Downloaded 13 times
Uploaded byAlgoSec
SDN's managing security across the virtual network final
The document discusses managing security in software-defined networking (SDN) across various cloud environments, emphasizing the need for proper management to enhance security. It highlights common challenges such as visibility, responsibility blurring, and the importance of consistent security controls across hybrid cloud setups. Recommendations include adopting automation, unified management, and evaluating cloud security controls tailored to specific needs.
More Related Content
Similar to SDN's managing security across the virtual network final
![20260201 [FOSDEM] gomodjail - library sandboxing for Go modules.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/20260201fosdemgomodjail-librarysandboxingforgomodules-260201225659-76609ec4-thumbnail.jpg?width=640&height=640&fit=bounds)
![谷歌留痕技术教程[ 𝙩𝙤𝙥 𝟮𝟯𝟯. 𝙘 𝙤𝙢 ]](https://cdn.slidesharecdn.com/ss_thumbnails/top233-260130173900-2eb784f9-thumbnail.jpg?width=640&height=640&fit=bounds)
SDN's managing security across the virtual network final
- 1. SDN: MANAGING SECURITY ACROSSTHE VIRTUAL NETWORK Omer Ganot Product Manager, AlgoSec
- 2. WELCOME Have a question?Submit it via the chat This webinar is being recorded! Slides and recording will be sent to you after the webinar 2
- 3. Layer of Abstraction InfrastructureData Panel Infrastructure Control Panel WELCOME TO THE SOFTWARE-DEFINED WORLD Northbound APIs Southbound APIs Applications Platform APIs
- 4. Private Cloud SDN CANEXIST ON Public Cloud
- 5. IMAGINE A FUTUREWHERE NETWORK SECURITY HAS… No visibility into the network No boxes with “blinking lights” that inspect traffic No login screen to configure policy (just APIs)
- 6. GREAT SCOTT!!! That’s notsecure at all…
- 7. Which SDN brands(private and public) are you using in production? • VMware NSX • Cisco ACI • Amazon Web Services (AWS) • Microsoft Azure • Google Cloud Platform (GCP) Please vote using the “votes from audience” tab in your BrightTALK panel
- 8. SOFTWARE DEFINED NETWORKINGCAN BE More secure More adaptive More agile
- 9. Assuming…. you can manageit properly You can spend more time defining policy and less time enforcing policy
- 10. Through 2019, 80%ofcloud breaches will be due to customer misconfiguration, mismanaged credentials or insider theft, not cloud provider vulnerabilities. 80%
- 11. For many companies, thefuture has already arrived
- 12. Most companies willgradually evolve to this future or are already hybrid. Your Logo Here
- 13. HOW DOES NETWORKSECURITY WORK IN THE CLOUD?
- 14. Shared responsibility- Infrastructure security-by the cloud provider Application security- by the customer Your good old perimeter security (FW, IPS, SWG) SECURITY BOUNDARIES Private CloudPublic Cloud
- 15. SECURITY IN THECLOUD Cloud Security Groups Abstracted firewalls at the network fabric level. Free and very flexible, but different for every cloud provider and (currently) do not provide advanced functionality Virtual Firewalls 3rd party commercial next-generation firewalls designed for the cloud. Familiar usage patterns, some already became “cloud-friendly” (data center objects) Host Agents Host agents that utilize existing host-based firewalls. Work across clouds and provide some advanced functionality, but add cost and management overhead
- 16. HYBRID CLOUD CHALLENGES •Visibility • Different configurations and security controls on each side • Ensuring consistency • Blurring responsibilities between teams
- 18. SECURITY FUNDAMENTALS STAYTHE SAME Monitoring Least privileged Change management Risk analysis (Micro) Segmentation Governance Compliance
- 19. What is your primarymotivation for deploying PUBLIC Cloud IaaS?
- 20. VMWARE NSX ANDCISCO ACI MODELS
- 21. DYNAMIC OBJECTS ANDTAGS Simplifies policy definition BUT complicates policy visualization • Great inside the data center but what happens outside? • Can you keep up? • Open up wide nets?
- 22. NETWORKS THAT SPANMULTIPLE DATA CENTERS Good for policy definition; Bad for policy visualization • Need network AND application joint visualization approach • Need to verify consistency of edge definitions • Compliance
- 23. APPLICATION CONNECTIVITY DEFINITION Goodfor policy definition; Bad for policy visualization • Match to actual policy is not always automatic, no way to enforce • Compliance is hard
- 24. ISLANDS OF SDNAUTOMATION
- 25. ISLANDS OF SDNAUTOMATION A software controlled data center can be sleek and automated • How do you extend your policy to rest of the network ?
