Solve the paradox Less Downtime More Security LinuxCon Berlin, - PowerPoint PPT Presentation

Solve the paradox Less Downtime – More Security LinuxCon Berlin, Germany October 4, 12:10 – 13:00 Hannes Kühnemund SUSE Product Management

Downtime Considerations for your digital architecture Take a holistic approach … - End-users (Business) are interested service availability - Application, OS, Cluster, VM, Server, Network, Storage, People, Processes... ... because we understand that components will fail, ... - Failure tolerant architecture, identify weak links ... acceptance of any downtime is decreasing and it is critical to ... - Seek to reduce both planned and unplanned service downtime ... strike a balance. - Cost of IT continuity vs. business impact 2

Downtime Quiz planned Regular cadence - monthly - quarterly - yearly On the weekend In alignment with all stakeholders Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 3

Downtime Quiz planned unplanned Regular cadence - monthly - quarterly - yearly On the weekend In alignment with all stakeholders Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 4

Downtime Quiz planned unplanned Regular cadence No cadence - monthly - quarterly - yearly On the weekend In alignment with all stakeholders Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 5

Downtime Quiz planned unplanned Regular cadence No cadence - monthly - quarterly - yearly Usually on Christmas Day On the weekend In alignment with all stakeholders Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 6

Downtime Quiz planned unplanned Regular cadence No cadence - monthly - quarterly - yearly Usually on Christmas Day On the weekend No alignment with stakeholders In alignment with all stakeholders Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 7

Downtime Quiz planned unplanned Regular cadence No cadence - monthly - quarterly - yearly Usually on Christmas Day On the weekend No alignment with stakeholders In alignment with all stakeholders Only one particular problem fixed Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 8

Downtime Quiz planned unplanned Regular cadence No cadence - monthly - quarterly - yearly Usually on Christmas Day On the weekend No alignment with stakeholders In alignment with all stakeholders Only one particular problem fixed Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with Optimizable with - Various technologies available - SUSE Manager 9

Minimize Unplanned Downtime RAS System UPS Rollback High Availability Virtualization and GEO RAID Load Balancer Live Patching 10

Strike the balance? 11

Strike the balance? Security No Downtime 12

Since 2005, more than 75 data breaches in which 1,000,000 or more records were compromised have been publicly disclosed. But what about the non-disclosed ones? 13

Vulnerabilities Year # vulnerabilities 10000 2010 4258 8000 2011 3532 6000 2012 4347 4000 2013 4794 2014 7038 2000 2010 2011 2012 2013 2014 2015 2015 8822 Rank Operating System # vulnerabilities 2015 Vulnerability type 2015 1 Apple OS X 384 Operating 28% 2 Microsoft Windows Server 2012 155 System 38% Browsers 3 Canonical Ubuntu Linux 152 Mobile Devices 4 Microsoft Windows 8.1 151 ... Applications 18% 16% 11 The Linux Kernel 77 Source: [http://www.cvedetails.com] & [https://nvd.nist.gov/] & [http://www.gfi.com/blog/2015s-mvps-the-most-vulnerable-players/] 14

In a data center, not so long ago … 15

In a data center, not so long ago … Linux Kernel Nov-11, 2015 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 16

In a data center, not so long ago … Linux Kernel Nov-11, 2015  CVE-2015-6937  CVE-2015-7872  CVE-2015-7990 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 17

In a data center, not so long ago … Linux Kernel CVE: Common Vulnerabilities and Exposures Nov-11, 2015 It is a standard naming scheme used by the NVD  CVE-2015-6937  CVE-2015-7872  CVE-2015-7990 NVD: National Vulnerability Database (https://nvd.nist.gov/) July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 18

In a data center, not so long ago … Linux Kernel Nov-11, 2015  CVE-2015-6937  CVE-2015-7872  CVE-2015-7990 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 19

In a data center, not so long ago … Linux Kernel Reboot Nov-11, 2015  CVE-2015-6937 Linux Kernel  CVE-2015-7872 Dec-11, 2015  CVE-2015-7990 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 20

