Security Solution Architecture for VDI

Transcription

1 A reference implementation of VMware BENEFITS Desktop : An Architectural Approach Threats and Vulnerabilities 7 Figure : Connection Sequence REFERENCE GUIDE /

2 Vulnerabilities and Threats in the Connection Sequence End User Authentication Figure : End User Authentication Untrusted to Trusted Connection Figure : Untrusted to Trusted Connection REFERENCE GUIDE /

3 Provisioning Desktop Uninformed Figure : Provisioning Desktop Figure : Uninformed User Data Figure : User Data REFERENCE GUIDE /

4 Desktop Configuration Cluster Splunk vshield (App / Firewall / Edge /7 ( Network) dvs Prod Cluster.0 Figure 7: Desktop Configuration Rapid 7 Verdasys Digital Guardian vcm vshield Manager Doctors VDI Pool Nurses VDI Pool Practices and Considerations ESX Host () Microsoft Catbird / ( Desktop LAN) vcenter Corp VDI Pool Kiosk VDI Pool ESX Host () Figure 9: Solution Lab Setup for Simplified VDI Architecture Firewall IDS/IDP and Flow Monitor Vulnerability Layer Access Control Virtual Infrastructure Monitoring Auditing Orchestration and Validation for Real-Time Compliance Measurement and Reporting Corp VDI Pool Trust Zone Figure 8: Real-Time Compliance Metrics and Reporting with Multi-Functional Policy Enforcement REFERENCE GUIDE /

5 Trust Zone Trust Zone Doctors Compliance Monitoring Dashboard ISV Trust Zones Membership Automation and Real-Time Compliance Firewall Corp Trust Zone Firewall internet vshield App Firewall Enforces Network Access Controls vshield Edge Provided Connectivity with Corporate HOME Network Integrated Splunk Dashboard Corporate Home Network Figure 0: Using vshield App and Edge to Define the Geo and Network Boundaries Figure : Integrated Dashboard REFERENCE GUIDE /

6 Figure : Event Manager Default Log Compliance Template (HIPAA, SOX, FISMA, PCI, DIACAP, and COBIT) REFERENCE GUIDE /

7 DIACAP Analysis: Virtual Infrastructure Access for Need-to-Know ECAN Access for Computing Facilities EECF Best Practices DCBP Compliance Testing DCCT HW Baseline DCHW Remote Access for User Functions EBRU Remote Access for Privileged Functions ECMP 0 Interconnection Documentation DCD Partitioning the Application DCM Boundary Defense EBBD Port, Protocols, and Services DCPP Conformance Monitoring and Testing ECMT CM Process DCPM Least Privilege ECLP Audit Trail, Monitoring, Analysis and Reporting ECAT Software Development Change Control ECSD Audit Record Content EXAM SW Baseline DCSW Changes to Data ECCD Support Structure Partitioning DCSP Vulnerability VMW Incident Response Planning VMW Audit Trail Backup ECTB Audit Reduction and Report Generation ECRG Interconnections among DoD Systems and Enduser EOC Network Device Controls ECNO Existing VI Impact VirtSec Figure : Technical Controls Used for DIACAP in a Virtual Infrastructure by Catbird Figure : VDI-DIACAP-Catbird Compliance Dashboard REFERENCE GUIDE / 7

8 VDI RA vswitch, Portgroup, Infrastructure, VDI Pool Architecture BASE vswitch0 - VMWare Mgmt vswitch0 - Operation vswitch - COI-MED-Apps vswitch - COI-FAC-Apps vswitch - COI-MED-vPOOL vswitch - COI-FAC-vPOOL VMWare Kernel Operations VCS VSS AD Catbird v vcm Rapid 7 Verdasys vshield Mgr Splunk COI-Medical-Applications MED-App(IIS) Nimsoft COI-Facilities-Applications FAC-App(IIS) MED-App(IIS) COI-Medical-Practitioners VDI Pool - Persistant COI-Facilities-Operations VDI Pool - Stateless Figure : Community of Interest Zone Design for Desktops and Applications Summary Authors the Architecture for VDI: VMware and Partner Products PARTNER PRODUCTS USE CASES IN SECURITY DASHBOARD VMware, Inc. 0 Hillview Avenue Palo Alto CA 90 USA Tel Fax Copyright 0 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies. Item No: VMW-Q-RG-SECSOLARCHVDI-USLET-WEB