Symantec and VMWare why 1+1 makes 3

Transcription

1 Symantec and VMWare why 1+1 makes 3 Finn Henningsen Principal Systems Engineer Peter Schjøtt Principal Systems Engineer Rasmus Rask Eilersen Principal Systems Engineer Symantec and VMWare 1

2 Tak til vores sponsorer Symantec and VMWare 2

3 VIRTUALIZATION GROWTH 1 new VM every 6 seconds 95% of Enterprises using Virtualization technology 80% of x86 servers virtualized by % of server workloads will be virtualized by 2014 Symantec and VMWare 3

4 The current X86 virtualization market footprint Other 8.5% 7% 8% 7% 69.3% * Source: Nexenta virtualization survey June 2012 Symantec and VMWare 4

5 Secure Recoverable Available Symantec and VMWare 5

6 1 2 3 Secure Available Recoverable Symantec and VMWare 6

7 1 Secure Symantec and VMWare 7

8 Security, Compliance, Resilience => Predictability Anti-malware Cyber Security in a virtualized environment Anti-malware HIDS/HIPS for critical servers Protect Hypervisor Securing VMware Configs & Components Locking down vcenter & vsphere components Compliance & Monitoring Compliance and Monitoring for a Virtual environment Vulnerability Management Incident and Event Management (SIEM) Symantec and VMWare 8

9 Protection approaches Endpoint Protection (AV) Using Endpoint Protection package AV alone Firewall, HIPS, SONAR, Insight, Browser Protection, Device Control?? Disadvantages May not provide adequate protection => data & server compromise Critical System Protection Define what OS and applications are allowed to do => Locks down based on policy Can monitor based on policies No signatures Virtual patching Detection + Prevention Disadvantages Creation/maintenance of policy important Less good for changing environments Symantec and VMWare 9

10 Holistic Threat Protection - no matter how the threat surfaces Symantec and VMWare 10

11 SEP and virtual features Symantec and VMWare 11

12 Virtualization Features VMware 5 features to optimize for performance 1 Virtual Client Tagging 2 Virtual Image Exception Scan Cache 3 Offline Image Scanner Hypervisor 4 Shared Insight Cache 5 Resource Leveling Symantec and VMWare 12

13 Shared Insight Cache - High Level Shared Insight Cache Server (nsic) File Hash Def Ver Result AE32D Clean B923E Clean F Clean C3FDA Clean First SEP client needs to scan a file. Queries SIC and finds no record. SEP scans the file and sends the results to the SIC. Subsequent SEP clients need to scan the same file. They query the cache server and find the file has already been scanned with the same version of defs and the file is clean. SEP client skips scanning the file. VM VM VM VM VM VM VM VM VM VM VM VM ESX Server 13 Symantec and VMWare 13

14 vshield Endpoint Components vshield Endpoint plugs directly into vcenter and consists of three components: Hardened security virtual appliances, delivered by VMware partners Thin agent for virtual machines to offload security events (included in VMware Tools) VMware Endpoint ESX hypervisor module to enable communication between the thin agent and the security virtual appliance at the hyper-visor layer vshield Symantec and VMWare 14

15 Critical System Protection Symantec and VMWare 15

16 Virtualization Introduces New Areas of Risk Minimal admin access controls to management components Offline VM s miss security updates Lack of inter-vm communication visibility Compromised vcenter can compromise VM s and hypervisors Underlying infrastructure is at risk of being compromised No physical barrier between servers increases risk of data loss Symantec and VMWare 16

17 Critical System Protection Protects New Areas of Risk Minimal admin access controls to management components Offline VM s miss security updates Lack of inter-vm communication visibility Compromised vcenter can compromise VM s and hypervisors Underlying infrastructure is at risk of being compromised No physical barrier between servers increases risk of data loss Symantec and VMWare 17

18 VMware Hardening Guidelines VSH01 Maintain supported operating system, database, and hardware for vcenter VSH02 Keep VMware center system properly patched VSH03 Provide Windows system protection on VMware vcenter server host VSH04 Avoid user login to VMware vcenter server system VSH06 Restrict usage of vsphere administrator privilege VSH10 Clean up log files after failed installations of VMware vcenter server VSC03 Restrict access to SSL certificates VSC05 Restrict network access to VMware vcenter server system VSC06 Block access to ports not being used by VMware vcenter VUM03 Provide Windows system protection on Update Manager system VUM04 Avoid user login to Update Manager system HMT03 Establish and maintain ESXi configuration file integrity HMT15 the messages kernel log file should be monitored for specific errors Symantec and VMWare 18

19 CSP Policy Focus Lock-Down and Prevention Tamper Protection (no unauthorized modification) SSL Certificate Protection (no unauthorized access) Network Firewall Reduce Attack Surface for vsphere Apps and guest System Hardening Symantec and VMWare 19

