vSEC pro VMware NSX

©2015 Check Point Software Technologies Ltd. 1©2015 Check Point Software Technologies Ltd.
Zabezpečení softwarově definovaných
datových center prostřednictvím Check
Point vSEC a VMware NSX
Peter Kovalčík
Security Engineer, Check Point Software Technologies

©2015 Check Point Software Technologies Ltd. 2
Hey, I can spin-up VMs
in minutes.
Why does it take
a week to get
network/firewall changes
State of Virtualization vs. Networking

DATA CENTERS
are rapidly evolving.

Virtual
Datacenter
DATA CENTER EVOLUTION
• Server (compute) virtualization
• Network operation is manual
Software
Defined
Datacenter
Private Cloud
• Network are is also virtualized
• Services can be dynamically inserted and
orchestrated via automation

THE NEW ERA OF
SOFTWARE-DEFINED DATACENTERS (SDDC)
Allowing IT to deliver applications at a fraction
of the cost and time in a more secure way!

SECURITY CHALLENGES IN THE CURRENT
DATACENTER

WEST EAST
SOUTH
NORTH
Perimeter (north-south) security is
blind to 80% of the east-west data center traffic
Challenge #1: Increasing Traffic Inside the Datacenter

• Lack of security control between VMs
• Threat can easily traverse VLANs
• Threats attack low-priority service
and then move to critical systems
Modern threats can spread laterally inside the data center,
moving from one application to another
Challenge #2: Lateral Threats Inside the Data Center

Traditional static controls fail to secure dynamic networks
and highly mobile applications
Challenge #3: Security Ignores Data Center Changes
• New Virtual Machines
• Virtual Machine movement
• VM that change IP address
• Dormant VMs that wakes up
• VMs move between VLANs

How to define secure policy for
catalog applications that have not
been provisioned and still don’t have
IP address?
Lack of security automation impacts business agility in
delivering services, results in security gaps
Challenge #4: Security Inhibits Data Center Agility

Securing SDDC - goals
 Better SECURITY
 Better MANAGED
 Better PERFORMANCE

Securing SDDC - goals
 Increased visibility and control
 DEEP inspection, CLOSE to applications
 Security is natural part of modern SDDC design
 Improved security policy management
 avoid overhead by knowing CONTEXT
 FLEXIBLE for application deployments and changes
 Performance and scalability
 SCALABLE - growing with datacenter growth
 no choke point design

Building blocks
• Automated security provisioning (new ESXi hosts
deployed with security from beginning)
• Transparent security insertion – configurable
redirection to deep inspection engine
• Cloud management systems integration into Security
Management – consume objects and state of
NSX/vCenter (using SDDC context)
• Tagging VMs with security incidents
• API and CLI for security automation and
orchestration

14©2013 Check Point Software Technologies Ltd.
Beyond L4 firewall… Users, applications,
data, known and unknown threats
GranularVisibility
Identity
Awareness
DLP
Mobile
Access
SmartEvent
Application
Control
URLF
IPS
Anti-Bot
Antivirus
Threat
Emulation
HTTPSHTTPSHTTPS
USERCHECKUCUC

WHAT IS NEEDED?

SECURITY REQUIREMENTS INSIDE THE DATA CENTER
Automated insertion and deployment of advanced threat
prevention to protect inside the data center3
Automated security provisioning to keep pace with
dynamic data center changes2
Security visibility into traffic inside the data center1

CHECK POINT & VMWARE
Automating Security inside the Data Center
+
Virtual Security with Advanced
Threat Prevention
Security Control
&
Visibility
Next Generation Networking
and security
Lateral
Threat
Prevention
Automated
Security
Provisioning

vSEC & NSX DATACENTER SECURITY
100% Software Based: Service, Network & Security
s
Segmented Data Center
Micro-Segmentation
with advanced threat
prevention
Security Orchestration
between Virtual Machines
Automation of Virtual
Network & Security
s
Consistent security for N-S
and E-W traffic
Security Control for
All Data Center Traffic

