The McAfee MOVE Platform and Virtual Desktop Infrastructure Simplifying and accelerating security management for virtualized environments
Table of Contents Wish List of Security Elements for Virtualized Endpoints 3 A Virtualization Security Management Platform 3 Adaptive to New Environments McAfee MOVE and VDI Case Study 4 Security Intelligence for VDI 5 Protection Designed to Be Flexible for VDI: 5 Hosted and Client Hypervisors Summary 5
Virtualization of endpoints, servers, and desktops gives IT greater flexibility, but today s security solutions in these new environments do not scale well. Security solutions must adapt to the changing operational model needed to leverage virtualized environments to their fullest in order to enable the business agility promised by virtualization vendors. With virtual desktop infrastructure (VDI), business end users expect high performance and low latency with every session and want to use the latest consumer computer systems, smartphones, or tablets often introducing their own personal devices into the workplace. Information technology owners also want to keep options open and do not necessarily want to lock themselves into any single vendor or type of configuration. McAfee Management for Optimized Virtualized Environments (McAfee MOVE) provides an open platform, aimed at simplifying security to address the concerns of today s VDI deployments. It accelerates the ability to leverage the best of virtualization without compromising performance or security. Wish List of Security Elements for Virtualized Endpoints Virtualization dramatically changes the IT characteristics of an endpoint, but once a VDI session is initiated, the experience and applications are the same to the user. The underlying security needs remain almost identical, but the way that security works within the environment should reflect and support the different mechanisms that are at play. It is critical to support and protect the virtual desktop infrastructure with a defense-in-depth security strategy. When it comes to a virtualized environment, the focus alters from protecting a physical endpoint by blocking against possible breaches or compromise to looking at how to protect business data and data sets commonly used by the end-user community. Each user session is now a data set abstracted from the shared computing platform and made available through the fabric of the virtualization solution to become the virtual endpoint that processes the allocated and allowed applications and services. Security must adapt to this change to the IT infrastructure. Endpoint security functions are still relevant, but for virtualized environments, the way security is delivered needs to change. Let s take a look at key security considerations for virtualized environments: To minimize performance impact, determine how security can be deployed in an infrastructure services model versus security product installation on individual virtual machines Ensure that the management platform for the initial deployment of your security will scale to the entire organization and support the physical and the virtualized environments equally Ensure that there is no conflict with the flexibility features of the virtualization solutions, and make sure that there is a balance. Provisioning and operational policies should allow for the incorporation of security policies to obtain a high level of compliance. Since many virtualization vendors are incorporating various degrees of security and security policy management into their frameworks, look for security solutions that are solving these issues with broader vendor platform support A Virtualization Security Management Platform Adaptive to New Environments The McAfee MOVE platform is the foundation for beginning the transformation of traditional endpoint security to deeper and more relevant intelligence in securing data as it flows through virtualized environments. As the world s largest security vendor, McAfee brings experience in global threat intelligence and development of IT security solutions to enable the research and subsequent McAfee MOVE platform design and architecture. (The McAfee MOVE platform provides security in a more agile and service-oriented way, optimized specifically for virtualized environments.) 3
McAfee MOVE is not only a development platform that McAfee uses to build commercially available products, it is also a platform with an application programming interface (API) used by McAfee partners for developing and certifying McAfee-compatible security solutions specifically designed to meet the needs of virtualized environments. McAfee supports the major hypervisor and virtualization vendors with the McAfee MOVE platform. Because the focus is on security, not on overall operational control at the hypervisor layer, McAfee MOVE is designed to be flexible and utilize standard communication and not rely on any proprietary or specialized API from the hypervisor vendors to deliver service. However, this still provides the visibility to be hypervisor context-aware and enable virtual machine tagging, simplifying security policy management and keeping it intact as the virtual machines migrate from hypervisor to hypervisor. It is also critical to understand the current status of overall resource utilization across the hypervisor to minimize the impact of security processing in these shared resource environments. Common components: McAfee MOVE virtual appliance The appliance delivers service-driven security. It is the engine that provides service-based capabilities, such as security policy and processing on behalf of guest users. It is a dedicated virtual machine and allocated CPU that hosts the McAfee MOVE virtual appliance. McAfee epolicy Orchestrator (McAfee epo ) platform This management tool installs client software, pushes out new policies, monitors client activity, and stores and sends out content and client updates McAfee epolicy Orchestrator Extension This software provides the interface for configuration, scheduling, and security reporting for McAfee MOVE McAfee epolicy Orchestrator Agent The McAfee epo agent