This document discusses building a paper trail to secure and audit a public cloud. It begins with an agenda that includes introducing OVH and discussing common security requirements, solutions, and scenarios. It then provides details on OVH as a global cloud provider and their data center infrastructure. The presentation outlines solutions like identity federation, role-based access control, network security using NSX, logging with Log Insight, and monitoring with vROps. It demonstrates these solutions and discusses how to overcome limitations of public clouds to maintain visibility, control, and security. Potential security scenarios are also demonstrated.

1. Building a Paper Trail:
How to secure and audit a Public Cloud
Neal Elinski | Technical Product Manager
Rok Orsic | Consulting Cloud Architect

2. ©2017 OVH US | Proprietary & Confidential
–––
VMworld disclaimer
This presentation may contain product features that are
currently under development. This overview of new
technology represents no commitment from VMware or OVH
to deliver these features in any generally available product.
Features are subject to change, and must not be included in
contracts, purchase orders, or sales agreements of any kind.
Technical feasibility and market demand will affect final
delivery. Pricing and packaging for any new technologies or
features discussed or presented have not been determined.

3. ©2017 OVH US | Proprietary & Confidential
–––
AGENDA
1. Intro and Objectives – 10min
2. Solution Detail – 20min
3. Scenarios – 20min
4. Q/A – 10min
3

4. 2017 Proprietary and Confidential
WHO IS OVH?
____
4

5. ©2017 OVH US | Proprietary & Confidential
©2017 OVH US | Proprietary & Confidential
Over 1.2 Million Business
Clients in 138 Countries
Own 11+ Tbps Network
with
32 Points of Presence
2017
27 data centers in 11
countries
2020
50 data centers
Data center capacity:
1.3 million physical servers;
260,000 already deployed
19 years experience building &
managing servers + data centers
INTRODUCING OVH – GLOBAL HYPER-SCALE CLOUD PROVIDER
* https://www.netcraft.com/internet-data-mining/hosting-analysis/
5th Largest Cloud Provider in the
world*
2016
20 data centers in 5 countries
5

6. ©2017 OVH US | Proprietary & Confidential
©2017 OVH US | Proprietary & Confidential 6
OVH BUILDS OUR OWN DATA CENTERS

7. ©2017 OVH US | Proprietary & Confidential
©2017 OVH US | Proprietary & Confidential 7
30% natural air cooling
+
70% water cooling
=
0% air conditioning
OVH USES GREEN TECHNOLOGY TO MANUFACTURE SERVERS

8. ©2017 OVH US | Proprietary & Confidential
–––
+ Dedicated Cloud
+ Virtual Private Cloud
+ Disaster Recovery
+ VMware SDDC
+ Open API
+ Automation Compatibility
+ Scalability
+ Bring you own License
+ Non-Virtual Workloads
+ Proprietary Software
Dedicated Servers
Bare Metal
Customer Support & Services
Global Hyper-Scale Reach
OVH’s Fiber Optic Network (11+ Tbps) + Anti-DDoS + Private LAN
Public Cloud
SOLUTIONS TO SUIT YOUR NEEDS
Hosted Private Cloud

9. 2017 Proprietary and Confidential
OBJECTIVES
___
9

10. ©2017 OVH US | Proprietary & Confidential
–––
COMMON REQUIREMENTS
• Layered Security
• Onion Model
• Vector-based approach focused on Network, Host, and Management security
• Least Privilege Access Model
• Archival Activity Tracking
• Anomaly Detection
10

11. ©2017 OVH US | Proprietary & Confidential
–––
HOW DO WE ACCOMPLISH THIS?
• Role-Based Access Control
• Management/End-User Segregation
• Governance
• Network Security
• Systems Security
• Audit Logging and Archival
• Mitigation and Investigation
11

12. 2017 Proprietary and Confidential
HOW DOES THIS CHANGE WHEN WE INTRODUCE
THE CLOUD?
___
12

13. ©2017 OVH US | Proprietary & Confidential
–––
CLOUD ISSUES
• Loss of control
• Depends on the model, but lose control to hardware and most management software
• Limited visibility
• The cloud company owns the special sauce and they don’t like to share
• Have to fit into given access model
• May have limited RBAC
• Multi-factor and federation are rare
• Limited toolset
• May only have limited native tools to monitor and manage
13

14. ©2017 OVH US | Proprietary & Confidential
–––
HOW TO OVERCOME LIMITATIONS
• Focus on the API
• Though low-level services may not be available, the API should be
• Focus on platform-native tools for better integration
• Work within the boundaries to segregate
• This may mean setting up service accounts for shared logged access
• Pull and archive activity offsite
• Keep records available, just like you’d treat backups
• Automate
• Governance, reporting, alerting…make it scale
14

15. ©2017 OVH US | Proprietary & Confidential
–––
TOOLS WE’LL FOCUS ON
• VMware platforms
• Access to vSphere or vCD
• Focus on VMware tools, but with options for 3rd party
• NSX
• vRealize Log Insight
• vRealize Automation
• vRealize Operations
• Where necessary, lean on 3rd party
• HyTrust
• Snort
• Antivirus (guest security)
15

