Http://aka.ms/FEEAB .
-
Upload
augusta-shepherd -
Category
Documents
-
view
215 -
download
1
Transcript of Http://aka.ms/FEEAB .
Yuri DiogenesSenior Technical WriterServer and Cloud Division Information Experience – Solutions Group
Security Enhancements in Windows Server 2012Securing the Private Cloud Infrastructure
Tom ShinderSenior Knowledge EngineerServer and Cloud Division Information Experience – Solutions Group
http://aka.ms/FEEABhttp://blogs.technet.com/security_talk
• The Importance of Security in a Private Cloud
• Private Cloud Reference Model: Infrastructure
• Private Cloud: Compute Layer• Private Cloud: Storage Layer• Private Cloud: Networking Layer• Private Cloud: Resiliency Layer• Practical Scenario
AgendaPrivate cloud Infrastructure Security
Why is Private Cloud Security Important? Customers want to know
What we will cover in this presentation?Private Cloud Infrastructure Security
Ultimate GoalAlign Windows Server 2012 security features to address core Private Cloud Security concerns by providing a secure foudation of its cloud infrastructure based on Microsoft PCRM (Private Cloud Reference Model).
Primary Considerations
Compute
Networking
Storage
Resiliency
Compute
• What if…• The Cloud Operator restarts the compute resource that I’m using and
load a malware upon the boot process?• A failure in provisioning leads to another operating system to load,
causing downtime to my workload?• There is a breach on the physical security and someone steals the
server?
• Protecting Compute Resource• Policies in place to avoid errors in security provisioning• Clean up process• SLA
Private Cloud Security ConcernPhysical Security to Compute Resources
Secure BootServer Protection
Current boot process
New boot process
Any OS could hook in load code here, including a piece of malware
If it is not valid the boot will be interrupted
UEFI Secure Boot Activation
UEFI will only load a verified (via certificate) OS
Network Unlock for BitLockerServer Protection
• Requires Windows 8, TPM, DHCP and UEFI• Allows admins to boot remote systems
without user interaction• If taken outside the trusted location (off
premise), the machine will require a PIN in order to boot
• No more trade-offs between security and power management or servicing
Storage
• What if…• Other tenants can access my data?• Data leakage occurs while at rest?
• Protecting Storage Resource• Isolation• Encryption• Auditing
Private Cloud Security ConcernStorage Security
• Secure data within deployments inside and outside of the datacenter.
• Enables IT administrator to:• Encrypt local disk storage (DAS)• Encrypt traditional failover cluster disks• Encrypt Cluster Shared Volumes 2.0
• Meets compliance demands.
Bitlocker Drive EncryptionData Protection
Demo: Encrypting a Cluster Shared VolumeTom Shinder
Scenario• Bob wants to ensure that the tenants' data
is protected while at rest• Bob wants to make sure that even if an
intruder breaches the data center and pulls a drive, the data will be inaccessible
• Bob is using Windows Server 2012 iSCSI target for failover cluster storage and CSVs
Networking
• What if…• Other tenants can access my data?• Data leakage occurs while data is in transit?• Rogue servers/traffic can disrupt my workload?
• Protecting Network Resource• Isolation• Encryption• Protection against rogue services
Private Cloud Security ConcernNetwork Security
• End-to-end encryption of SMB data in flight• Protects data from eavesdropping attacks• No need for IPSec or specialized hardware• Configured per share or for the entire
server• Can be turned on for a variety of scenarios
where data traverses trusted and untrusted networks• Branch Offices over WAN networks• Application workload over unsecured networks
SMB EncryptionNetwork Protection
Demo: Enabling and verifying SMB EncryptionYuri Diogenes
Scenario• The Private Cloud tenant read a report
saying that internal threats are still the biggest concern in network security
• The tenant has a file server on his segment that contains financial records and must be protect against eavesdropping attack launched by internal clients
Lab Environment
• Protects against a malicious VM representing itself as a Dynamic Host Configuration Protocol (DHCP) server for man-in-the-middle attacks
DHCP GuardNetwork Protection
Demo: Protecting Tenants against rogue DHCPYuri Diogenes
Scenario• The Private Cloud tenant read the paper “
A Solution for Private Cloud Security” from Microsoft and wants to ensure that his network segment is protected against rogue servers, clients and applications
• This feature allows you to specify whether the router advertisement and redirection messages from unauthorized VMs should be dropped
Router GuardNetwork Protection
• Allows you to create rules to apply to a Hyper-V switch port.
