Zabezpečení softwarově definovaných datových center prostřednictvím Check Point vsec a VMware NSX

Zabezpečení softwarově definovaných datových center prostřednictvím Check Point vSEC a VMware NSX

Tomáš Michaeli Senior System Engineer, Vmware Peter Kovalčík Security Engineer, Check Point Software Technologies

©2015 ©2015 Check Check Point Point Software Software Technologies Technologies Ltd. Ltd.

1

Nebezký cloud?

Dnes virtualizujeme síťové služby pomocí VMware NSX

Network Hypervisor

S koncepcí definice datového centra v software vRealize Suite nebo OpenStack

Stavové programovatelné ovládání

Software Hardware

APIs Aplikace

Virtuální Servery

Virtuální Sítě

Virtuální Úložiště

Data Center Virtualization

Výpočetní Kapacita

Propojovací Kapacita

Datová Kapacita

Komoditní HW kapacita

4

Umožňuje vytvářet virtuální prostředí

Softwarové Kontajnery Virtuální Sítě Load-Balancing NAT, VPN, Firewall

Programatický přístup k bezpečnostním s síťovým službám https://www.vmware.com/support/pubs/nsx_pubs.html Web Tier Logický Switch

L3 Subnet

App Tier NAT

Logický Router

L3 Subnet

DB Tier 100 pravidel Firewallu

L3 Subnet

NAT Definice VIP Load Balancing 7

Neustále se setkáváme s krádežemi dat nebo čísel karet Nekontrolovaná komunikace Malá nebo laterální kontrola uvnitř perimetru Aplikace nízké priority jsou cílem útoku na prvním místě. Útočník se může svobodně pohybovat v rámci zóny.

Internet

10110100110 Útočník se 101001010000010 1001110010100infiltruje v řádu Data Center Perimeter

týdnů nebo měsíců.

8

Zero–Trust bezpečnost detailně Současný model bezpečnostních zón

NSX Transparentní Zero-Trust bezpečnost

FIREWALL

Port Group “Web” VLAN 91

Port Group “Web” VLAN 91

FIREWALL

Bezpečnostní Skupina: Web Pravidlo Firewallu: Nemožné

Pravidlo Firewallu: Web na Web: DROP 10

Plně automatizované datové centrum

Hypervisor ESXi

VMware CheckPoint Automatizace Okamžité Nasazení NSX vSEC Cloudu Minuty

Čekám

Automatická Konfigurace

Čekám Připraveno

Manuální Konfigurace

Hodiny a Dny 11

DATA CENTERS are rapidly evolving.

©2015 Check Point Software Technologies Ltd.

12

DATA CENTER EVOLUTION

Software Defined

Virtual Datacenter

Datacenter Private Cloud

• •

Server (compute) virtualization Network operation is manual


• •

Network are is also virtualized Services can be dynamically inserted and orchestrated via automation

13

THE NEW ERA OF SOFTWARE-DEFINED DATACENTERS (SDDC)

Allowing IT to deliver applications at a fraction of the cost and time in a more secure way! ©2015 Check Point Software Technologies Ltd.

14

SECURITY CHALLENGES IN THE CURRENT DATACENTER

©2014 Check Point Software Technologies Ltd. 15

Challenge #1: Increasing Traffic Inside the Datacenter

NORTH

WEST

EAST

SOUTH

Perimeter (north-south) security is blind to 80% of the east-west data center traffic ©2015 Check Point Software Technologies Ltd.

16

Challenge #2: Lateral Threats Inside the Data Center

•

Lack of security control between VMs

•

Threat can easily traverse VLANs

•

Threats attack low-priority service and then move to critical systems

Modern threats can spread laterally inside the data center, moving from one application to another ©2015 Check Point Software Technologies Ltd.

17

Challenge #3: Security Ignores Data Center Changes

•

New Virtual Machines

•

Virtual Machine movement

•

VM that change IP address

•

Dormant VMs that wakes up

•

VMs move between VLANs

Traditional static controls fail to secure dynamic networks and highly mobile applications ©2015 Check Point Software Technologies Ltd.

18

Challenge #4: Security Inhibits Data Center Agility

How to define secure policy for catalog applications that have not been provisioned and still don’t have IP address?

Lack of security automation impacts business agility in delivering services, results in security gaps ©2015 Check Point Software Technologies Ltd.

19

WHAT IS NEEDED?


