Current Issues

Size: px

Start display at page:

Download "Current Issues"

Chad Curtis
6 years ago
Views:

1 SER1848BE vsphere Platform Security Update Mike Foley Technical Market Architect vsphere Security Abhijat Singh Product Manager vsphere Security #VMworld #SER1848BE

2 Current Issues

3 Current Issues: SMB v1 on vsphere VMware vsphere components not implemented/affected vsphere components are client only They don t have the ability to run as a server (Server components not compiled/shipped) SMBv1 issues are Windows specific. VMware components not implemented/affected SMBv2 enablement is needed to support SMBv1 disablement on Windows infrastructure SMBv2 currently not enabled by default in 5.5 & 6.0 SMBv2 enabled in 6.5 on VC & 6.5 Update 1 on ESXi SMBv1 disablement on vsphere is not the issue. SMBv2 *enablement* is the issue Order: Ensure vcenter/esxi have SMBv2 enabled Patch your Windows systems to address the vulnerabilities based on Eternal Blue Disable SMBv1 on your Windows systems Remember: SMB negotiation protocols are configured at the server side, not the client (vsphere) side #SETR1848BE CONFIDENTIAL 3

4 Current Issues: TLS 1.0/1.1 Disablement Current state of TLS disablement Minimum version of vsphere where TLS is fixed to Update 3 Some ports on VCSA may not be configurable (syslog) Windows VC ODBC and Oracle are not TLS 1.2 configurable (not VMware) 6.5 or greater All ports on VCSA are TLS 1.2 configurable Hardware compatibility changes moving to 6.5 may affect your 1.2 rollout Older hardware may no longer be on the 6.5 HCL TLS Reconfiguration Tool vsphere tool for everything except CIM See KB for more info At scale CIM fix handled via Powershell script Older VMware and 3 rd party s/w that connects to your vcenter may hold you back from TLS 1.0/1.1 disablement e.g. Backup/Recovery solutions #SETR1848BE CONFIDENTIAL 4

5 vsphere 6.0 Update 3 Support for TLS 1.0, 1.1 & 1.2 out of the box TLS 1.0 disablement supported as of GA release KB articles: Managing TLS protocol configuration for vsphere 6.0 Update 3 ( ) Link to download TLS configuration script for vsphere 6.0 Update 3 Status of TLSv1.1/1.2 Enablement and TLSv1.0 Disablement across VMware products ( ) #SETR1848BE CONFIDENTIAL 5

6 vsphere 6.5 Support for TLS 1.0, 1.1 & 1.2 out of the box TLS 1.0 disablement supported as of GA release KB articles: Managing TLS protocol configuration for vsphere 6.5 ( ) Link to download TLS configuration script for vsphere Status of TLSv1.1/1.2 Enablement and TLSv1.0 Disablement across VMware products ( ) #SETR1848BE CONFIDENTIAL 6

7 Enabling TLS 1.2 on ESXi CIM Server Not currently changeable via TLS Reconfigurator A PowerShell script is available to automate this - Search for Automating Disabled Protocols #SETR1848BE CONFIDENTIAL 7

8 Key Management for vsphere Encryption Solutions 8

9 Key Managers VM and vsan Encryption leverage KMIP 1.1 compliant key managers Customers requested certified solutions Addressed by the Key Manager Certification Program Certified Today Certification Program ramping up Additional vendors are going through certification KMS vendor customer demand drives certification program participation VMware Compatibility Guide - Key Management Server Certification 9

10 Key Management The next infrastructure requirement Encryption is becoming pervasive Regulatory requirements for encryption are growing Key Manager availability is a business critical requirement Not unlike DNS or NTP! Plan like your life depends on it Do you have just one DNS server? No! What if it goes down? THAT is how you should plan key management! #SETR1848BE CONFIDENTIAL 10

11 Key Manager Topology KMS Cluster/Alias KMScluster KMS A KMS B KMS C vsphere Datastore #SETR1848BE CONFIDENTIAL 11

12 Multi-Site Key Manager Topology Site A KMS Cluster/Alias KMScluster KMS A KMS B KMS CD KMS E KMS F vsphere VMworld 2017 Content: Not for vsphere Site B publication Datastore Datastore #SETR1848BE CONFIDENTIAL 12

13 Multi-Site Key Manager Topology Order is important Site A KMS Cluster/Alias KMScluster Site B KMS-A KMS-B KMS-C KMS-D KMS-E KMS-F vsphere Datastore SITE A KMS Order KMS-A KMS-B KMS-C KMS-D KMS-E KMS-F SITE B KMS Order KMS-D KMS-E KMS-F KMS-A KMS-B KMS-C vsphere Datastore #SETR1848BE CONFIDENTIAL 13