Check Point vSEC + VMware NSX
How it works

CHECK POINT vSEC DEPLOYMENT
NSX automatically provisions Check Point vSEC gateway on each host

NSX manager automatically
deploys and provisions Check
Point vSEC Gateway on each host
CHECK POINT vSEC AUTO-DEPLOYMENT

Automatically & instantly
scale vSEC to secure VMs
on new host members
CHECK POINT vSEC AUTO-DEPLOYMENT

Use NSX to segment Virtual Machines
into different Security Groups using a flat network
MICRO-SEGMENTATION
Finance Legal
Web
Database
Partners
NSX Security Group

Use Check Point vSEC to control traffic access between Virtual
Machines
EAST-WEST SECURITY CONTROL
NSX Service Chain Policy
Traffic from Partner to Legal
Security Group must go through
Check Point vSEC Gateway

Use vSEC for Advanced Threat Prevention inside data center
PREVENT LATERAL THREATS

APPLICATION-AWARE POLICY
Check Point Access Policy
Rule From To Service Action
3
WEB_VM
(vCenter Object)
Database
(NSX SecGroup)
SQL Allow
Use Fine-grained security policies tied to NSX Security Groups
and Virtual Machine identities
Check Point dynamically
fetches objects from NSX
and vCenter

SHARED-CONTEXT POLICY
NSX Policy
From To Action
Infected VM
(Tagged by Check Point)
Any Quarantine
Shared security context between vSEC and NSX Manager to
automatically quarantine and trigger remediation by other services
Check Point tags
infected Virtual Machines
in NSX manager

UNIFIED MANAGEMENT
Use Check Point unified management for consistent policy control
and threat visibility across virtual and perimeter gateways

Use Check Point SmartEvent to monitor and investigate threats
across north-south and east-west traffic
THREAT VISIBILITY INSIDE THE DATACENTER
4800
12400
Infected Virtual Machines
VM Identity Severity Date
VM_Web_22 High 3:22:12 2/4/201
VM_DB_12 High 5:22:12 2/4/201
VM_AD_15 Medium 5:28:12 2/4/201
VM_SAP_34 Medium 7:28:12 2/4/201

©2015 Check Point Software Technologies Ltd. 35[Confidential] For designated groups and individuals
Feature Check Point
Policy
Management Unified management for Virtual and physical Gateways
Datacenter policy segmentation with sub policies*
Fetch vCenter and NSX objects for use in Check Point policy
Security
Threat Prevention with multi-layered defenses for Virtual Data
Center
Tag infected VM and update NSX for automatic remediation
Visibility &
Forensics View VM objects in security logs
Comprehensive Datacenter Threat Visibility
Automation &
Orchestration Granular privilege down to individual rule for trusted integrations*
Check Point vSEC Key Features
* Available in R80

LIVE DEMO

SUMMARY

vSEC & NSX DATACENTER SECURITY
100% Software Based: Service, Network & Security
s
SDDC
Software Defined
Datacenters
Security Orchestration
between Virtual Machines
Automation of Virtual
Network & Security
s
Consistent security for N-S
and E-W traffic
Security Control for
All Data Center Traffic
Software
Defined
Datacenter
Private Cloud

Backup slides

NSX Security Group

NSX Security Group - definition

NSX and vCenter in Check Point

Data Center Objects Group

CP Network Introspection Service

Service Deployments

Running as Service VM (ESX Agent)

NSX DFW does redirection to CP

by Security Policy
applied to Security Group

Granular CP policy

Data Center Object identity acquisition

Botnet incident

…is translated to VM Security Tag

vSEC pro VMware NSX

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to vSEC pro VMware NSX

Similar to vSEC pro VMware NSX (20)

More from MarketingArrowECS_CZ

More from MarketingArrowECS_CZ (20)

Recently uploaded

Recently uploaded (20)

vSEC pro VMware NSX