20

SECURITY REQUIREMENTS INSIDE THE DATA CENTER

3

Automated insertion and deployment of advanced threat prevention to protect inside the data center

2

Automated security provisioning to keep pace with dynamic data center changes

1

Security visibility into traffic inside the data center


21

CHECK POINT & VMWARE Automating Security inside the Data Center

+ Virtual Security with Advanced Threat Prevention

Lateral Threat Prevention


Next Generation Networking and security

Automated Security Provisioning

Security Control & Visibility

23

vSEC & NSX DATACENTER SECURITY 100% Software Based: Service, Network & Security Micro-Segmentation with advanced threat prevention

Automation of Virtual Network & Security

s

Segmented Data Center ©2015 Check Point Software Technologies Ltd.

Security Control for All Data Center Traffic

s

Security Orchestration between Virtual Machines

Consistent security for N-S and E-W traffic 24

Check Point vSEC + VMware NSX How it works


28

CHECK POINT vSEC DEPLOYMENT NSX automatically provisions Check Point vSEC gateway on each host


29

CHECK POINT vSEC AUTO-DEPLOYMENT

NSX manager automatically deploys and provisions Check Point vSEC Gateway on each host


30

CHECK POINT vSEC AUTO-DEPLOYMENT

Automatically & instantly scale vSEC to secure VMs on new host members


31

MICRO-SEGMENTATION

NSX Security Group Finance

Legal

Web

Partners

Database

Use NSX to segment Virtual Machines into different Security Groups using a flat network ©2015 Check Point Software Technologies Ltd.

32

EAST-WEST SECURITY CONTROL

NSX Service Chain Policy Traffic from Partner to Legal Security Group must go through Check Point vSEC Gateway

Use Check Point vSEC to control traffic access between Virtual Machines ©2015 Check Point Software Technologies Ltd.

33

PREVENT LATERAL THREATS

Use vSEC for Advanced Threat Prevention inside data center


34

APPLICATION-AWARE POLICY Check Point Access Policy Rule 3

From

To

WEB_VM

Database

(vCenter Object)

(NSX SecGroup)

Service

Action

SQL

Allow

Check Point dynamically fetches objects from NSX and vCenter

Use Fine-grained security policies tied to NSX Security Groups and Virtual Machine identities ©2015 Check Point Software Technologies Ltd.

35

SHARED-CONTEXT POLICY

NSX Policy From Infected VM (Tagged by Check Point)

To

Action

Any

Quarantine

Check Point tags infected Virtual Machines in NSX manager

Shared security context between vSEC and NSX Manager to automatically quarantine and trigger remediation by other services ©2015 Check Point Software Technologies Ltd.

36

UNIFIED MANAGEMENT

Use Check Point unified management for consistent policy control and threat visibility across virtual and perimeter gateways ©2015 Check Point Software Technologies Ltd.

37

THREAT VISIBILITY INSIDE THE DATACENTER

4800

Infected Virtual Machines VM Identity

Severity

Date

VM_Web_22

High

3:22:12 2/4/201

VM_DB_12

High

VM_AD_15

Medium

5:22:12 2/4/201 12400 5:28:12 2/4/201

VM_SAP_34

Medium

7:28:12 2/4/201

Use Check Point SmartEvent to monitor and investigate threats across north-south and east-west traffic ©2015 Check Point Software Technologies Ltd.

38

Check Point vSEC Key Features Feature Policy Management

Check Point

Unified management for Virtual and physical Gateways

Datacenter policy segmentation with sub policies*

Fetch vCenter and NSX objects for use in Check Point policy Threat Prevention with multi-layered defenses for Virtual Data Center Security

Tag infected VM and update NSX for automatic remediation Visibility & Forensics

View VM objects in security logs Comprehensive Datacenter Threat Visibility

Automation & Orchestration Granular privilege down to individual rule for trusted integrations* * Available in R80


[Confidential] For designated groups and individuals

40

LIVE DEMO


41

SUMMARY


42

vSEC & NSX DATACENTER SECURITY 100% Software Based: Service, Network & Security Software Defined Datacenters

Automation of Virtual Network & Security

s

Security Control for All Data Center Traffic

s Software Defined Datacenter Private Cloud

SDDC ©2015 Check Point Software Technologies Ltd.

Security Orchestration between Virtual Machines

Consistent security for N-S and E-W traffic 43

THANK YOU!


45

Zabezpečení softwarově definovaných datových center prostřednictvím Check Point vsec a VMware NSX

Recommend Documents