into the infrastructure and requires no application changes Leverages Microsegment Definition Encryption leverages the isolation model context as an abstraction to determine who has access to which pieces of sensitive information As a result, rule provisioning can be a simple drag and drop exercise, with the platform handling the hard work to distribute keys between nodes Integrates with Security Infrastructure Application level encryption also has a nasty downside inline monitoring tools that rely on deep packet inspection no longer can function with the encrypted data With virtualisation, any security tool inserted will always have access to the unencrypted packet for inspection before the data protection layer is put in place 37

38 Summary

39 Key Takeaways Virtualisation Raises All Security Boats Architect-In vs. Urban Sprawl of the Past Major Shifts Are Underway in Security Explore Network Virtualisation 39

40 Accelerate Digital Transformation to Realize What s Possible Business Agility and Innovation Exceptional Mobile Experiences Protection of Brand and Customer Trust Modernize Data Centers Integrate Public Clouds Empower Digital Workspaces Transform Security Take the next step. Visit 40

41 Thank you.