Hardened Security in the Cloud Bob Doud, Sr. Director Marketing March, 2018

Transcription

1 Hardened Security in the Cloud Bob Doud, Sr. Director Marketing March,

2 Cloud Computing is Growing at an Astounding Rate Many compelling reasons for business to move to the cloud Cost, uptime, easy-expansion, geographic diversity $100B Worldwide Public Cloud Services Revenue Forecast $80B $60B So cloud investments are rising IaaS and PaaS growing in double-digit CAGR Large hyperscale cloud companies consuming vast numbers of servers $40B $20B $0B Gartner (October 2017) BPaaS PaaS SaaS IaaS 2

3 But Security Concerns Abound in the Cloud Data Privacy Concerns My sensitive data running on shared servers and storage Protecting data as it transits in and out of the cloud Access Control Enforcement Authenticating programs and users is more difficult when remote How to enforce the right access privileges to data and applications? Data Integrity Protection Assure that data isn t accidentally corrupted during transit or storage Protect against malicious alterations of data 3

4 Many Security Solutions Offered Legacy Solutions (Designed for Enterprise) VPN Solutions for Data-in-Flight Traditional edge protection IDS/IPS, Firewall Software-based Cloud Security Encryption SW Firewall Visibility & Monitoring Behavioral Analytics Data Leakage Prevention (DLP) Tokenization 4

5 Enterprise Solutions Generally Don t Work for Cloud Typically built to separate the inside from the outside Where is the edge of the network? How do you define your secure boundary? Outside Inside When operating in the cloud, you may be co-located with competitors or hackers Even running on the same virtualized server Traditional Enterprise Security 5

6 Software Security is Vulnerable to Internal Attacks Dangerous assumption: I ll just run security software on my server (to protect my server?!) Do you trust: The applications? Dozens of apps running on multiple VMs on the same server The OS / kernel? When security patches are released many times/year The Hardware? Meltdown, Spectre (2018), Remote Execution Exploit (2017) Superior Security Is Achieved in a Physically Separate Subsystem with Streamlined, Stable Security Software 6

7 Distributed Security Security should be deployed where sensitive data is stored and processed Securing data over the network Securing data at rest And if you re building a cloud data center Need to protect the datacenter infrastructure from attacks From outside and from inside The solution: Programmable SmartNICs running a hardened OS and security applications 7

8 SmartNIC Secures the Server Combining hardware-based network offloads with Arm processing power Accelerates multiple networking and security workloads Reduce TCO by offloading main CPU Main CPU is free for compute and applications rather than security / networking functions Next Generation Server NIC 8

9 Why Put Security Processing in The Adapter? Natural place for security boundary Isolated execution separate domain from host Only network traffic passes across PCIe to/from host Offers unique security capabilities Secure boot / trusted firmware Protected & authenticated key management In-line processing is efficient Traffic must flow through network adapter regardless No extra PCIe hops Lower latency datapath 9

10 App Acceleration Delivers Security & Efficiency Security Visibility Efficient Data Transport Storage Application Acceleration Delivers Infrastructure Efficiency 25, 50, 100 Gb/s SmartNIC Security Benefits Security & workload isolation & offload Scalable, distributed security Logically separated security domains Secure boot & firmware update Flexibility L2-L7 policy per session Workload control & visibility Fully programmable and extensible 10

11 Mellanox BlueField SmartNIC Adapter Features ConnectX -5 front-end Flexible Ethernet or InfiniBand I/O Arm multicore CPU array Arm v8 CPUs offloading dataplane functions Security features for crypto protocol offload Standard Linux/C programming environment 2x Ethernet / InfiniBand QSFP/ BlueField 64-bit ARM Cores GBytes DDR4 Card characteristics PCIe gen3/4 x8/16 2-ports 25/40/50/100GbE 16GBytes DDR4 on board HHHL and other configurations SFP28 QSFP/ SFP28 PCIe Switch x8 / x16 Gen3/4 Accelerators 11

12 Flexible Security Acceleration and Offload Capabilities RSS, LRO, LSO, Checksum Overlay VLAN encaps/decaps RDMA over Converged Ethernet (RoCE) NVMe over Fabrics offload Ethernet Offloads Advanced Features OVS offload Lossless compression (LZ4, etc.) Network Monitoring Packet filtering Wire-speed packet capture Security Offloads Stateful L3/L4 Firewall Crypto protocols IPsec, SSL/TLS offload AES-XTS for data-at-rest Security isolation 12

13 Summary Securing the cloud requires a comprehensive, distributed approach SmartNICs offer a secure enclave at the server boundary SmartNICs can pay for themselves Accelerate networking throughput Restore cycles back to the host CPU Mellanox offers the broadest portfolio of software-compatible network adapters 13

14 Smart Networking Solutions from Mellanox Adapters FPGA- Programmable System on a Chip Switches Enabling the Intelligent Data Center 14

15 Thank You 15