Friday 24 th April Keynote Presentation by Guido Appenzeller, Chief Technology Strategy Officer for Networking and Security ‘The Next Horizon for Cloud Networking and Security ’
The Next Horizon for Cloud Networking and Security Guido Appenzeller Chief Technology & Strategy Officer Networking & Security VMware
Networking is a Software Industry
Evolution of Compute vs Evolution of Networking Orchestration & Software Management Software Software Software OS OS OS OS OS OS Operating Compute Compute System Virtualization Virtualization Software System System System System CPU CPU CPU CPU Compute Mainframe / Workstation Client Server Cloud Software Software Software Software System System System System Chip Chip Chip Chip Networking 4
Revolution in Networking • Stanford Photo with quote around innovation, fossilization CONFIDENTIAL 5
Revolution in Networking 6
Evolution of Software Defined Networking Network Virtualization has Research Products & Architecture become mainstream. • • OpenFlow Overlay Networks • Operational Readiness • • Mostly in Academia Centralized Control Planes • Easy Deployment • • Experimental Service Providers & Enterprise • Operational Tools 2008 2010 2012 2014 2015 2016 Architectural Battles 7
NSX 2014 Customer & Business Momentum 400 + 70 80 % of Top Banks NSX Customers Production Deployments Adopting NSX (adding 25-50 per QTR) 8
Software Defined Network is the big moment to create the unified way of operating and teaming Operations Audit Network Security Servers Storage
Software Defined Network is the big moment to create the unified way of operating and teaming Cloud Business
The golden era of network administration is now. DevOps Mentality + Rich APIs + Scripting Network Automation Nirvana
State of Network Virtualization and SDN Virtual infrastructure 3 rd Generation Apps and Cloud
Two Tier Infrastructure Model VM or server workloads and network are separate security domains Physical Servers Physical Network Infrastructure Internet
Two Tier Infrastructure Model VM or server workloads and network are separate security domains Virtual Machines Physical Network Infrastructure Internet
Two Tier Infrastructure Model VM or server workloads and network are separate security domains Virtual Machines Virtual Infrastructure Physical Network Infrastructure Internet
Virtual Infrastructure Virtualizing the Network and Security Virtual Machines Switches (L2) Virtual Infrastructure Routers (L3) Load Balancer Firewall (Security) Physical Network Infrastructure Internet
Virtual Infrastructure What else can we do with virtual infrastructure? • End point security Virtual Machines • Monitoring/Loggin g • Key storage • PII/PCI data storage Virtual Infrastructure Physical Network Infrastructure • App Delivery • VPN • IDS/IPS • DLP Internet
Why virtual infrastructure? Security Automation Application Continuity 18
Perimeter-focused security Unconstrained Communication Little or no lateral controls inside perimeter Sophisticated attackers bypass perimeter defenses. The initial system that is compromised, is often of lowvalue. Because of a lack of internal controls, attackers can move around the data center freely and over time infect systems with sensitive data. Internet 10110100110 Attackers gather and 101001010000010 exfiltrate data over weeks or 1001110010100 even months. Data Center Perimeter 19
Micro-Segmentation Why can’t we have individual firewalls for every VM? With traditional technology, this is operationally infeasible. Physical firewalls Cost prohibitive with complex configurations Internet Virtual firewalls Slower performance, costly and complicated Data Center Perimeter 20
Secure Micro-Segmentation in the Data Center Security Policy Cloud Management Platform Internet Perimeter Firewalls 2 1
Security: Protected Domain The hypervisor can bridge the context / isolation gap Virtual Machine VM VM Endpoint Application Trusted Module Virtualization Protected Domain Trusted Secure Provision Network Module Data Keys Hypervisor Verify Signature Secure Audit 22
Microsegments as a Policy Primitive Policy & Security Load Balancer Allow TCP Port 443 Web Tier Deny All … Provision: SSL Certificate Hypervisor based IDS Firewall App Servers Allow TCP Port 80 Network Encryption to DB Hypervisor based IDS Firewall Allow TCP Port 3306 Database Allow PCI Data to be stored on this server Hypervisor based IDS