14 Encryption Overview VM and vsan Encryption Overview

15 VM Encryption Manageability Encryption managed via Storage Policies Scalable & Easy to Manage Encryption No modification within the Guest. VM Agnostic Guest OS VM Hardware version Datastore Independent NFS, iscsi, VMFS, vsan Encrypts both VMDK and VM files No access to encryption keys by the Guest Full support of Encrypted vmotion Encrypted VM = vmotion is ALWAYS encrypted Not Deduplication/Compression friendly #SETR1848BE CONFIDENTIAL 15

VM Encryption How it works HA Cluster VM Encryption Module VM Encryption Module VM Encryption Module ESXi ESXi ESXi DEK: XTS-AES-256 KEK: AES-256 VM Encryption Module IOIO IOIO IOIO ESXi *&* %*^ $&*(

16 VM Encryption How it works HA Cluster VM Encryption Module VM Encryption Module VM Encryption Module ESXi ESXi ESXi DEK: XTS-AES-256 KEK: AES-256 VM Encryption Module IOIO IOIO IOIO ESXi *&* %*^ $&*( vcenter 3 rd Party KMIP-Compliant KMS Previously encrypted VM - Data Encryption Key (DEK) is created by host. DEK encrypted with Key Encryption Key (KEK) from the KMS Encrypted VM is powered on vcenter requests KEK from Key Management Server Key Manager returns the KEK to vcenter which passes it to all hosts in an HA cluster (KEK is not persisted in vcenter!) KMIP-provided KEK used to decrypt DEK Hypervisor level Encryption and Decryption begins without Guest OS modification or knowledge! #SETR1848BE CONFIDENTIAL 16

17 VM Encryption ESXi Key Cache and HA behavior HA Cluster Key Cache Key Cache Key Cache #SETR1848BE CONFIDENTIAL 17

18 Data Encryption Key (DEK).vs. Key Encryption Key (KEK) KMS Cluster Alias and KEK key ID are stored with the VM scsi0:0.present = "TRUE" scsi0:0.redo = "" tools.synctime = "FALSE" extendedconfigfile = "Centos 7.vmxf" migrate.encryptionmode = "disabled" encryption.keysafe = "vmware:key/list/(pair/(fqid/<vmware- NULL>/KMS01/5,HMAC%2dSHA%2d256,MhtSNrQA8FC9DehrUiiw2SPjamJpfk5x5FNbYcvRgKpJFaWw7iHDeaxFBHLXAU8OQdVoSLJW%2f wosellr7ktx9etzlb63rssetceu%2banx4e2ighbybkjilnlwugabzmjjhqnl%2bl6jxl2fu5e8bm2dq%2boiezyn9rcqceoy8svdorg%3 d))" encryption.data = "k3oonxfhkgeg4vrsk+aeamuxpaobvbi4wwdr26vjkyb6+tjioizcbf7klpou3hcufopzmhsc7cguxwyoqcm2+fbhsu/huh1qkhomyrdwg nb05vll9n2e4/8pzhynwmmrwtv51exfuch6z9n0ivt0wcyvvxsfm/eohf2/l8+ef32/psnn8mmlt99652aespqn0mqduumwhj/fch8wvz9 /BFHbsXQoK1EHKt1gH5zmA/UDXhlYXC+E9TV4xgfI/ID8u48M7e5SuTdJumWPNcaO+1Y7LTuOzFc+iNJ5Y8yksLR8bLXYb3Bca19EZYcbz Dj6nEw0rQ8uyo4v7zd1WANBKEfvqm+F1qAE7bNl5p/MR8c=" VMworld 2017 Content: Not for publication DEK is stored with the VM and encrypted with the KEK #SETR1848BE CONFIDENTIAL 18

19 UI Encrypt / Decrypt demo UI Enable-Disable Encryption video 19

VM Encryption & vsan Comparison Encryption

Point: One Key Per vsan Cluster distribution

Encryption Datastore Support: Any vsphere

20 VM Encryption & vsan Comparison Encryption Point: One Key Per VM Key Manager Support: Multiple via API vsphere SAN Encrypted vc/psc: Not Supported NAS Shared Storage Storage vsan vsphere Encrypted vc/psc: Supported vsan Datastore vsan or Encryption Point: One Key Per vsan Cluster distribution Key Manger Support: One per vsan Cluster VM Encryption Datastore Support: Any vsphere Datastore Datastore Support: vsan Datastore vsan Encryption 20

