Virtualized Security for Software-Defined Data Centers
•Download as PPSX, PDF•
2 likes•563 views
This document discusses the need for a new security model in software-defined data centers (SDDCs). Traditional security approaches no longer apply in SDDCs due to their dynamic nature. The Check Point vSEC solution is presented as providing security across virtual and physical systems in SDDCs. Key features of vSEC include automatically scaling security across virtual machines, enforcing security for east-west traffic between VMs, providing advanced threat prevention, and unified management of virtual and physical gateways. A demo is provided of vSEC's advanced security protections, granular visibility, identity awareness, and automation capabilities.
![©2015 Check Point Software Technologies Ltd. 1©2015 Check Point Software Technologies Ltd. [Restricted] ONLY for designated groups and individuals
Síla virtuality
virtualizovaná bezpečnost
Softwarově Definovaných Datových Center (SDDC)
s plnou podporou SDN
Martin Koldovský, Check Point Software Technologies
SE Manager Eastern Europe](https://image.slidesharecdn.com/chp2015-10-07-securingsddc-151013145609-lva1-app6891/85/Sila-virtuality-virtualizovana-bezpecnost-softwarove-definovanych-datovych-center-SDDC-s-plnou-podporou-SDN-1-320.jpg)
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (12)
Similar to Virtualized Security for Software-Defined Data Centers
Similar to Virtualized Security for Software-Defined Data Centers (20)
More from MarketingArrowECS_CZ
More from MarketingArrowECS_CZ (20)
Recently uploaded
Recently uploaded (20)
Virtualized Security for Software-Defined Data Centers
- 1. ©2015 Check Point Software Technologies Ltd. 1©2015 Check Point Software Technologies Ltd. [Restricted] ONLY for designated groups and individuals Síla virtuality virtualizovaná bezpečnost Softwarově Definovaných Datových Center (SDDC) s plnou podporou SDN Martin Koldovský, Check Point Software Technologies SE Manager Eastern Europe
- 2. ©2015 Check Point Software Technologies Ltd. 22 DID YOU KNOW? months is the average time to deliver new DC service. Source: Gartner Research
- 3. ©2015 Check Point Software Technologies Ltd. 33 $7,900 per minute $1/2 M dollar per hour Source: Gartner Research DID YOU KNOW? Average Costs of a downtime:
- 4. ©2015 Check Point Software Technologies Ltd. 44 DID YOU KNOW? 1 in 5 companies fire employees due to downtime. Source: Gartner Research
- 5. ©2015 Check Point Software Technologies Ltd. 8[Restricted] ONLY for designated groups and individuals CRM ERP Web Server File System Billing Mail Server The Backbone of any Enterprise Business
- 6. ©2015 Check Point Software Technologies Ltd. 99[Restricted] ONLY for designated groups and individuals It is nearly impossible for today’s data center to run at business speed. “ ”ZK Research
- 7. ©2015 Check Point Software Technologies Ltd. 10 Hey, I can spin-up VMs in minutes. Why does it take a week to get network/firewall changes State of Virtualization vs. Networking
- 8. ©2015 Check Point Software Technologies Ltd. 1111[Restricted] ONLY for designated groups and individuals The traditional DC is SLOW INSECURE
- 9. ©2015 Check Point Software Technologies Ltd. 1212[Confidential] For designated groups and individuals But it doesn’t have to work this way. let’s take a DIFFERENT APPROACH
- 10. ©2015 Check Point Software Technologies Ltd. 13 A new networking model is needed [Highly Restricted] ONLY for designated individuals Facebook’s Data Center @ Altoona Iowa US
- 11. ©2015 Check Point Software Technologies Ltd. 1414[Restricted] ONLY for designated groups and individuals A new trend is gaining momentum… Software Defined Networking
- 12. ©2015 Check Point Software Technologies Ltd. 1515[Restricted] ONLY for designated groups and individuals Before SDN Traditionally, switches and routers learn the network topology by communicating with neighbor devices
- 13. ©2015 Check Point Software Technologies Ltd. 1616[Restricted] ONLY for designated groups and individuals What is SDN all about? Controller With SDN, network devices get directions from a central controller
