VMworld 2010 Reporting: Security and the Cloud

Session introduced the Tenant-in-control concept. How can the cloud provider assure customers their assets are safe?

Issues for IaaS (infrastructure as a service)

Hyperjacking - installing a rogue hypervisor to take complete control. Examples are Blue Pill/SubVirt experiments.

White paper on cloud attacks; http://cseweb.used.edu/~havoc/dist/cloud sec.pdf

Regulatory requirements on cloud and virtualization are being actively developed NIST's.

Rick Brunner was talking about booting from a secure chain of trust, rooted to hardware. The concept is to establish and validate hardware and software. New generation of CPU's (Intel Westmere) with Trusted Execution Technology (TXT). TXT provides secure measures of all software which are stored in the Trusted Platform Module making the system tamper proof to prevent attacks. The TPM provides secure storage on the physical server.

vSphere ESXi supports TXT (not supported in classic) vSphere sends the TPM measurements to vCenter. vCenter allows applications to take advantage of this through an API. vCenter is the control point; can I move vms to this hardware, is it trusted?

All this is good but it is not sufficient means of ensuring security and compliance. Customers should follow vSphere hardening guidelines in addition to considering TXT.

This leads into presentation from RSA, the security devision of EMC.

In the 'demo', RSA enVision is used to query vCenter to ensure compliance. EnVision sends the information through the Advanced Data Management Layer to the RSA Archer eGRC platform.

The use case for this technology is more complex than just firewalling vms. The use case presented is "ensuring VISMA vms are executing with US-tagged resources". TXT is enabled in the bios of the hardware and a geotag is written to the TPM on the host. You enable tboot under the advanced properties of the vSphere host to ensure a trusted boot is performed.

A policy is applied at the cluster level and inherited by the virtual machine. The demo showed the customized version of RSA Archer. You can look at your FISMA compliance chart to determine the level of compliance across your Virtual Infrastructure. You can also look at compliance over a period of time.

As a cloud provider you can tier based on security offerings. For example a Gold standard complies with FISMA.

This is a solution that integrates VMware, Intel and RSA to solve security problems with utilizing cloud resources.









- Posted using BlogPress from my iPad