acts as an intermediary between the guest and the McAfee epo console and database McAfee MOVE guest component The guest component provides communication and brokers the security status and information regarding the guest. It becomes an instrumentation engine on behalf of the virtual appliance. The guest software component of the McAfee epo agent and the McAfee MOVE guest component can be integrated into the master template images and configured with default security policies, including communication to a default McAfee MOVE virtual appliance that supports security policy adherence immediately upon the creation of any individual virtual endpoint. Protective security measures must be optimized and made instantly available to the virtualization layers. McAfee MOVE enables these capabilities architecturally so that any new virtual machine/workload will have the right security enforcement and can appropriately leverage shared resources. McAfee MOVE and VDI Case Study With the rapid expansion of VDI, the performance and virtual machine density that one can realistically expect with traditional endpoint security installed within each guest has caused many enterprises to reconsider the speed with which they plan to roll this out to their community. This deployment has been proven to be inefficient and resource intensive, limiting the total number of virtual machines that can be deployed on a single host. These challenges have jeopardized the long-term operational expectations and management-related cost savings that organizations hoped to achieve. McAfee developed the first endpoint security specifically designed to optimize security for VDI McAfee MOVE AntiVirus. This solution allows enterprises to leverage their existing McAfee VirusScan Enterprise endpoint security and to use the McAfee MOVE platform architecture as a way of offering McAfee VirusScan Enterprise as a service, greatly reducing the overall performance impact. The virtual appliance provides McAfee VirusScan Enterprise services such as on-access and.dat file updating for supported guests. 4
Security Intelligence for VDI McAfee MOVE also provides adaptive intelligence that goes beyond simply offloading the virus scanning in resource-critical, virtualized IT environments. Because the McAfee MOVE virtual appliance provides scan processing on behalf of the guests on the hypervisor, it can also provide valuable information regarding the threats encountered. McAfee MOVE AntiVirus for VDI solutions uses the McAfee MOVE platform and capabilities to proactively populate critical cache information for all guests it manages. After encountering a malicious file once, on behalf of a single guest, other guest caches are also automatically updated. If, throughout the day, multiple guests attempt to read this malicious file, the cache information and security policy prevent the malware from compromising the session or corrupting the data being processed through the virtualized environment without any additional overhead. Protection Designed to Be Flexible for VDI: Hosted and Client Hypervisors As virtual desktop options continue to expand, McAfee MOVE can accommodate configurations that give IT flexibility in deployment and management. From hosted VDI with persistent and dynamic user sessions to emerging client-side hypervisor solutions that extend the ability to provide controlled enterprise desktop resources even when fully disconnected from the network, McAfee MOVE can deliver and optimize endpoint security in these environments. Client-side hypervisors allow for multiple, separated work systems to be hosted as virtual machines within a single laptop or endpoint. One system might host computing and resources for working with a legacy terminal emulation/application, another may be a Microsoft Windows 7 work environment, and yet another guest may host a system where the end user can freely install applications and entertainment. Having the hypervisor fabric create disparate systems is not a problem for McAfee MOVE, which, in this case, would also be installed as a McAfee MOVE virtual machine on the client-side hypervisor. With the ability to create specific default security policies for each individual guest based on the risk characteristics that are derived by what each virtual machine performs, security management can be as flexible as the virtualization solution. In these configurations, the McAfee MOVE virtual appliance, when supporting anti-virus offloading, will still broker on behalf of the individual guest machines and provide the economies of scale and adaptive security intelligence. Summary McAfee MOVE is a security platform that takes into account the unique performance and operations issues that VDI presents to enterprise IT. The platform will continue to expand with additional functionality aimed at easing security management for virtualized environments. McAfee MOVE addresses the most immediate security needs, not only in security protection, but also by removing operational obstacles that are hindering the effective deployment of secure VDI environments. VDI has the power to provide the flexibility to address key business goals, helping to centralized data and management. McAfee MOVE not only accelerates the delivery of security controls uniquely tailored to the virtualized environment, it also simplifies security management. Next Steps For more information, visit www.mcafee.com/virtualization, or contact your local McAfee representative or reseller near you. McAfee, Inc. 2821 Mission College Boulevard Santa Clara, CA 95054 888 847 8766 www.mcafee.com McAfee, the McAfee logo, McAfee epolicy Orchestrator, McAfee epo, and McAfee VirusScan Enterprise are registered trademarks or trademarks of McAfee, Inc. or its subsidiaries in the United States and other countries. Other marks and brands may be claimed as the property of others. The product plans, specifications and descriptions herein are provided for information only and subject to change without notice, and are provided without warranty of any kind, express or implied. Copyright 2011 McAfee, Inc. 19702wp_move-platform_0111_fnl_ASD