Why virtual infrastructure? Security Automation Application Continuity 24
Automation Application Workloads Virtual Infrastructure Physical Network Infrastructure Internet 25
Platform Services Enable Robust Ecosystem We expect the vast majority of this functionality to come from partners Applications and End Hosts Virtual Infrastructure Physical Network Infrastructure Internet 26
Self Service IT: Driving IT Agility Automation by IT Automation by IT Automation by IT for IT for End user for External Use Cloud Consumer Provider - Faster project on boarding - Community Cloud - Developer Cloud - Elastic Services - Services Cloud - Streamline Security Enforcement - IAAS - Mergers & Acquisition 27 27
Why virtual infrastructure? Security Automation Application Continuity 28
Hardware Refresh Viertual infrastructure decouples applications from hardware Virtual Machines Virtual Infrastructure Isolation Physical Network Infrastructure Internet
Desaster Recovery Network configuration becomes easily replicable once it is software defined Application Workloads Application Workloads Virtual Infrastructure Virtual Infrastructure Physical Network Infrastructure Physical Network Infrastructure Internet Internet Original Site Backup Site 30
State of Network Virtualization and SDN Virtual infrastructure 3 rd Generation Apps and Cloud
3rd Platform Apps How are these apps different? • Built-in scale-out • Built-in redundancy • Often stateless with state stored in a service • Build on higher level abstractions • • File system Storage Services What does this mean for • • L2+L3 Networking L3 Networking Only networking and security infrastructure? • • ADC Appliance Load Balancing Service 32
Containers Containers emerging as the application management layer of choice Application Containers VM Applications Application Containers Host Host Containers Applications Applications Applications App App App App App App App App App App App App Framework Framework Framework OS OS OS App Framework OS Hypervisor
Container Networking Enterprise Model Today VM VM Containers run inside of VMs • One VM per server per security domain Container Container Container Container Container Container Container Container • Containers often behind NAT • No container level networking Hypervisor Does this make sense? vSwitch It actually does… 34
Container Networking In the future, container level visibility VM VM Two levels of vSwitch Container Container Container Container Container Container Container Container • First layer vSwitch inside the container VM • Second layer vSwitch inside the Hypervisor vSwitch vSwitch • Container level networking Hypervisor vSwitch 35
Containers – do we still need a Hypervisor? Without a hypervisor, attackers can spread Without Hypervisor: • Attacker compromises Server Server Server container • Privilege escalation Container Container Container Container Container Container Container Container Container Container Container Container to get root access on container host • Now has direct access to the physical network vSwitch vSwitch vSwitch • Can compromise other physical hosts Physical Network Infrastructure Internet 36
Containers – do we still need a Hypervisor? Hypervisor provides a security control point With Hypervisor: Attacker can’t escalate Guest Guest Guest • from container to vSwitch Container Container Container Container Container Container Container Container Container Container Container Container • Does not gain physical network access • Ability to spread is limited Hypervisor Hypervisor Hypervisor vSwitch vSwitch vSwitch Physical Network Infrastructure Internet 37 37
Three Tier Model Containers still need virtual infrastructure Applications and End Hosts Container Container Container Container Container Container Container Container Container Container Container Container Virtual Infrastructure Physical Network Infrastructure Internet 38
Power of cloud: workload mobility
Lock-in through services Load Load Load Storage Balancin Firewall Storage Balancin Firewall Storage Balancin Firewall Service g Service Service g Service Service g Service Service Service Service
Cloud: Just new Silos? Load Load Load Storage Balancin Firewall Storage Balancin Firewall Storage Balancin Firewall Service Service Service Service Service Service g g g Service Service Service
Recommend
More recommend
