Securing Your Virtual Data Centers:

Transcription

1 Securing Your Virtual Data Centers: The Future of Endpoint and Server Security Chip Epps, Symantec, PM Virtualization Security Papi Menon, VMware, PM vshield Endpoint 1

2 Agenda 1 The Virtual Data Center 2 VMware Update 3 Our Vision and Strategy 4 SEP and SCSP 5 Resources SYMANTEC VISION

3 Do Any Of These Statements Sound Familiar?! I m a security professional and I think I know I need to do something, but I don t know WHY.?! I m a security professional and I need to do something differently? Really? I m a security professional and I think I know I need to do something, but I don t know WHAT.? I m a virtualization technology implementer and I m making the security decisions since my security team isn t. SYMANTEC VISION

4 Why Virtualize Promises of Cloud Computing Traditional IT Clouds Leaders Servers per Admin 50 5,000 Time to Provision Server Server Utilization 5 days 15 mins 20% 75% SYMANTEC VISION

5 The CISO s Guide To Virtualization Security January % 75% Planning to adopt x86 virtualization Of x86 Serverswill be virtual by 2014 SYMANTEC VISION

6 Servers Are Different from Desktops Servers Hacking Desktops/Laptops Malware vs. 81% of Breaches 69% of Breaches 99% of Records 95% of Records Server Protection is Different from Endpoint Protection SYMANTEC VISION

7 Servers are the Primary Target % of stolen data is from Servers. More often endpoints / user devices simply provide an initial foothold into the organization, from which the intruder stages the rest of their attack. SYMANTEC VISION 2012

8 Defining the Virtual Data Center New Protection Required Management Framework Resource Pool App OS App OS VMDK Data Store ESXi Hosts/Hypervisor SYMANTEC VISION

9 And its Logical Characteristics Highly Dynamic and Zoned vapp VDC vapp vapp vapp Web App DB Template SYMANTEC VISION

10 Defining the Virtual < > Security Landscape x86 Server Virtualization Infrastructure Endpoint Protection Platforms Symantec Data Center Endpoint Security SYMANTEC VISION

11 The VMware Cloud Infrastructure Suite Cloud Infrastructure Suite New New New New New vcloud Director 1.5 vshield Security 5.0 vcenter Operations 1.0 vcenter SRM 5.0 vsphere 5.0 Policy, Reporting, Self-Service Virtualized Security & Edge Functions Monitoring & Management Business Continuity High Performance Resource Control, Pooling & Scheduling 11

12 Overview of vshield and vcenter Configuration Manager vshield Edge vshield App with Data Security vshield Endpoint vcenter Configuration Manager Segment and isolate at org level Firewall (IP), VPN, Web load balancer, NAT, DHCP, static routing Segment and isolate based on security, compliance Firewall (vnic), security groups, sensitive data discovery Partner enablement platform for endpoint security AV, File Integrity Monitoring, and more IT compliance management across the stack Controls validation, compliance reporting, change management, patching, and more 12

13 Framework for Orchestrating and Managing VMware and Third Party Networking and Security Services VMware Services Partner Services VMware Data Security VMware.. Security partners Networking partners VMware vshield Manager(VSM) Open Partners Interfaces 13

14 We ve come a long way, but even more exciting times ahead! 2013 and beyond 2011 New 3 rd party endpoint service insertion for solution choice New Data Security discovery of sensitive data New Security Automation using APIs and scripts Scalable and agile networking and security products 2012!! New 3 rd Party network service insertion for more solution choice Shipping products from endpoint security vendors Improved Usability and High Availability Improved automation with data security triggers, vcenter Orchestrator plugin 14

15 Virtual Vulnerabilities Still Exist SYMANTEC VISION

16 Symantec Protection for the Virtual Data Center Management SCSP: Critical System Protection GuestVM SEP: Symantec Endpoint Protection SCSP: Critical System Protection Data Store Protection Engine Hypervisor SCSP: Critical System Protection SYMANTEC VISION

17 A Perspective Today Service-Oriented, Hybrid Security Model VM Breadth of Se ecurity Expanded Maximum Security Guest Security Maximum Host Security SYMANTEC VISION