- 26. ISLANDS OF SDNAUTOMATION Bad for policy visualization and policy automation beyond the data center
- 27. FIREWALL VENDORS SUPPORTDYNAMIC OBJECTS What about the others? Mostly in cloud firewalls
- 28. RECOMMENDATIONS • Network Securityimplementation in the cloud is different (If you’re doing the same things you are doing it wrong) • Evaluate cloud security controls and pick the best one for your needs • Get cloud experts on the network security team • Automation is a must • Unified management across hybrid environment is a must
- 29. MORE RESOURCES 29 www.algosec.com/resources WHITEPAPERDATASHEET PPT Prof. Wool Educational Videos
- 30. UPCOMING WEBINARS https://www.algosec.com/webinars Topic: ApplicationVisibility Across the Security Estate–The Value & the Vision When: Tuesday, June 5 Presented by: Jonathan Gold-Shalev, Senior Product Manager Topic: Securely Managing External Network Connections — Tips & Tricks When: Tuesday, June 12, Presented by: Prof. Avishai Wool, CTO ---Sign up now ---
- 32. THANK YOU! Questions canbe emailed to marketing@algosec.com
Editor's Notes
- #2 https://www.brighttalk.com/webcast/11873/273869?utm_campaign=knowledge-feed&utm_source=brighttalk-portal&utm_medium=web
- #4 Public cloud is also a type of an SDN infra, as you can use its APIs to configure its networking and security
- #5 Public cloud is a form of SDN
- #6 No visibility- Various constructs that are not existing on the regular network Can’t connect directly to boxes, but only to mgmt. No UI. Only API
- #7 Problem, but opportunity The control is not in the hand of the security team. In the networking team, not necessarily 1st priority
- #9 Re secure- better segmentation Adaptive- do changes in network as needed. Some network was attacked- can isolate, fix and re-deploy Agile- Deploy faster. not dependent on changing policy on multiuple different boxes- AlgoSec can make it faster
- #10 Intent-based- graphical is easy. Complexity and understanding it isn’t easy- Many types of policies. You need a tool to manage all of this as it’s complicated
- #11 On-prem- proably 95% Most of the risk remains in the configuration- because it’s not simple
- #12 Public cloud What they doing today in the DC
- #13 Hybrid for most of us. New DC in the cloud (private/public), while we’ll still see many years remaining with on-prem DCs for various reasons such as legacy HW or SW, price, proving things before full velocity in the cloud
- #15 Public- Infra security- should be secure Private- you’re in charge of everything (infra and application) SWG- Secure Web Gateway IPS- Intrusion prevention systems (IPS), also known as intrusion detection and prevention systems (IDPS), are network security appliances that monitor network or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, report it and attempt to block or stop it.
- #16 Cloud security controls- SGs, dist. FW in NSX. Controlled by the APIs that manage the system. Built in the fabric. In public cloud- it is provided for free. SDN- NSX and ACI- not free. OpenStack- free for built in controls. Sub-flavor- virtual firewall Virt FWs- used to be at edges, now at the VM level. Good old functionality and additional functionality to land on cloud Host agents- Illumio. Own iptables, Windows firewalls. Runs on the platform itself. Good for very fragmented subnets. Hard to define objects that will cover all those frgaments
- #17 Visibility- many types of systems. Hard to define a consistent policy Responsibility- multiple Networking team-security team, security team-cloud/virt. DC team
- #18 What is your biggest challenge moving to the cloud Controls and teams are different Visibility The need for integrated NSPM
- #19 Monitoring- important, even more as of the greater rate of change and ppl Segmentation- better and easier in SDNs => easier governance and compliance. Assuming cloud provider takes care of underlying certification and compliance
- #20 Being able to quickly deploy apps and security is the most important reason for choosing cloud
- #22 Dynamic objects allow to logically define groups of machines that should get the same policy. You can abstract the subnets and use tags. VMs add/remove dynamically. But targets are not only in the virt. DC. Possible resolution- open wide subnets Synchronize the data center objects of the north-south firewalls and the Data Center (east-west) firewalls to allow external users to reach the internal resource. Problematic for hybrid network with multiple brands. Partner reaching on-perm via VPN that then leads to the cloud
- #23 Great protocols like VXLAN- network that can span across multiple DCs. One policy for all. Hard to understand what goes where. Not enough to see only the app layer or the network layer. Need to see both. Edge definitions- 2 or more DCs that connect to each other- infra configuration that affects the outcome of those flows Compliance- everything is configured and compliant
- #24 Able to define app. Connectitvity in a declarative fashion Easy to initially define, hard to understand visibility Match- those using 3rd party FWs, plugins, or edge integration with this infra. As long as the config with the SDN infra works as it allows- good. But if you want flexibility tailored to your needs- hard
- #25 OS, NSX and ACI doing great job of enhancing their infra
- #27 Partner networks, campus, On-perm, etc. Different policies. Hard to automate across the entire org.
- #28 There may be additional. Need mgmt. system that knows to fetch these objects When you make a change on dynamic objects on cloud-typed FWs, what happens for objects on on-prem firewalls- do they all have these objects? Right now no cohesive way to do that over the entire org. We’ll be happy to help with that
- #29 The OOB cloud security controls come with some good capabilities Automation is a must- for agility, efficiency and cost. If you’re not doing that, you’re utilizing half the value Unified- cohesive controls and visibility . Otherwise you'll have issues securing and automating