Automated Security for the Real-time Enterprise with VMware NSX and Trend Micro Deep Security

transcript

Chris Van den AbbeeleKelly McBrair

SAI3313BUS

#VMworld #SAI3313BUS

Automated Security for the Real-Time Enterprise with VMware NSX and Trend Micro Deep Security

Welcometo:AUTOMATEDSECURITYFORTHEREAL-TIMEENTERPRISEWITHVMWARENSXANDTRENDMICRODEEPSECURITY[SAI3313BUS]Presenter:ChrisVandenAbbeele,GlobalSolutionsArchitect,TrendMicroPresenter:KellyMcBrair,ITInfrastructureArchitect,PlexusCorp

JoinusWednesdayat11amfor:SKIPTHESECURITYSLOWLANEWITHVMWAREONAWS[SAI3316BUS]Presenter:BryanWebster,PrincipalArchitect,TrendMicroPresenter:Dharmesh Chovatia,LeadArchitect,GlobalCTOOffice,CapgeminiUS

VisittheVMwareSolutionExchangefora30DayTrialofTrendMicro™DeepSecurityhttps://www.trendmicro.com/product_trials/download/index/us/123

Visittrendmicro.com/vmware

Followus@trendmicro

AutomatedSecurityfortheReal-timeEnterprisewithVMwareNSXandTrendMicroDeepSecurity

KellyMcBrair,ITInfrastructureArchitect,PlexusCorp.ChrisVanDenAbbeele,GlobalSolutionArchitect,TrendMicro

CustomerPerspective

PlexusMarketSectorsExclusivelyfocusedinmarketsectorsthatrequiremid-to-lowvolumehighercomplexityvaluestreamsolutions

Communications Healthcare/LifeSciences

Industrial/Commercial

Defense/Security/Aerospace

TrendMicro

§ 28yearsfocusedonsecuritysoftware§ HeadquarteredinJapan,TokyoExchangeNikkeiIndex (4704)§ Annualsalesover$1BUS§ Customersinclude45oftop50globalcorporations§ 5500+employees inover50countries

500kcommercialcustomers&155M endpointsprotected

SmallBusiness

MidsizeBusiness

Enterprise

Consumer

Consumers

Agenda

• Introductions

• Automatedsecurity:From“boltedon”to“partofthefabric”

• TheBusinessCaseforAutomatedVirtualPatching

• Solvenewproblems

• IntegrationwithvRealizeOperations

• Deploymentlessonslearned

Integratedsecurity:From“boltedon”to“partofthefabric”

Visibility

Riskassessment Protect MoneyMaintainContextVisibility

What’stheproblemwith“boltedon”security?• Withtheintroductionofvirtualization,wemadeaquantumleapinOperations.

ThesameishappeningwithNWvirtualization.Butinmanycases,Security,remainedstuckintheDarkAges.Securityisstillsomethingthatisappliedafterwards.

• Weneedto“shiftleft”securityandintegrateitintheautomation• Intoday’sreal-timeenterprise,theOperationsteamhastodomorewithless,

everyday.Theycreatemorenewworkloadsthaneverbefore.• Manuallyaddingthesecuritycontrols,takesalotoftimeanditisoften

postponed(and/orfinally...“forgotten”)• ManySecurityDashboardsonlyshowworkloadswhichhadbeenbrought

underthecontroloftheSecuritySolution(andhaveasecurityagentinstalledonthem).

• ShadowITcanremaincompletelyundertheRADAR

Contextofnewsystems

Riskassessment Protect MoneyMaintainVisibility Context

Event-basedtaskstoprofilenewsystems

EstimatetheRisk

Protect MoneyMaintainContextVisibility Riskassessment

SomeHighRiskVulnerabilities

Riskassessment

Protectingnewsystems

MoneyMaintainContextVisibility Protect

TheSameExploits...nowProtectedbyDeepSecurity

8layersofsecurity:- Anti-Malware- WebReputation- Firewall- IntrusionPrevention- IntegrityMonitoring- LogInspection- ApplicationControl- ProtectionforSAP

systems(NW-VSI)

Full,multi-layeredsecurity

ProtectRiskassessment

Maintainconsistency

MoneyContextVisibility Maintain

IntegrityMonitoringMonitorsensitivefilesandsensitiveregistrykeysforchanges

ApplicationControl:“Freezes”theserverandblocksnewexecutablesandscriptsfromrunning

Protectagainstdrift:

Protectagainstthelatestvulnerabilities:Scheduled“Vulnerability”Scans

Reducedeploymentcomplexity

RichAPIsettointegratewithvirtuallyanyorchestrationandautomationtools

PowerShell

TheBusinessCaseForAutomatedVirtualPatching

Typicalpatchcyclewithoutvirtualpatching

TypicalpatchcyclewithoutVirtualPatching

MonthlySecurityPatching Half-yearlyFullPatching

12xpatching/year

High-impactzerodaysrequireimmediateattention

– Arewevulnerable?(risk?)– Who canprovideapatch?– Whencanwehavethepatch?– Whencanwetestit?– Whocantestit(team?)– Wherecanwetestit?(testenvironment)

– WhencanwehaveamaintenancewindowtoPatchandRebootourservers?