21 Encryption Performance Considerations vsphere Datastore Virtual Machine I/O Characteristics CPU Encryption Performance Storage Capabilities #SETR1848BE CONFIDENTIAL 21

VM Encryption Performance Whitepaper Performance Whitepaper Highlights Enterprise-class SSD or VMware vsan = minimal I/O performance impact Different storage

22 VM Encryption Performance Whitepaper Performance Whitepaper Highlights Enterprise-class SSD or VMware vsan = minimal I/O performance impact Different storage types = different I/O characteristics Encryption = higher CPU utilization Storage layer has as much if not more impact on total performance #SETR1848BE CONFIDENTIAL 22

23 Encryption Nitty-Gritty Keys, Algorithms, etc. XTS-AES-256 length keys for data Key generated by the ESXi host Referred to as the Data Encryption Key or DEK AES-128 or AES-256 for key encryption Key generated by the KMS. Referred to as the Key Encryption Key or KEK VM and vsan Encryption KEK key length is configured on the KMS, not on vcenter Generated by vcenter, not KMS One Time Use Only! AES-256 key 64-bit Nonce vmotion Encryption keys #SETR1848BE CONFIDENTIAL 23

24 vsphere Encryption Summary Ease of Operations and Deployment PowerCLI and other API support for automation Ease of Manageability No change to individual virtual machine operating systems Common encryption solution across all virtual machines Flexibility Encrypt based on workload type and security requirements Choice Standards Based Key Management Secure AES-XTS-256 encryption using modules that are FIPS evaluated #SETR1848BE CONFIDENTIAL 24

25 PowerCLI Modules for VM Encryption VMworld 2017 Content: Not for publication

PowerCLI for VM Encryption: Disk encryption Tasks $vmname = VM01 #Encrypt a VM Get-VM -Name $vmname Enable-VMencryption #Shallow Re-Key of a VM Get-VM -Name $vmname Set-VMEncryptionKey -KMSClusterId

26 PowerCLI for VM Encryption: Disk encryption Tasks $vmname = VM01 #Encrypt a VM Get-VM -Name $vmname Enable-VMencryption #Shallow Re-Key of a VM Get-VM -Name $vmname Set-VMEncryptionKey -KMSClusterId NewKMS # Encrypt just the Home object $EP = Get-SpbmStoragePolicy -Name "Encryption Policy Get-VM -Name $vmname Enable-VMEncryption -Policy $EP -SkipHardDisks #Decrypt a VM Get-VM -Name $vmname Disable-VMencryption #SETR1848BE CONFIDENTIAL 26

27 27

28 What KMS is providing the host keys? #SETR1848BE CONFIDENTIAL 28

29 PowerCLI Modules for VM Encryption Blog Article #SETR1848BE CONFIDENTIAL 29

30 STO1960BU vsphere Encryption for Virtual Machines and vsan Encryption Deep Dive VMworld 2017 Content: Not for publication Jase McCarty & Mike Foley #VMworld #STO1960

31 Secure Boot for ESXi

32 UEFI Secure Boot Secure Boot + VIB verification A hybrid model of trust. A verified boot process plus file system integrity ESXi Running hostd / DCUI / VM s Secure Boot Verifier VM Kernel Boot Loader UEFI Firmware Secure Boot Verifier validates all VIB s against VMware digital certificate VM Kernel starts Secure Boot Verifier, which also contains VMware digital cert ESXi Boot Loader validates VM Kernel against VMware digital certificate ESXi Boot Loader contains VMware digital certificate UEFI firmware validates ESXi Boot Loader against that digital certificate Hardware Vendor supplied UEFI firmware contains digital certificate 32

33 Adoption of Least Privilege Too many Administrators

34 Least Privilege is everywhere 34

35 Full Admin Full Admin Full Admin Full Admin Me too! Full Admin but why does everyone in IT have Administrator/root? 35

36 CONFIDENTIAL 36

New Role: No Cryptography Administrator Most of the same privileges as Administrator Power On Power Off Boot Shutdown vmotion Does not include any

37 New Role: No Cryptography Administrator Most of the same privileges as Administrator Power On Power Off Boot Shutdown vmotion Does not include any Cryptographic Operations No Encrypt No Decrypt No Console Access to Encrypted virtual machines No ability to download encrypted VM s #SETR1848BE CONFIDENTIAL 37

