RSA pro VMware. David Matějů. RSA, The Security Division of EMC

Transcription

1 RSA pro VMware David Matějů RSA, The Security Division of EMC

2 How secure are you? Does your IT security address the risks associated with virtualization and private cloud before they are implemented? 24% Yes, always. 43% Sometimes, but there are gaps. 22% No, security is brought in after the fact. 11% We move ahead without security. Source: Live EMC Forum poll conducted in five cities across North America, 10/09

3 How secure are you? 76% of businesses are restricting the potential value of virtualization and increasing potential risk Source: Live EMC Forum poll conducted in five cities across North America, 10/09

4 Agenda Event Analysis and Log Management for Virtualized Environments Cloud Security and Compliance Solutions VMware View Solutions 4 4

5 RSA envision SIEM Platform Event Analysis and Log Management for Virtualized Environments

6 RSA envision SIEM Platform Event Analysis and Log Management Consolidated Event Log Management Real-time Monitoring Correlated Alerting Incident Management Reporting and Historical Analysis

7 RSA envision SIEM Platform Event Analysis and Log Management Consolidated event log management, analysis, and reporting supporting 230+ systems (servers, OS, network, security, applications, storage,...) Allows for cross-environment correlation Collects logs from the VMware stack VMware vshield VMware vcenter VMware ESX/ESXi VMware View Manager VMware vcloud Director VMware Collector for RSA envision leverages VMware API s RSA envision Over 380 unique messages 19 normalized event categories Can pull logs from multiple vcenters

8 RSA envision SIEM Platform Auto Discover Managed ESX Servers via vcenter

9 RSA envision SIEM Platform Purpose-prebuilt Virtualization Reports

10 RSA envision SIEM Platform Easily Build Customized Virtualization Reports

11 RSA envision SIEM Platform Deep visibility into Virtual and Physical Datacenters Validated with Vblock Applications Virtual Machines Networking vsphere UCS RSA envision Comprehensive visibility into security events Security incident management, compliance reporting Storage

12 RSA envision SIEM Platform Use Case: Monitoring events in the virtual datacenter

13 RSA Arecher egrc RSA Solution for Cloud Security and Compliance

14 Enabling the Cycle of Security Compliance Discover VMware infrastructure Define security policy Manage security incidents that affect compliance Manual and automated configuration assessment RSA Archer egrc Remediation of non-compliant controls

15 How we do it: Solution Components RSA Archer egrc Platform 130+ control procedures mapped to VMware best practices Automated deployment workflow, configuration measurement, incident notification and reporting Maps technical security controls to Authoritative Sources (Regulations like PCI) Single business view of compliance for both physical and virtual RSA envision (SIEM) Correlate security and compliance events across virtual and physical environments, fed into Archer E.g. VMware vshield, VMware vcloud Director, HyTrust Appliance, EMC Ionix, etc RSA Data Loss Prevention (DLP) Suite RSA SecurBook

16 RSA Archer egrc: Mapping VMware security controls to regulations and standards Authoritative Sources PCI, HIPAA, SOX, CSA, VMware Hardening Guide, etc Administrator and Operator Logs CxO Control Standard Generalized security controls CS-179 Activity Logs system start/stop/config changes etc. Control Procedure Technology-specific control CP Persistent logging on ESXi Server VI Admin

17 Example Work Queue Sent to VI Admin

18 Automated Assessment via PowerCLI Automated Measurement Agent VI Component Discovery and Population VI Configuration Measurement VMware-specific Controls RSA Archer egrc alerts RSA envision

19 RSA Data Loss Prevetion RSA SecurID RSA Solutions for VMware View

20 No Sensitive Data on Endpoints Strong Two-factor Authentication vshield protected network RSA SecurID Endpoint with NO sensitive data Virtual Desktop with access to sensitive data Application with sensitive data The endpoint is changing Mac iphone/ipad Android phones and tablets BYOC No USB or only secure USB allowed via RSA DLP Network access controlled via VMware vshield The process is fully logged by RSA envision

21 RSA Data Loss Prevention Suite (DLP) Unified Policy Mgmt & Enforcement Incident Workflow DLP Enterprise Manager Dashboard & Reporting User & System Administration DLP Datacenter DLP Network DLP Endpoint Discover File shares, SharePoint sites, Databases, SAN/NAS Remediate Delete, Move, Quarantine Monitor , webmail, IM/Chat, FTP, HTTP/S, TCP/IP Enforce Allow, Notify, Block, Encrypt Discover Local drives, PST files, Office files, 300+ file types Enforce Allow, Justify, Block on Copy, Save As, Print, USB, Burn, etc. edrm Encryption Access Controls

22 RSA Solution for VMware View RSA Archer Compliance Dashboard VMware Infrastructure RSA DLP for protection of data in use RSA SecurID for remote authentication Active Directory VMware View Manager VMware vcenter Clients RSA SecurID for ESX Service Console and vma RSA envision log management for VMware vcenter & ESX(i) VMware View RSA SecurID RSA DLP Active Directory 230+ other 3rd party systems

23 More Information RSA SecurBooks Technical guides for deploying and operating RSA Solutions

24 rsa.com/rsavirtualization Thank you!