- 14. ©2015 Check Point Software Technologies Ltd. 1717[Restricted] ONLY for designated groups and individuals Benefits of SDN Controller SDN allows modern networks to be more agile and automated Network App Network App
- 15. ©2015 Check Point Software Technologies Ltd. 1818 Traditional Data Center • Dedicated and Isolated Hardware • Low utilization • Low flexibility Virtualized Data Center • Server Consolidation and Virtualization • Optimized Compute utilization • Performance issues Software Defined Data Center • Offer infrastructure as a service • Better utilization • Higher flexibility / Capacity on demand DATA CENTER EVOLUTION Server Virtualization Allows aggregation of multiple independent virtual servers to exist on a physical server 2007-2010 Network Virtualization Decouples the physical infrastructure from the connectivity services making the network adaptive and dynamic with simple one-touch provisioning Compute Access Data Center Core Campus Core Distribution Layer Access Layer
- 16. ©2015 Check Point Software Technologies Ltd. 19 SDDC
- 17. ©2015 Check Point Software Technologies Ltd. 20 The SDDC Vision [Restricted] ONLY for designated groups and individuals Software Defined Data Center revolutionize IT by implementing SDN concepts and supporting : Orchestration & automation Private/Hybrid cloud Self service
- 18. ©2015 Check Point Software Technologies Ltd. 21 SDDC improves traffic flows [Restricted] ONLY for designated groups and individuals • Networking layer is virtualized and centrally controlled • IP segments no longer force ineffective traffic routes • Fully optimized traffic flows are be generated automatically on demand without admin intervention • Potentially – everything is connected !
- 19. ©2015 Check Point Software Technologies Ltd. 22 But what about security ? [Restricted] ONLY for designated groups and individuals • Traditional security methodology no longer apply: ̶ No IP based topology ̶ No clear static segments ̶ Dynamic real-time end-user-triggered changes ̶ Security policies and access control readiness for changes ̶ Lack of virtualization awareness ̶ The Data Center is a blind spot for the IT security • Multiple vendor-independent components • Dynamic traffic flows serving application layer • SDDC prone to malware propagation and collateral movement
- 20. ©2015 Check Point Software Technologies Ltd. 23[Protected] Non-confidential content Anatomy Of Modern Attacks On Data Centers infiltrate lateral move
- 21. ©2015 Check Point Software Technologies Ltd. 24[Restricted] ONLY for designated groups and individuals We need a new security model, don’t we ? http://www.checkpoint.com/sdp/
- 22. ©2015 Check Point Software Technologies Ltd. 25 SDN An emerging network architecture, decoupling network control and data planes. Data flows between network nodes controlled via a programmable network SDN controller. SDP An overlay architecture enforcing security traffic flows within an SDN network Data flows are programmed to pass through SDP enforcement points SDP AND SDN MODELS WORK IN SYNERGY
- 23. ©2015 Check Point Software Technologies Ltd. 26 vSEC Solution Components
- 24. ©2015 Check Point Software Technologies Ltd. 27 vSEC solution components [Restricted] ONLY for designated groups and individuals
- 25. ©2015 Check Point Software Technologies Ltd. 28 vSEC Key Features
- 26. ©2015 Check Point Software Technologies Ltd. 29 Automatically & instantly scale vSEC to secure VMs on new host members CHECK POINT vSEC AUTO-DEPLOYMENT
- 27. ©2015 Check Point Software Technologies Ltd. 30 SECURITY FOR EAST-WEST TRAFFIC NSX chains Check Point vSEC gateway between VMs Traffic between VMs goes through VMware NSX and Check Point vSEC gateways
- 28. ©2015 Check Point Software Technologies Ltd. 31 Use vSEC for Advanced Threat Prevention inside data center PREVENT LATERAL THREATS
- 29. ©2015 Check Point Software Technologies Ltd. 32 UNIFIED MANAGEMENT Use Check Point unified management for consistent policy control and threat visibility across virtual and perimeter gateways
- 30. ©2015 Check Point Software Technologies Ltd. 33 APPLICATION-AWARE POLICY Check Point Access Policy Rule From To Service Action 3 WEB_VM (vCenter Object) Database (NSX SecGroup) SQL Allow Use Fine-grained security policies tied to NSX Security Groups and Virtual Machine identities Check Point dynamically fetches objects from NSX and vCenter