38 Encrypted vmotion

39 Encrypted vmotion available for ALL VM s! VMworld 2017 Disabled Do not use encrypted vmotion Opportunistic Use encrypted vmotion if source and destination hosts support it. Required Content: Not for publication Allow only encrypted vmotion. If the source or destination host does not support encrypted vmotion, migration with vmotion fails Virtual Machine vmotion data encrypted/decrypted (NOT vmotion Network!) One time use key and nonce generated by vcenter. Does not use KMS. 41

40 Encrypted vmotion VM vcenter Migration Spec Encryption Key + Nonce ESXi-A ESXi-B vmotion Network Not Encrypted 42

41 PowerCLI: Setting vmotion Encryption get-vm "Tiny" Set-vMotionEncryptionConfig Encryption required Options are: 'disabled' 'opportunistic' 'required' #SETR1848BE CONFIDENTIAL 43

42 vsphere 6.5 Enhanced Logging

43 Logs transform in vsphere 6.5 Pre-6.5: Logs used for GSS/Troubleshooting 6.5: Logs include VC Events Audit Quality and Actionable #SETR1848BE CONFIDENTIAL 45

44 vsphere Logging Today: 5.x / 6.0 virtual machine reconfigure Logs really need improvement. I know a change was made, but what happened? What changed? #SETR1848BE CONFIDENTIAL 46

45 Actionable Logging Who, What, When, How #SETR1848BE CONFIDENTIAL 47

46 Virtual Machine Changes being logged 48

47 Logging vcenter role being granted #SETR1848BE CONFIDENTIAL 49

48 CONFIDENTIAL 50

49 VMware Cloud on AWS Security

50 Permissions challenges VC permissions are not fine-grained FileManagment permission on a datastore allows you to copy, delete, and edit anything Customers require these permissions for standard operations (eg backup, restore, etc) VMware needs to protect our service infrastructure (VC, NSX, etc) from customers We have contractual obligations with AWS to prevent users from gaining access to hosts We have SLAs with customers that are dependent on our infrastructure VMs VM VM VM VM VM vsan Datastore vsan Cluster 52

51 Multiple Datastore Support Preventing customers from accessing our infrastructure VMware Mgmt. Datastore VM VM VM VM VM vsan Cluster Customer Administrator (Cloud Admin) Customer Datastore Motivation Provide separate datastore level permissions to enable use cases like VADP based backup Overview Logical separation of physical vsan cluster storage into two datastores Separates management workloads from customer workloads Allows more flexibility for assigning datastore permissions to customer s role #SETR1848BE CONFIDENTIAL

52 VMware Cloud on AWS - Permissions differences Role Privileges Owner Traditional Administrator Role CloudAdmin GlobalCloudAdmin Full Administrator Permissions Privileges for vcenter managed entities: Virtual Machines Resource Pools Datastores Networks Global privileges: Content Library Tagging Storage Profiles Read-Only VMware Customer Customer CONFIDENTIAL 54

53 VM Sandboxing in vsphere 6.5 Architecting another layer of Defense in Depth

54 CONFIDENTIAL 56

55 Virtual Machine (VMX) Sandboxing in vsphere 6.5 Zero Configuration! Nothing to change, nothing to configure Every VM runs in it s own sandbox Policies dictate what the VMX process that runs the VM is allowed to do or access e.g. VMX process has no access to /etc/passwd VMX process can t run scripts on the host VMX process can t initial SSH connections in or out of the host Limits what system calls a VMX process allowed to call Will this solve all my security concerns? No. This is an additional layer of defense in depth There is NO Easy Button when it comes to security 57

56 vsphere Security v.future

57 Disclaimer This presentation may contain product features or functionality that are currently under development. This overview of new technology represents no commitment from VMware to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new features/functionality/technology discussed or presented, have not been determined. This information is confidential. VMworld 2017 Content: Not for publication The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract.

58 vsphere 6.5 Comprehensive Built-In Security vsphere 6.5 The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 60

Technical Preview Comprehensive Built-In Security vsphere 6.5 vsphere.

0 Support Remote Host Attestation Programmatic Security Configuration Simplified

0 The information in this presentation is intended to outline our general product

59 Technical Preview Comprehensive Built-In Security vsphere 6.5 vsphere.future Forensics Logging Limited ESXi Admin AppDefense TPM 2.0 Support Remote Host Attestation Programmatic Security Configuration Simplified VM Encryption vsan Encryption Virtual TPM 2.0 The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 61

60 Remote Host Attestation Secure Infrastructure TPM 2.0 chip on ESXi Host is used to establish Hardware Root of Trust and to keep measurements safe vcenter attests ESXi host for running known VMware software. Guarantees that secure boot has done its job VMworld 2017 vcenter ESXi Host ESXi Running hostd / DCUI / VM s Secure Boot Verifier VM Kernel Boot Loader UEFI Firmware Hardware Technical Preview Content: Not for publication The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 62