20 Policy Focus Detection & Monitoring Windows OS RT-FIM, Registry, Audit, Event and Log Monitoring vsphere Real-Time File Integrity Monitoring VMware unique hardening Requirements E.g. VSC02 & VSH05 vsphere General Log Monitoring ESXi FIM, host configuration files, key configuration files ESXi General Log Monitoring Symantec and VMWare 20

21 SCSP Protection for Virtual Environments vcloud Director DB vcenter Server DB VMWare vcloud Director Server 1.5 (RHEL 5 64bit U4/5/6) VMWare vcenter Server 5.0 (64 bit Windows or SLES 11-based virtual appliance) manage VMWare vshield Manager (Linux virtual appliance) VMware View Manager 5.0 Virtualization Management Universe Protection CSP agent deployed on vcenter Server with custom policies (conforming to vsphere hardening guidelines), to protect and monitor specific components Virtual Infrastructure Protection CSP Agent deployed within a specific guest VM (1 per ESXi server) to monitor ESXi VM VM VM VM VM CSP VM Agent VM VM VM Virtual Guest Server Protection ESXi 5.0 vsphere 5.0 ESXi 5.0 vcli ESX 3.5/4.1 vsphere 3.5/ 4.1 CSP can be installed in each guest virtual machine (virtual server) to lock down the OS / application, specific to each virtual server s use-case Virtual Infrastructure Protection Protect the Guests VMs (OS hardening/ application lockdown for each guest) Protect the host servers (monitor hypervisor config and access logs) Protect the Management Universe (lockdown vcenter Server and associated mgmt agents) CSP is deployed in the ESX Service Console (RHEL) with monitoring and hardening policies enabled Symantec and VMWare 21

22 Demo Symantec and VMWare 22

23 2 Available Symantec and VMWare 23

24 Application availability one vserver Symantec ApplicationHA protect application components App Components Application Resources VM1 VM2 VMx SQL Oracle SQL Ora Vol IP Vol Vol IP Application Awareness API OS OS OS OS VMware HA protect infrastructure components VM ESX Server Site VMware ESX Symantec and VMWare 24

25 Demo Symantec and VMWare 25

26 Application failover x vservers Symantec Veritas Cluster Server and Storage Foundation protect application and storage App Components Application Resources VM1 SQL Vol IP Hot Disk API VM2 Oracle Vol VMx SQL Ora Vol IP OS OS OS OS VMware protect infrastructure components VM ESX Server VMware ESX Site Symantec and VMWare 26

27 Demo Symantec and VMWare 27

28 3 Recoverable Symantec and VMWare 28

29 VIP Designed for Two Major Tasks 1) Automatically add and backup new and moved VM s 2) Automatically balance backups across entire vsphere environment (Fibre or network) VMs protected based on physical location ESX server ESX Datastore VMs protected based on logical attributes vcenter folder Resource pool Backup performance is maximized with VIP by using physical location of VM to define backup Symantec and VMWare 29

30 vcenter Integration NetBackup reporting and VM restores made available to the VM administrator via a vsphere plug-in Integrated using standard vsphere Client Event Logging Symantec and VMWare 30

31 Demo Symantec and VMWare 31

32 Application Protection & Recovery In VMs Easy checkbox setup Automatic application discovery via VM intelligent policy Application-consistent VM backup Optional database transaction log truncation Any-level Recovery: VM, Files, Databases, Items Recovery Exchange SharePoint SQL Server Media VM Any File Any Database Not Tape Item n/a Not Tape Symantec and VMWare 32

33 VMware Instant Recovery in NBU 7.6 Instantly power on any protected VM from disk backup target No need to restore VM first Uses standard NetBackup backup images No need to change any backup process Support with all Symantec disk based solutions Basic disk, Advanced disk, PDDO, MSDP, NetBackup appliance Once powered on, VM is 100% available After power-on, VM disks transferred to ESXi storage (Storage VMotion) Storage VMotion ensures no disruption of service ESX/ESXi SAN NAS NetBackup NFS Datastore Symantec and VMWare 33

34 Demo Symantec and VMWare 34

35 NetBackup, with V-Ray Technology, Provides Market Leading Backup and Recovery Fortune % Leading Telecom 10 of 10 Symantec is #1 in VMware Backup Leading Financial Services 10 of 10 Leading Healthcare 10 of 10 V-Ray 4 Best of VMworld Awards in 5 Years Gartner Magic Quadrant and Backup and Recovery Market Share Leader Innovating with 75 patents & over 2,000 years of engineering experience V-Ray gives NetBackup a competitive advantage today and into the future - IDC *Won more Best of VMworld awards than any other vendor * Business Continuity and Disaster Recovery category CA, 2.7% Quest, 3.6% HP, 5.3% #1 in Backup & Recovery Market Share CommVault, 6.4% Others, 13.5% EMC, 17.0% Symantec, 34.1% IBM, 17.3% Enterprise Distributed System Backup/Recovery Revenue Market Share, 2011 Symantec and VMWare 35

36 Secure Recoverable Available Symantec and VMWare 36

37 Thank you! Copyright 2011 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Symantec and VMWare 37