- 31. ©2015 Check Point Software Technologies Ltd. 34 SHARED-CONTEXT POLICY NSX Policy From To Action Infected VM (Tagged by Check Point) Any Quarantine Shared security context between vSEC and NSX Manager to automatically quarantine and trigger remediation by other services Check Point tags infected Virtual Machines in NSX manager
- 32. ©2015 Check Point Software Technologies Ltd. 35 Use Check Point SmartEvent to monitor and investigate threats across north-south and east-west traffic THREAT VISIBILITY INSIDE THE DATACENTER 4800 12400 Infected Virtual Machines VM Identity Severity Date VM_Web_22 High 3:22:12 2/4/201 VM_DB_12 High 5:22:12 2/4/201 VM_AD_15 Medium 5:28:12 2/4/201 VM_SAP_34 Medium 7:28:12 2/4/201
- 33. ©2015 Check Point Software Technologies Ltd. 36 Demo
- 34. 37©2013 Check Point Software Technologies Ltd. Advanced Security Protections GranularVisibility Identity Awareness DLP Mobile Access SmartEvent Application Control URLF IPS Anti-Bot Antivirus Threat Emulation HTTPSHTTPSHTTPS USERCHECKUCUC
- 35. ©2015 Check Point Software Technologies Ltd. 38 Summary Check Point SDDC security solutions Advanced Security protections seamlessly enforced inside the SDDC Agile Security Provisioning for the SDDC Comprehensive threat visibility across the SDDC
- 36. ©2015 Check Point Software Technologies Ltd. 39[Confidential] For designated groups and individuals Feature Check Point Policy Management Unified management for Virtual and physical Gateways Datacenter policy segmentation with sub policies* Fetch vCenter and NSX objects for use in Check Point policy Security Threat Prevention with multi-layered defenses for Virtual Data Center Tag infected VM and update NSX for automatic remediation Visibility & Forensics View VM objects in security logs Comprehensive Datacenter Threat Visibility Automation & Orchestration Granular privilege down to individual rule for trusted integrations* Check Point vSEC Key Features * Available in R80
- 37. ©2015 Check Point Software Technologies Ltd. 40©2015 Check Point Software Technologies Ltd. THANK YOU!
Editor's Notes
- And if we look at the financials: It is estimated that: DC downtime may cost:
- Let’s analyze this definition to understand whether it can apply to modern Data Centers.
- First statement refers to a “facility”, while SDDC provides the ability to virtually distribute Data Center services among different physical locations and even leverage public cloud platforms
- First statement refers to a “facility”, while SDDC provides the ability to virtually distribute Data Center services among different physical locations and even leverage public cloud platforms
- Instead of phisical servers and locations, the modern Data Center addresses the concept in terms of business applications regardless on the location and hardware in use.
- But I can hardly blame you, because according to ZK Research: “It is nearly impossible for today’s data center to run at business speed.”
- ASK Who knows what SDN is about.
- Utopian network Want to take decision from network layer to application layer, more sophisticated and agile network.
- Being controlled by an intelligent controller, operating at an application level which allows modern SDN networks to be very agile and automated. Changes in the network can be automatically accommodated. Self healing Easily Orchestrated Part, and eventually Automated Utopian network
- Private cloud – organizational entity providing compute, storage and network access to application services Hybrid cloud – combines private and public cloud services, distributing specific functions according to load/capacity/other or data/application sensitivity Orchestration and automation – layer designed to provide provisioning, define processes flows, optimize resources, translate logical requirements into operations and react dynamically to changes Self service – methodology allowing end-users to initiate changes by submitting requests and translating it into an automated provisioned process
- Movie – self service
- Let’s start with what we don’t know
- Movie – self service