16. 2017 Proprietary and Confidential
SOLUTION DETAIL
___
16

17. ©2017 OVH US | Proprietary & Confidential
–––
PLATFORM
vCloud Director:
• Tenant Access:
• VDC– Resource pools
• VMs
• Catalog
• Networking:
• Networks
• Edge Gateway
• Distributed FW
• Resource reservation
• Users & Groups
• Identity Federation
• Affinity Rules – VM level
vSphere:
Tenant Access:
• Cluster Management
• HA
• DRS
• Resource Pools
• VMs
• Catalog
• Networking:
• Access to NSX manager
• Networks
• Edge Gateway
• Distributed Routing
• Distributed FW
• Service Composer
• Users & Groups
• Identity Federation
• Affinity Rules
17

18. ©2017 OVH US | Proprietary & Confidential
–––
RBAC
vCloud Director
• Authentication:
• Local users
• SAML:
• Identity federation
• 2FA
• Login restriction based on time,
location, etc
• Auditing:
• vCD UI
• REST API
• LogInsight with the use of scripts
• Granularity
• Pre-created roles
18
vSphere
• Authentication:
• Local users
• SAML:
• Identity federation
• 2FA
• Login restriction based on time,
location, etc
• Auditing:
• vSphere UI
• LogInsight Integration
• Granularity
• Pre-created roles

19. ©2017 OVH US | Proprietary & Confidential
–––
Directory
Service
Identity
Provider
User Navigates to
vCloud Air URL
Redirect to
corporate idP
User logs in
idP posts SAML
assertion
vCloud Air Access
granted
User Accesses vCloud Air
Dedicated Cloud portal
IDENTITY FEDERATION
19

20. ©2017 OVH US | Proprietary & Confidential
–––
USER DEMO ACCESS
• Client navigates to vSphere/vCA
• Gets redirected to Identity Provider website
• Logs in with AD credentials
• Gains access to vSphere/vCA
20

21. ©2017 OVH US | Proprietary & Confidential
–––
SYSTEMS SECURITY
• Encryption at rest
• vCD and vSphere (6.x) don’t offer native encryption of data
• HyTrust DataControl will be used for vmdk encryption
• OS-level solutions (BitLocker) are also possible
• AV and HIDS recommended at system level
• Compliance software (VMware Trustpoint/Tanium) as well
• Periodic testing
• Through a 3rd party, typically via Nessus
21

22. ©2017 OVH US | Proprietary & Confidential
–––
HYTRUST DATA ENCRYPTION
• Cloud Agnostic
• FIPS approved AES-128/256 encryption for in motion and at rest data
• Multi node HyTrust Cluster support Hybrid Cloud scenarios
• Nodes running in On Premises and in Cloud Provider
• Encryption travels with VM:
• vMotion to vSphere/vCD based Cloud
• Disaster recovery
• On the fly Encryption and Rekey
• AES-Ni Hardware acceleration
• Forensic grade logging
22

23. ©2017 OVH US | Proprietary & Confidential
–––
NETWORK SECURITY
• Edge GW
• Firewall
• IDS/IPS for vCloud Air possible with the use of 3rd party appliances deployed in a HDMZ
• Distributed FW
• Micro segmentation
• FW at VM NIC level
• Centrally controlled FW
• Security Groups
• Policy follows VM when migrating to Cloud
23

24. ©2017 OVH US | Proprietary & Confidential
–––
NETSEC DEMO
• User tries to ping a new VM, but ping doesn’t work as VM is not part of any distributed FW
group
• User opens distributed firewall and views FW sections
• User adds a VM to a pre-existing group that has ICMP allowed
• VM pings
24

25. ©2017 OVH US | Proprietary & Confidential
–––
GOVERANCE
• vRA
• Built to limit user action, with option for layered approvals for XaaS operations
• Bonus: keeps a log of every user action triggered from the self-service vRA catalog forever
• SAML
• Enables organizations to set login rules
25

26. ©2017 OVH US | Proprietary & Confidential
–––
vRA DEMO
• User logs into vRA
• Available catalog items are displayed
• User deploys catalog item to vSphere/vCA
• The action is limited per approval rules
• The action is logged in multiple areas
26

27. ©2017 OVH US | Proprietary & Confidential
–––
MONITORING
27
• vROPs
• vSphere Cloud:
• vROPS as a Service
• Own installation
• Full vSphere integration
• vCloud Air:
• Own installation
• vCloud Air management pack
• Retrieves metrics from API
• Rest API

28. ©2017 OVH US | Proprietary & Confidential
–––
MONITORING DEMO
• Admin views anomaly in vCD/vCA Summary Dashboard
• Admin follows the error through vROps to determine the cause
28