In a data center, not so long ago … Linux Kernel Nov-11, 2015  CVE-2015-6937 Linux Kernel  CVE-2015-7872 Dec-11, 2015  CVE-2015-7990  CVE-2016-0728  CVE-2016-0728 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 21

In a data center, not so long ago … Linux Kernel Nov-11, 2015  CVE-2015-6937 Linux Kernel  CVE-2015-7872 Reboot Dec-11, 2015  CVE-2015-7990  CVE-2016-0728  CVE-2016-0728 Linux Kernel Jan-15, 2016 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 22

In a data center, not so long ago … Linux Kernel Nov-11, 2015  CVE-2013-7446 Linux Kernel  CVE-2015-6937 Dec-11, 2015  CVE-2015-7872  CVE-2015-7990  CVE-2013-7446  CVE-2015-8019 Linux Kernel  CVE-2015-8019  CVE-2015-8539 Jan-15, 2016  CVE-2015-8539  CVE-2015-8660  CVE-2015-8660  CVE-2016-0728  CVE-2013-7446  CVE-2016-0728  CVE-2015-8019  CVE-2015-8539  CVE-2015-8660 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 23

In a data center, not so long ago … Linux Kernel Nov-11, 2015  CVE-2013-7446 Linux Kernel  CVE-2015-6937 Dec-11, 2015  CVE-2015-7872  CVE-2015-7990  CVE-2013-7446  CVE-2015-8019 Linux Kernel  CVE-2015-8019 Reboot  CVE-2015-8539 Jan-15, 2016  CVE-2015-8539  CVE-2015-8660  CVE-2015-8660  CVE-2016-0728  CVE-2013-7446  CVE-2016-0728 Linux Kernel  CVE-2015-8019 Feb-10, 2016  CVE-2015-8539  CVE-2015-8660 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 24

In a data center, not so long ago … Linux Kernel Nov-11, 2015  CVE-2013-7446 Linux Kernel  CVE-2015-6937 Dec-11, 2015  CVE-2015-7872  CVE-2015-7990  CVE-2013-7446  CVE-2015-8019 Linux Kernel  CVE-2015-8019  CVE-2015-8539 Jan-15, 2016  CVE-2015-8539  CVE-2015-8660  CVE-2015-8660  CVE-2015-8709  CVE-2013-7446  CVE-2015-8709 Linux Kernel  CVE-2015-8812  CVE-2015-8019  CVE-2015-8812  CVE-2015-8816 Feb-10, 2016  CVE-2015-8539  CVE-2015-8816  CVE-2016-0728  CVE-2015-8660  CVE-2016-0728  CVE-2015-8709  CVE-2016-0774  CVE-2015-8709  CVE-2016-0774  CVE-2015-8812  CVE-2016-2384  CVE-2015-8812  CVE-2016-2384  CVE-2015-8816  CVE-2015-8816  CVE-2016-0774  CVE-2016-0774  CVE-2016-2384  CVE-2016-2384 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 25

In a data center, not so long ago … Linux Kernel Nov-11, 2015  CVE-2013-7446 Linux Kernel  CVE-2015-6937 Dec-11, 2015  CVE-2015-7872  CVE-2015-7990  CVE-2013-7446  CVE-2015-8019 Linux Kernel  CVE-2015-8019  CVE-2015-8539 Jan-15, 2016  CVE-2015-8539  CVE-2015-8660  CVE-2015-8660  CVE-2015-8709  CVE-2013-7446  CVE-2015-8709 Linux Kernel  CVE-2015-8812  CVE-2015-8019 Reboot  CVE-2015-8812  CVE-2015-8816 Feb-10, 2016  CVE-2015-8539  CVE-2015-8816  CVE-2016-0728  CVE-2015-8660  CVE-2016-0728  CVE-2015-8709  CVE-2016-0774 Linux Kernel  CVE-2015-8709  CVE-2016-0774  CVE-2015-8812  CVE-2016-2384  CVE-2015-8812 Mar-22, 2016  CVE-2016-2384  CVE-2015-8816  CVE-2015-8816  CVE-2016-0774  CVE-2016-0774  CVE-2016-2384  CVE-2016-2384 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 26