18 A Perspective Tomorrow Service-Oriented, Hybrid Security Model VM Service Levels Breadth of Se ecurity Ris sk Expanded Security SVA Baseline Security Gold Silver Bronze Hardened Virtual Infrastructure SYMANTEC VISION

19 Security Effectiveness Dynamic, Transparent, Beyond-Physical Security On a Hardened Infrastructure across Managed/Unmanaged VMs Today Agented VMs (Managed) Hardened Virtual Infra. Medium Term Agented VMs (Managed) Agent-less Protection (All VMs) Hardened Virtual Infra. Agented Value-Ad dd Agentless Baseline Long Term Agented (Managed) Agent-less Protection (All VMs) Hardened Virtual Infra. Agent (SCSP + SEP) Agentless Hardened Infrastructure hardened by SYMC Baseline Security Rogue VM Protected Agentlessly by SYMC Full Security VM fully protected with SYMC Agents SYMANTEC VISION

20 What is Agent-less? Introspection & vnetwork Analysis SYMANTEC VISION

21 Is Symantec going to Support vshield and When Yes, SEP Jaguar and Beyond! SYMANTEC VISION

22 Question: How Best to Apply Traditional Security? Firewall Content Filtering NIPS Reputation AV HIPS ETC SYMANTEC VISION

23 SEP 12.1 vs. Trend Micro Deep Security 8.0 May % 90% 100% 64% % of samp ples 80% 70% 60% 50% 40% 30% Maximum 20% Compromised Neutralized Defended 20% 10% Baseline 16% 0% Symantec Endpoint Protection 12.1 Trend Deep Security 8 (Agentless) SYMANTEC VISION

24 Roadmap Progress Phase 1 Re-architect Security for Changing Threat Environment Done Insight and SONAR Phase 2 Phase 3 Phase 4 OptimizeFeatures for Virtualized Environment MaximizeIntegration with Platforms, and Introspection-Zoning Infrastructure Maximize Architecture for Cloud Service Delivery Done Shared Insight Cache & vcenter Hardening 2012 In progress vshield& vsphere integration Currently in development SYMANTEC VISION

25 New Approaches: Insight Enhanced Scanning On a typical system, 80% of active applications can be skipped! Traditional Scanning - Requires scan of everyfile - Scans on defined schedule Insight Scanning - Requires scan of un-trusted files only - Scans based on useractivity SYMANTEC VISION

26 SEP 12.1 Built for Virtual Environments Scan Elimination Scan De-duplication Scan Randomization Virtual Image Virtual Resource Insight and Offline Image Exception Client Leveling Shared Insight Scanning Tagging Cache Together up to 90% reduction in disk IO SYMANTEC VISION

27 SEP 12 vs. Trend Micro Deep Security 8 -Virtual Machine Performance April % reduction in I/0 60% reduction in scan time SYMANTEC VISION

28 RU2: Shared Insight Cache for Virtual Environments vshieldendpoint enabled scan cache to optimize performance for scanning Moves the SEP 12.1 Shared Insight Cache into a Security Virtual Appliance Uses vshieldendpoint as the communication channel between SEP and the cache Same performance benefit as SEP 12.1 cache Significant resource reduction for persistent VDI Limited impact for non-persistent VDI and server applications SYMANTEC VISION

29 Ferrari: Shared Content for Virtual Environments Goal: reduce IO and CPU from definition update process by 90+% at the host level vshield Endpoint enabled Shared Antivirus Definitions Removes the need to update definitions in each Guest VM One update process per ESXiHost on the vshieldenabled SVA Updated definitions available to guests immediately on start up with no update overhead Significantly improves performance in all environments, servers, non-persistent VDI and persistent VDI Solves key management issues with non-persistent VDI deployments SYMANTEC VISION

30 Shared Content (Definitions and Insight Cache) LiveUpdate Network Network Based Defs Cache SEP Client SEP Client SEP Client Share Insight Cache SVA VMware vshield Endpoint / VMTools GVM GVM GVM ESXi Host SYMANTEC VISION