29. ©2017 OVH US | Proprietary & Confidential
–––
LOGGING
• Log Insight
• Limited logging in vCD
• Task and event log accessible via UI and API
• To view tasks and events in Log Insight a script and helper VM is needed
• Syslog for EDGE GW logs
• More access in vSphere – easier to manage
• Full NSX logs
• Full vSphere logs
29

30. ©2017 OVH US | Proprietary & Confidential
–––
vCD LOG INSIGHT
30
dXpYvZ Dedicated Cloud
VMware vCloud® Air™
+06TB
Org Routed Net
Hybrid
Cloud
Manager
vCloud Air Management
Plane
Migrated Virtual Machines
VDC
Stretched VXLAN networks
OrgEdge Gateway
Log Insight
Helper VM
Rest API Pull Logs
Ingestion API Push Logs
Edge GW syslog settings

31. ©2017 OVH US | Proprietary & Confidential
–––
LOGGING DEMO
• User logs in
• Event is logged in vSphere/vCD
• Event is forwarded to LogInsight
• Display even in LogInsight
31

32. ©2017 OVH US | Proprietary & Confidential
–––
THE END SOLUTION– vCLOUD DIRECTOR
32
vDC 1
vDC 1
vCloud Air
Direct Connect
Head
Quarters
Production workloads
Dedicated Cloud
Hybrid DMZ
vDC 1
BGP
Active/
Standby
Active
MPLS/
P2P etc.
vDC N
Dedicated Cloud SID 1
Net/Sec VMs
(F/Ws, WAN opt)
Shared service VMs
(AD, DNS, Logs etc.)
OSPF, BGP
Redundant links
1/10 Gbps
INTERNET
vRA vROPS LogInsight HyTrust
Governance
Logging
Monitoring
Encryption

33. ©2017 OVH US | Proprietary & Confidential
–––
vDC 1
THE END SOLUTION – vSPHERE
33
VRACK
Connect
Head
Quarters
Production workloads
vSphere Based Cloud
BGP
Active/
Standby
Active
MPLS/
P2P etc.
Production Workloads
Net/Sec VMs
(F/Ws, WAN opt)
Shared service VMs
(AD, DNS, Logs etc.)
INTERNET
vRA vROPS LogInsight HyTrust
Governance
Logging
Monitoring
Encryption

34. 2017 Proprietary and Confidential
SCENARIOS…WHERE THE BAD STUFF HAPPENS
___
3
4

35. ©2017 OVH US | Proprietary & Confidential
–––
SCENARIO 1
Unauthorized Administrative Action
• User logs in and changes distributed FW settings
• Option 1 – User doesn't have permission and operation fails
• Option 2 – User implements the change
• Event is logged in Activity log
• Show NSX manager logs
• Show lack of logging in vCloud Air
• Show Activity log in vCD
• Events are forwarded to LogInsight
• Show NSX logs in LogInsight
• Show vCD activity in LogIsight
35

36. ©2017 OVH US | Proprietary & Confidential
–––
SCENARIO 2
Compromised VM
• Show a three tier app
• Show distributed FW rules
• One VM is compromised but can’t reach other VMs because of FW rules
• Show FW log
• VM is put into restricted group until remediation
36

37. 2017 Proprietary and Confidential
CONCLUSIONS
___
3
7

38. ©2017 OVH US | Proprietary & Confidential
–––
PUTTING IT ALL TOGETHER
• High security is possible in the cloud
• Though the provider will manage half the stack, there are ways for you to manage the other
half
• VMware tools can simplify security of vSphere or vCD based clouds
38

39. –––
Q&A

40. ©2017 OVH US | Proprietary & Confidential
–––
HOW TO CONTACT US
40
VMworld Booth Location – D313
@ovh and @vcloudair_ovh
@ovh and @vcloudair.ovh
OVH and vCloud Air powered by OVH
ovh.com

41. ©2017 OVH US | Proprietary & Confidential
–––
OVH AT VMWORLD
41
Session ID Session Title Time
LHC3295BES OVH: Why Optimizing Layer 0 matters Wednesday Sept 13th 2:00 p.m. – 3:00 p.m.
LHC2401BE How far is too far? The Hybrid Cloud Distance Factor. Tuesday Sept 12 3:30 p.m. – 4:30 p.m.
LHC3296BES Shields Up! Building a True Security Barrier in the Cloud Tuesday Sept 12th 2:00p.m. – 3:00 p.m
LHC1951BE
Automate Cloud Recovery For When You Are Nuked From
Orbit: It’s the Only Way to Be Sure
Thursday Sept 14th 9:00 a.m. – 10:00 a.m.
LHC1010BES
Open your mind: mix Private Cloud, Hybridity and Elasticity all
Together
Tuesday, Sept 12th 5:00 p.m. – 6:00 p.m.
GRC2676BE Building a Paper Trail: How to Secure and Audit a Public CloudWednesday Sept 13th 3:30 p.m. – 4:30 p.m.

42. –––
THANK YOU