Typicalpatchcyclewithvirtualpatching

Typicalpatchcyclewith VirtualPatching

Half-yearlyFullPatching

2xpatching/year

AutomatedOngoingSecurityPatching

Win-Win:increasessecurity+reducescost

5daysafterShellShock:766attacksblocked(Customerexample)

766attacksblockedbyDeepSecurityAutomatedVirtualPatchingonSept30th,atacustomermanaging100+instancesIfEmergency(physical)Patchingtakes5days...

SolveNewProblems

WhyVMwarewithNSXandTrendMicroDeepSecurity?

TableStakes• Performance• Security• Cost

NextPlay• IntegrationandChoice• FlexibilityandInnovation

NISTCybersecurity Framework

Identify Protect Detect Respond Recover

• AssetManagement• Business

Environment• Governance• RiskAssessment• RiskManagement

Strategy

• AccessControl• Awarenessand

Training• DataSecurity• Information

ProtectionProcessesandProcedures

• Maintenance• Protective

Technology

• AnomaliesandEvents

• SecurityContinuousMonitoring

• DetectionProcesses

• ResponsePlanning• Communications• Analysis• Mitigation• Improvements

• RecoveryPlanning• Improvements• Communications

SecurityDashboard

Firewall

Antivirus

VulnerabilityScanning

IDS SIEM

Monitoring

DataRecovery

DisasterRecovery

DisconnectionManagement

SecurityIncidentResponse

• LeverageSyslog,SNMP,Emailand/orvRealize SuiteforBetterIntegrationwithExistingMonitoring/AlertingTools

• IsolateVMTaggedbyDeepSecuritywithNativeNSXFirewalling• Behavior-basedfirewalling,blockinternetphonehome,preventRGE

• TakeActiononVMTaggedbyDeepSecuritywithVMwareOrchestrator• Snapshotsandclones,preparerestores,performadditionalscanning

ExamplevideoofautomatedVMsnapshotandWireshark tap(withcode):http://www.storagegumbo.com/2014/09/automation-multi-action-security.html

• SeetheTrendThreatEncyclopediaforexamplesofHigh,MediumandLowthreats:http://trendmicro.com/vinfo

• FindsamplecodeatTrend’sDSGithub repo:https://github.com/deep-security

AutomatedResponsetoImproveProtection

IntegrationwithvRealizeOperations

Usercall- VMslowtorespond…

or…Administratorreceivesasecurityalert

LogTicket

AdminlogsintovRealizeOperations

AdminlogsintoDeepSecurityManager

• AttempttovMotion

• ReboottheVM• RecycletheVM

• Changerulestoblockspecificports

• Quarantineandscan

RootCauseAnalysis

CloseTicket

VirtualInfrastructureAdministrator

SecurityAdministrator

Isolatedworlds...

SinglepaneofglassForTrendMicroeventsandVMwareevents

CorrelatevRopsEventswithSecurityEvents

DeploymentLessonsLearned

ReadTrend’sBestPracticesGuide(Notesizing,testing,recommendations):https://help.deepsecurity.trendmicro.com/best-practice-guide.html

ConsiderAdditionalDistributionPointsand/orManagersoverWANTroubleshootDeepSecurityVirtualAppliancesasCattlePlanYourRules:Firewall,Affinity,Restart,etc.

Agentsarestillneeded(today)for:• Server2016and*nixVMs• Someadvancedfeatures• (recommendation)Windows-basedVMwareComponentsandSupporting

SystemsthatmaystartupbeforeTrendDeepSecurityManager(i.e.itsDB)

TipsandThingsYouShouldKnow

GuestIntrospectionDriversandTroubleshooting:https://kb.vmware.com/kb/2094261

VMwareToolsVersionsandUpgradeshttps://packages.vmware.com/tools/index.html (Bewareofv10.0.0-10.0.7)https://kb.vmware.com/kb/1014508 (CorrelateversionsfiletoESXi Build)

AutomatetheUpgradewith:/v“/qn ADDLOCAL=ALLREMOVE=Hgfs,NetworkIntrospection”Note:NetworkIntrospection removaloptionalAddREBOOT=ReallySuppress topreventanyreboots

GettoKnowVMwareTools

Summary

HopefullythispresentationhasprovidedafewinsightsandpracticalexamplesonhowtobringyourHybridCloudSecurityintothe21st century.

Byautomatingandintegratingsecurityintheoperationsstack,youcangreatlyimproveyoursecuritypostureandreduceoperationalcosts

DothesamesetupanddemoyourselfintheVMworld HandsonLabsLABHOL-1841

Summary

JoinusWednesdayat11amfor:SKIPTHESECURITYSLOWLANEWITHVMWAREONAWS[SAI3316BUS]Presenter:BryanWebster,PrincipalArchitect,TrendMicroPresenter:Dharmesh Chovatia,LeadArchitect,GlobalCTOOffice,CapgeminiUS

VisittheVMwareSolutionExchangefora30DayTrialofTrendMicro™DeepSecurityhttps://www.trendmicro.com/product_trials/download/index/us/123

Visittrendmicro.com/vmware

Followus@trendmicro