31 Virtual Infrastructure Still Requires Attention SYMANTEC VISION

32 SCSP MP3: Securing vsphere 5.0 Infrastructure vcenter Server SQL DB WMWare Management Framework VMWare vcenter Server 5.0 (64 bit Windows) vcenter Server VMkernel Infrastructure Agents (NTP, Syslog, etc.) LDAP 64-bit Windows OS manage VMware ESXi VM support and Resource Management CSP Agent OS Tomcat Web Service vcli vcli for Config and Support Agentless Systems Mgmt Agentless Hardware Monitoring Protecting the Virtualization Management Universe Automate implementation of VMware Hardening Guidelines vcenter IPS Policy : Enhanced Windows Strict policy to protect application components including: vcenter Server, vcenter Orchestrator, vcenter Update Mgr. Infrastructure components e.g., SQL Express DB, Tomcat, JRE vcenter application program files and sensitive directories (certificates and logs) Restricts vcenter network port access to trusted programs Can protect the following tools accessing vcenter from desktops, laptops, client access VM s or even Jump hosts: vsphere Client, vsphere CLI, vsphere Power CLI, vsphere Web Client vcenter IDS Policy Highlights: vcenter Windows Detection Policy Pre-tuned Windows Baseline Policy detects user/group changes, login failures, etc. vcenter Application Detection Policy Pre-tuned Windows Policy performs real-time FIM of vcenter binaries / configurations and monitors vcenter logs Addresses gap in existing vcenter monitoring and log forwarding capabilities SYMANTEC VISION

33 Virtual Security Top-to-Bottom Hypervisor SVA SVA 1 Hardened Infrastructure Hardening infrastructure(hypervisor kernel-level file monitoring, management hardening) Server Management capabilities for patch, change management, discovery, inventory etc. Hypervisor vserver Farm Cloud VDI Security Host/VM Management Infrastructure Agent (SCSP + SEP) Hardened Agentless 2 3 Infrastructure hardened by SYMC Baseline Security for All VMs (agent-less for unmanaged VMs) through SVA Enhanced Agent-less via Security Virtual Appliance enabling IPS, Deep Packet Inspection, File Integrity Monitoring, AV, etc. Zoningthrough workflow integration to drive actions based on security posture Full Security for Managed VMs (agented) through SCSP and SEP In-guest agent thinningsupporting introspection and differentiated security (Shared AV Definitions, reduced memory etc.) Baseline Security Rogue VM Protected Agentlessly by SYMC Full Security VM fully protected with SYMC Agents SYMANTEC VISION

34 Other Sessions to Attend SEP WE, 1:00-2:00, SR B20, Michael Marfise, Scott Sawoya, Symantec Endpoint Protection 12: Hundreds of Millions of New Pieces of Malware Mean You Have to Do Things Differently WE; 4:45-5:45, SR B27, Kevin Haley, Archana Rajan, SONAR, Insight, Skeptic and GIN - The Symantec Secret Sauce LABS TH, 9:00-10:00, SR L06, Elisha Riedlinger, Migrating to Symantec Endpoint Protection 12.1 TH, 10:15-11:15 & 1:00-2:00, SR L08, Paul Murgatroyd, Troubleshooting Symantec Endpoint Protection 12.1 TH, 11:30-12:30, SR L07, Scott Sawoya, Configuring Protection Technologies with Symantec Endpoint Protection 12.1 SCSP: TH, 1:00-2:00, SR B22, Percy Wadia, Prashant Khandelwal, Stop Server Incursions and Unauthorized Access: How to Defend Against Common APT Attacks LABS WE, 3:30-04:30, SR L21, Colin Gibbens, Protect Servers and Defend Against APTs with Symantec Critical System Protection TH, 9:00-10:00, SR L22, Colin Gibbens, Lock Down a Virtual Environment with Symantec Critical System Protection Protection Engine TH, 1:00-2:00, SR B11, Ian McShane, Symantec Protection Engine: for Cloud Services and Storage SYMANTEC VISION

35 Additional Resources Symantec Virtualization Security site on symantec.com Securing the Virtual Data Center white paper VMware and Symantec Joint Press Release - Solution overviews Coming Soon: VDI Best Practices White Paper Joint VMware Reference Architecture SYMANTEC VISION

36 Thank you! Chip Epps Papi Menon Copyright 2012 Symantec Corporation. All rights reserved.symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. 36