• The rule specifies whether a packet is allowed or denied on the way into or out of the VM.
Port ACLNetwork Protection
How to implement this configurationAdd-VMNetworkAdapterAcl -VMName MyVM –LocalMacAddress 12-34-56-78-9A-–Direction Both –Action Allow
Add-VMNetworkAdapterAcl -VMName MyVM –LocalMacAddress FF-FF-FF-FF-FF-FF –Direction InBound –Action Allow
Add-VMNetworkAdapterAcl -VMName MyVM –LocalMacAddress Any –Direction Both –Action Deny
Demo: Traffic isolation with Port ACLsYuri Diogenes
Scenario• The Private Cloud tenant read the paper “
A Solution for Private Cloud Security” from Microsoft and wants to ensure that traffic isolation happens not only between tenants on his Private Cloud but also within the same tenant network
• Allows you to specify whether a VM is allowed to change its source MAC address for outgoing packets.
MacAddressSpoofing Network Protection
How to implement this configurationSet-VMNetworkAdapter –VMName MyVM –MacAddressSpoofing On
Demo: Protecting against MacSpoofing attackYuri Diogenes
Scenario• The Private Cloud tenant read the paper “
A Solution for Private Cloud Security” from Microsoft and wants to ensure that his company reduces the likelihood that man in the middle attack can occur inside of a tenant’s network
• Open platform that lets multiple Partners provide extensions that arewritten to standard Windows API frameworks.
• Partners include:• Cisco: Nexus 1000V & UCS Virtual Machine Fabric Extender (VM-FEX)• NEC: OpenFlow• 5nine: Virtual Firewall 3.0
Hyper-V Extensible Switch Network Protection
Demo: Enabling Security Settings in the Hyper-V Extensible SwitchYuri Diogenes
Scenario• Contoso has plans to extend their Private
Cloud infrastructure by enabling intrusion detection in the hypervisor level.
• Cloud architect wants to understand if his current deployment has any built in capability to implement that and if not how this can be done without changing the hypervisor.
Resiliency
What happens when hardware fails?
VMs designed to handle failures (e.g. Guest Clustering) or downtime acceptable.Lower End Industry Standard Server, single infrastructure
App-Level Resiliency
Application-controlled failover / Guest clustering
Switch
Switch
Parent VMs
VMs
VMs
Parent VMs
VMs
VMs
Resiliency Approaches
Cluster
VMs not designed to handle failures, H/A at server level, Failover clustering as another layer of protection, high-end servers, redundant power and network gear
Hyper-V Failover Clustering
Infrastructure Resiliency
Parent VMs
VMs
VMs
Parent VMs
VMs
VMs
Switch
Switch
Hyper-V | Resiliency
Resi
liency Inbox Replication
Hyper-V Replica enables the replication of VMs fromPrimary to Secondary site for inbuilt Disaster Recovery
Incremental BackupsPerform agentless backup operations more quickly &easily while saving network bandwidth & disk space
Integrated NIC TeamingAggregate network adaptors to increase throughput &provide redundancy in case of link failure
Practical Scenario
Converged Datacenter Network + File Server StorageFile Server
Clu
ste
r
Sto
rag
e
Man
ag
e
SAS
Hyper-V Extensible
Switch
VM 1
Liv
e
Mig
rati
on
Clu
ste
r /
Sto
rag
e
Man
ag
e
Hyper-V Server
VM n
Datacenter Network Tenants Network
“Green Field”
• 10GbE Network(s)• File Server for VM storage
• Actual storage may be an existing FC/iSCSI SANs or JBODs+Spaces
• Highlighted features: 10GbE w/DCB, QoS, LBFO, Hyper-V over SMB, Spaces
• Note: LBFO & RDMA can’t coexist on same NICs.
10GbE1/10GbE
NIC Teaming
OS QoS
DCB
NIC Teaming
OS QoS
DCB
Use of NIC Teaming & Qos/DCB
10GbE
10GbE
SAN / JBODs
SAS
1/10GbE
Converged Datacenter Network + File Server Storage
• Documentation can be found at:http://technet.microsoft.com/en-us/library/hh831738.aspx
What about the Management Layer?
Solution for Management LayerSystem Center 2012 SP1
• Plan to embed security principles into the management layer, such as:• Role Based Access Control
• Secure provisioning and deprovisioning
• Secure elasticity
• Secure automation
Announcing
Learn more about our book athttp://blogs.technet.com/b/security_talk/archive/2013/01/22/windows-server-2012-from-end-to-edge-and-beyond-the-book.aspx
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.