The document discusses several options for implementing private cloud security and resiliency: 1. UEFI Secure Boot helps prevent unauthorized operating systems from loading during the boot process by only loading verified and certified operating systems. 2. Network adapter ACLs on virtual machines can be used to control network traffic by allowing or denying traffic based on MAC addresses and traffic direction. 3. Enabling MAC address spoofing on virtual machine network adapters allows VMs to change their MAC address to enhance security. 4. Different resilience strategies like application-level clustering or infrastructure-level failover clustering can provide high availability depending on application needs and infrastructure capabilities.

1. http://aka.ms/FEEAB
http://blogs.technet.com/security_talk

8. Current
boot
process
New boot
process
Any OS could hook in load code
here, including a piece of malware
If it is not valid the boot will
be interrupted
UEFI Secure Boot Activation
UEFI will only load
a verified (via
certificate) OS

23. A
Solution for Private Cloud Security

26. Add-VMNetworkAdapterAcl -VMName MyVM –
LocalMacAddress 12-34-56-78-9A-–Direction Both –Action
Allow
Add-VMNetworkAdapterAcl -VMName MyVM –
LocalMacAddress FF-FF-FF-FF-FF-FF –Direction InBound –
Action Allow
Add-VMNetworkAdapterAcl -VMName MyVM –
LocalMacAddress Any –Direction Both –Action Deny

28. A
Solution for Private Cloud Security

30. Set-VMNetworkAdapter –VMName MyVM –
MacAddressSpoofing On

32. A
Solution for Private Cloud Security

38. VMs designed to handle failures (e.g. Guest
Clustering) or downtime acceptable.
Lower End Industry Standard Server, single
infrastructure
App-Level Resiliency
Application-controlled failover
/ Guest clustering
Switch Switch
Parent VM
s
VM
s
VMs
Parent VM
s
VM
s
VMs
Cluster
VMs not designed to handle failures, H/A at server
level, Failover clustering as another layer of
protection, high-end servers, redundant power and
network gear
Hyper-V Failover Clustering
Infrastructure Resiliency
Parent VM
s
VM
s
VMs
Parent VM
s
VM
s
VMs
Switch
Switch

41. File Server
Cluster
Storage
Manage
SAS
Hyper-V
Extensible
Switch
VM 1
Live
Migration
Cluster/
Storage
Manage
Hyper-V Server
VM n
Datacenter Network Tenants Network
“Green Field”
• 10GbE Network(s)
• File Server for VM storage
• Actual storage may be an
existing FC/iSCSI SANs or
JBODs+Spaces
• Highlighted features: 10GbE
w/DCB, QoS, LBFO, Hyper-V over
SMB, Spaces
• Note: LBFO & RDMA can’t
coexist on same NICs.10GbE
1/10GbE
NIC Teaming
OS QoS
DCB
NIC Teaming
OS QoS
DCB
Use of NIC Teaming & Qos/DCB
10GbE10GbE
SAN / JBODs
SAS
1/10GbE

42. http://technet.microsoft.com/en-
us/library/hh831738.aspx