This webinar discusses implementing a secure cloud for government and military organizations. It outlines some of the limitations of traditional firewalls and network segmentation approaches. The webinar proposes using network micro-segmentation, tenant isolation, application tier isolation, and defense-in-depth strategies to increase security and agility. It demonstrates how a software-defined networking approach with security groups can provide more granular access controls and isolation compared to traditional firewall rules. The webinar shows how this architecture integrated with threat management APIs could enable automated detection and remediation of security issues.

1. WEBINAR | JULY 14, 2016
Quickly Implement
a Secure Cloud for
Government and Military
Rick Kundiger
CEO & Founder
Awnix

2. 2
Security Today
* Contains 0% snake
EVERYTHING YOU NEED!
NO OTHER SECURITY REQUIRED!
HACKERS | PHISHERS | CRACKERS |SNIFFING | SPOOFING
SPAMMING | SPYING |EXPLOITING | SNARFING
SCRIPT KIDDIES |TARDS | & OTHERWISE BEING SNOWDEN’D

3. Security Today
Traditional firewalls, while better
than simple VLANs and ACLs, are
only marginally better
• Firewalls can only inspect traffic that
traverses them
• They rarely prevent server-to-server traffic
we have VLANs and ACLs for that!
(see previous slide)
• More and more rules are added as holes
are found or exploited or assumed, making
rule management nearly impossible
3

4. Security Today
• Silo’d network and security is inefficient
• Frequent miscommunication between
customer / network & security which
causes mistakes
• These errors lead to security incidents
What Customers Think of IT Security
What Customers Think of Networking
Customer to IT Security and Network
4

5. What’s Needed
• Network Micro-Segmentation
• Tenant/Project Isolation
• App Tier Isolation
• Increased Security Behind the Firewall
• Defense-in-Depth
• Increased Agility in Network and Security
• Increased Ability to Quickly Respond
Traditional physical networking and security tools, designs, appliances and
methods cannot meet these needs in a timely and cost effective manner
5

6. Security Tenant
Internet – Common Provider Network w/ public floating IPs
vFirewall
vSec UTM, IDS,
IPS, Etc.…
Security
Groups
Internal Provider Network 0 w/ private floating IPs
Web
DB
Mid-TierWeb Mid-Tier
DB
Internal Provider Network 1 w/ private floating IPs
Simple Tenant More Complex Tenant Security Tenant
6

7. App Tier Isolation
vFirewall
Mid
Mid
MidWeb Web
Web
Web Tenant Mid-Tier Tenant Security Tenant
DB DB
DB
DB Tenant
7
Internet – Common Provider Network w/ public floating IPs
Internal Provider Network 0 w/ private floating IPs
Internal Provider Network 1 w/ private floating IPs
Internal Provider Network 2 w/ private floating IPs
vSec

8. 8
Forensics
Internet – Common Provider Network w/ public floating IPs
Mid
Mid
MidWeb Web
Web
Compromised
Tenant
Mid-Tier Tenant Security Tenant
DB DB
DB
Internal Forensics Network with no Gateway to Internet
DB Tenant
Web Web
Web Sec Tool Sec Tool
vFirewall
Move
GW IP to
Forensic
Network
vFirewall
vSec
Forensics
tools for
Analysis /
Remediation

9. Integrating new or existing threat
management tools with APIs available via
the SDN Controller or Neutron for
automated remediation
IDS
consumes
SDN
metrics /
telemetry
via API
IDS
Identifies
a
Problem
IDS Sends
Instructions
via API
Instruction
is Executed
Offending
Instance or
Network
Remediated
9
Detection / Remediation

10. Security Groups vs FW Rules
• Security Groups are like a FW on every
vNIC
• If Attacker get in one server they can’t
jumpbox anywhere
• All traffic in separate encrypted domain
• Granular strategic + tactical control
• Attacker must compromise every node
individually
• If an Attacker compromises a server they
can normally jump around to others
because the internal network is “trusted”
• Attacker can sniff traffic as it isn’t
encrypted
• Blanket FW rules, no granularity
• Individual servers have little, if any
protection
10
DB
Mid-TierWeb 2
DB
Mid-TierWeb Mid-Tier
DB
Allow Mid
Allow WebAllow 80/443
Web
VLAN 234
VLAN 567
VLAN
Hopping
Packet Capture
Malicious
Payload

11. Demo
11

12. Questions?

13. Thank you!