61 Remote Host Attestation Secure Infrastructure Securing the Data Center Host s security stance is reported via a comprehensive security dashboard High Value Assets can be allowed to run only on attested ESXi Host Facilitate secure release of encryption keys to ESXi host VMworld 2017 Technical Preview Content: Not for publication The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 63

VM Encryption Secure Data Easy to Manage Security Simple setup

automate via PowerCLI User Friendly Easy button to encrypt with a

vcenter Scalable and Efficient 3 rd Party KMIP-Compliant KMS

Fine granular access controls Technical Preview Uses performance

is intended to outline our general product direction and should not

62 VM Encryption Secure Data Easy to Manage Security Simple setup Infrastructure Flexibility (Bring your own KMS) Use vsphere client or automate via PowerCLI User Friendly Easy button to encrypt with a single click Granular reporting of encryption state Easy to customize vcenter Scalable and Efficient 3 rd Party KMIP-Compliant KMS Agentless and guest OS Agnostic. Fine granular access controls Technical Preview Uses performance efficient AES-XTS 256 algorithm The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 64

VM Encryption Demo Intuitive and easy user experience Technical Preview The information in this presentation is intended to outline our general product

63 VM Encryption Demo Intuitive and easy user experience Technical Preview The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 65

64 VM Encryption Easy to Manage Security VMworld 2017 Content: Not for Easy button to enable encryption with a single click Granular reporting of the Encryption State of the VM Allows to do further customizations easily Technical Preview publication The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 66

65 Virtual TPM 2.0 Secure Data Enabling vtpm for a VM is as simple as adding a virtual device in VM settings! Guest secrets are protected from inguest attacks e.g encryption keys, certificates, device identity, etc. VMworld 2017 Technical Preview Content: Not for publication The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 67

device in VM settings! Guest secrets are protected from inguest attacks e.

Secrets stored in vtpm are protected by automatically encrypting VM files

Preview The information in this presentation is intended to outline our

66 Virtual TPM 2.0 Secure Data Enabling vtpm for a VM is as simple as adding a virtual device in VM settings! Guest secrets are protected from inguest attacks e.g encryption keys, certificates, device identity, etc. Secrets stored in vtpm are protected by automatically encrypting VM files IOIO IOIO IOIO VM Files ESXi *&* IOI %*^OIO $&* IOI (*&* OIO Technical Preview The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 68

67 Introducing VMWare AppDefense Protecting applications running on vsphere enabled private and public clouds VM MANIFEST Processes Processes OS Processes APPDEFENSE MONITOR VM MANIFEST Technical Preview New Product AUTOMATED AND ORCHESTRATED RESPONSE SECURE INFRASTRUCTURE INTEGRATED ECOSYSTEM Snapshot Suspend Block/Alarm Quarantine Network Blocking Service Insertion CAPTURE DETECT RESPOND The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 70

Protecting VMs in Non-Trusted Environments Technical Preview Operator of Public or Private

been tampered with, i.e. factory original Apps & Customer Data AppDefense: Secure data

Ensures that customer data is safe from both external and internal threats Virtual TPM 2.

intended to outline our general product direction and should not be relied on in making a

68 Protecting VMs in Non-Trusted Environments Technical Preview Operator of Public or Private Cloud Host Attestation: Assures that the infrastructure protecting customer data has not been tampered with, i.e. factory original Apps & Customer Data AppDefense: Secure data centers by focusing on verification of application s intended state Data Encryption: Ensures that customer data is safe from both external and internal threats Virtual TPM 2.0: Shields guest s secrets from in-guest attacks The information in this presentation is intended to outline our general product direction and should not be relied on in making a purchasing decision. It is for informational purposes only and may not be incorporated into any contract. 71

70 Questions? #SER1848BU

Update #STO1960BU vsphere Encryption for

71 Other sessions to consider: #SER1361BU Security Operations for VMware vsphere with VMware vrealize Log Insight #SER1848BE vsphere Platform Security Update #STO1960BU vsphere Encryption for Virtual Machines and vsan Encryption Deep Dive VMworld 2017 Content: Not for publication #GRC2226BU Operate Clouds at Least Privilege

vsphere Platform Security Update Day 2 Security Operations VMworld 2017 Content: Not for publication

SER1848BU vsphere Platform Security Update Mike Foley #VMworld #SER1848BU vsphere Platform Security Update Day 2 Security Operations VMworld 2017 Content: Not for publication Current Issues Current Issues: