Open Security Controller - Security Orchestration for OpenStack

Transcription

1 SESSION ID: CSV-W02 Open Security Controller - Security Orchestration for OpenStack Tarun Viswanathan Platform Solution Architect Intel Manish Dave Platform Architect Intel

2 Notices and Disclaimers Intel technologies features and benefits depend on system configuration and may require enabled hardware, software or service activation. Learn more at intel.com, or from the OEM or retailer. No computer system can be absolutely secure. Tests document performance of components on a particular test, in specific systems. Differences in hardware, software, or configuration will affect actual performance. Consult other sources of information to evaluate performance as you consider your purchase. For more complete information about performance and benchmark results, visit Intel, the Intel logo and others are trademarks of Intel Corporation in the U.S. and/or other countries. *Other names and brands may be claimed as the property of others Intel Corporation.

3 SDI The Application Defines the System The evolution to software-defined infrastructure

4 Enterprise Multi Cloud Security Challenges How can I provide consistent security across a multi cloud data center environment. Open Security Controller addresses this challenge.

5 Open Security Controller Key Design Goals Centralized security policy management for a multi cloud environment.

6 Conceptual Architecture

7 OpenStack * Micro-Segmentation Use Case

8 OSC API Interaction Model Applications, User Intent, and Policies Open Security Controller Manager Plug-ins Security Functions Catalog VNF Agent Plug-ins Business Logic GUI User Interface Service Dispatcher H2 Database API Cloud Apps 1 NB Rest API Jobs Engine User Intent Policy interface User intent Application intent SDN Plug-ins Policies Virtualization Connectors Lifecycle management Deployment specs, autoscaling and HA Authentication Image services Notification for events Role based access control 4 Rest API 5 Rest API IPC Web Sockets Security Function/Element Managers Dynamic policy updates Control path agent: IPS NGFW ADC and mapping provisioning, deprovisioning, Managers Managers Managers Domain/sub domain updates and mapping heartbeats, etc. Virtualized Security Functions Data path agent: instrumentation CPA and real time DPAstatistics SDN Controllers Virtual Infra OpenStack* 3 Rest API 2 Rest API SFC Policy Traffic redirection API NSX * Virtual Compute SFC policy API OpenDaylight * Midokura *, Plumgrid *, Advanced visibility Nuage functionality NSP *, Brocade * (example 6 tuple visibility) Virtual Storage Virtualization Layer Virtual Network Images, deployment, notifications, authentication Physical Infrastructure Computing Hardware Storage Layer Network Hardware

9 Customer PoC: Health industry IT services provider Virtual App Delivery Controller Next Gen Firewall Customer has to adhere to HIPAA regulatory requirements Existing solution was based on DC edge devices. Customer wanted to get to a dynamic policy based security solution for East-West traffic inspection. Virtual Intrusion Prevention System Open Security Controller Commercial SDN controller (Control Node) Commercial OpenStack Newton Distro (Compute Node) RHEL 7.2 Commercial x86 Server

10 Customer Deployment Architecture Current: Topology Based Security Firewall Future: Dynamic Policy Based East-West Security Security Function Manager Physical Appliances Intrusion Prevention Systems/ Intrusion Detection Systems SDN Controller Security Controller Application Delivery Controller East-west Traffic Top of Rack Switch East-west Traffic Top of Rack Switch High Latency X86 Server Security between Tenants and Tiers Latency Goes Down X86 server Granular Control and Scalability App App App App vips vadc App

11 Customer PoC: Large financial services provider Next Gen Firewall vendor 2 Customer has to adhere to PCI regulatory requirements Customer wanted to get to a Risk Based automated security policy management capability for their Openstack environment Next Gen Firewall Vendor 1 Open Security Controller Commercial SDN controller (Control Node) Commercial OpenStack Distro (Compute Node) RHEL 7.2 Commercial x86 Server

12 Customer deployment Workflow Security Admin Dev-Ops One Time Setup 1. Openstack Connector 2. Create Security Services a) Policy manager Plugins for NGFW 1, NGFW 2 3. Configure Security Services a) Distributed Appliance b) Deployment- Specifications Protection Policy 1. Define Global Risk based Sec-Groups 2. All Policy managers dynamically updated 3. Automated traffic redirection via SDN Plugin Spins workload up or down Automated Zero- Trust Security Network flows automatically updated to redirect traffic to security service chain

13 DEMO Automated Security Services Orchestration for Openstack

14 Demo Topology

15

16 Apply: Risk Based Approach 1. Identify workload which needs micro segmentation 2. Identify security controls to mitigate risks (vips, vngfw, vadc) 3. Automate Security Controls orchestration

17 Call to Action Current Status POC with early adopter customers / Security VNF s Open Security Controller available as Opensource ~ Mid 2017 compatible with few Security VNF and SDN vendors Call to Action Contact us to get engaged in the community: manish.dave@intel.com or Tarun@intel.com Additional Information: