Shields Up! Building a True Security Barrier in the Cloud
•Download as PPTX, PDF•
0 likes•544 views
Chris Romano, Principal Solutions Engineer at OVH US, presented "Shields Up! Building a True Security Barrier in the Cloud" at VMworld 2017 in Las Vegas and Barcelona.
Recommended
Recommended
More Related Content
What's hot
What's hot (19)
Similar to Shields Up! Building a True Security Barrier in the Cloud
Similar to Shields Up! Building a True Security Barrier in the Cloud (20)
Recently uploaded
Recently uploaded (20)
Shields Up! Building a True Security Barrier in the Cloud
- 1. 2017 Proprietary and Confidential2017 Proprietary and Confidential OVH: Shields Up! Building a True Security Barrier in the Cloud ––– Chris Romano | Principal Systems Engineer @Virtualirishman
- 2. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– VMworld disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitment from VMware or OVH to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new technologies or features discussed or presented have not been determined. 2
- 3. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– AGENDA 1 OVH – Who We Are 2 OVH Product Overview 3 Defense at the PERIMETER DDOS Mitigation 4 Defense WITHIN the Virtual Data Center 6 Securing the Extended Data Center 7 Q & A 3
- 4. 2017 Proprietary and Confidential ––– WHO IS OVH
- 5. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– OVH is a global, hyper-scale cloud provider that offers our customers maximum performance and value • Vertical integration (constructing own servers, data centers) and proprietary green water cooling technology allows OVH to save costs and pass savings to customers • Named largest hosting & cloud provider in Europe and third largest global hosting provider by Netcraft https://www.netcraft.com/internet-data-mining/hosting-analysis/ 5 OVH GROUP HIGHLIGHTS
- 6. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– 6 Over 1.2 Million Business Clients in 138 Countries Own 11+ Tbps Network with 32 PoPs 2016 20 data centers in 5 countries and 4 continents 2017 27 data centers in 11 countries 2020 50 data centers Hosting capacity: 1.3 million physical servers 270,000 already deployed OVH IS A GLOBAL CLOUD LEADER
- 7. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– OVH BUILDS ITS OWN DATA CENTERS 7
- 8. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– 30% natural air cooling + 70% water cooling = 0% air conditioning OVH MANUFACTURES SERVERS & USES GREEN TECHNOLOGY 8
- 9. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– + Dedicated Cloud + Virtual Private Cloud + Disaster Recovery + VMware SDDC + Open API + Automation Compatibility + Scalability + Bring you own License + Non-Virtual Workloads + Proprietary Software Dedicated Servers Bare Metal Customer Support & Services Global Hyper-Scale Reach OVH’s Fiber Optic Network (11+ Tbps) + Anti-DDoS + Private LAN Public Cloud SOLUTIONS TO SUIT YOUR NEEDS Hosted Private Cloud 9
- 10. ©2017 OVH US | Proprietary & Confidential ––– NETWORK CAPACITY 11+ Tbps 10
- 11. 2017 Proprietary and Confidential ––– WHY WE ARE HERE
- 12. 2017 Proprietary and Confidential ––– DEFENSE AT THE PERIMETER
- 13. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– Domain name provider Dyn suffered the largest DDoS attack in history on Oct. 21 DYN DDOS ATTACK - OCTOBER 21, 2016 13
- 14. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– MEANWHILE IN ROUBAIX 1 MONTH EARLIER……. Each day OVH detects and mitigates over 1500 attacks against its customers’ servers. About one third of these attacks are "SYN flood" attacks. 1 Tbps DDoS Attack Launched from 152,000 Hacked Smart Devices This is likely the largest DDoS attack ever reported. Reference Article: https://www.ovh.com/us/news/articles/a2367.the-ddos-that-didnt-break-the-camels-vac 14
- 15. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– DDOS ATTACKS INCREASE 125% ANNUALLY Source: Akamai: Q1 2016 State of the Internet - Security Report In 2016 we saw 19 attacks over 100 Gbps 15
- 16. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– TARGETS AND TYPES OF ATTACKS 16
- 17. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– End of the attack. Auto-mitigation is maintained for 26 hours after the attack has ended The server is operational - no attack Internet-based services are used without any problems. The DDoS attack begins the attack is launched via the internet and on the backbone. Mitigation of the attack Between 15 and 120 seconds after the attack has started, the mitigation is activated. STAGES OF MANAGING AN ATTACK 1 3 4 2 17
- 18. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– 18 • Pre-Firewall • OVH Managed Firewall • Firewall Network • Customer Configurable per IP address • Shield • UDP reflexion/amplification attacks filtering • Armor • Profiles based mitigation • Does the grunt of the work : SYN Authentication, Zombie detection, payload patterns, … • Only enabled when we detect an attack VAC Pre-Firewall Firewall Shield Armor VAC Architecture VAC – OVH’S ANSWER TO DDOS
- 19. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– OVH MITIGATION TECHNIQUES Traffic Analysis and Attack Detection • Netflow analysis of 1/2000 of the traffic that passes through routers. • The Armor boxes analyze this and compare it to the attack signatures. • If the comparison is positive, mitigation is ACTIVATED WITHIN SECONDS! Detection 19
- 20. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– VAC VAC VAC VAC SBG RBX GRA BHS Reference Article: https://www.ovh.com/us/news/articles/a2367.the-ddos-that-didnt-break-the-camels-vac LEVERAGING A GLOBAL NETWORK 20
- 21. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– VAC Anti-Hack Anti-Spam Anti-Phishing Remotely Triggered Black Hole (RTBH) • A fully redundant global network • Redundancy of all components • Fire risk management • High security Data Centers • Human presence in all Data Centers • Measures to counteract any failure of the electrical supply network. ADDITIONAL PROTECTION 21
- 22. 2017 Proprietary and Confidential ––– DEFENSE WITHIN THE VIRTUAL DATA CENTER
- 23. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– EDGE SECURITY NSX EDGE GATEWAY (vCloud Air Network) (vCloud Air Network) • Stateful Inspection Firewall • Network Address Translations (NAT) • DHCP • Site to Site VPN (IPSec) • Static Routing • Dynamic Routing OSPF, BGP • Load Balancer L4/L7 • SSL Certificate Offloading • SSL VPN (Client to Server) • 200 Sub-Interfaces • Distributed Firewall 23
- 24. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– Runs in Kernel Space Full vCenter Integration (VC Containers, vMotion) Zero-trust Security Micro-Segmentation Line RateDistributed Enable traffic redirection to 3rd party services Spoofguard Fully programmable (REST API) Internet DISTRIBUTED FIREWALL CHARACTERISTICS 24
- 25. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– WAN Internet Compute Cluster Compute Cluster Perimeter Firewall (Physical) NSX EDGE Service Gateway Compute Cluster SDDC (Software Defined DC) DFW DFW DFW DFW: E-W Edge Service Gateway positioned to protect border of the Cloud Instance or SDDC: North – South traffic protection Distributed Firewall positioned for internal traffic protection: East – West traffic protection Physical Virtual Compute Cluster EDGE:N-S NSX SECURITY IN THE CLOUD 25
- 26. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– SPOOFGUARD • Ensuring the IP of a VM cannot be altered without intervention • IP address does not match the IP address on record vNIC is prevented from accessing the network entirely. • Prevents rogue virtual machines from assuming the IP address of an existing VM • Guarantees distributed firewall (DFW) rules cannot be bypassed 26
- 27. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– 3RD PARTY INTEGRATION Hytrust Encryption at Rest Private Cloud / vSphere Data Center VM + HyTrust Key Controller 4 VM + HyTrust VM + HyTrust Key Controller 2 Key Controller 1 Key Controller 3 vCloud Air Admin 1 Admin 2 • Encrypt and re-key without taking applications offline • Transparent to users and admins • Customer retention of keys (Bring Your Own Keys) • Encryption travels with the VM, regardless of location 27
- 28. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– 3RD PARTY INTEGRATION 28
- 29. 2017 Proprietary and Confidential ––– SECURING THE EXTENDED DATA CENTER
- 30. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– • Secure VM migration or vMotion with IPSec and Suite- B Encryption • Flow entropy with FOU tunneling • Authentication required for migration • NAT’d vMotion Traffic • HCX will available upon release from VMware UNIQUE HYBRID CAPABILITIES Migrate Virtual Machines On-Prem to vCloud Air with Zero Downtime Compatibility Portability Security Hybrid Cloud vCloud AirOn-Premises Zero-Downtime Migration Active Replicating Secure Tunnel Overview 30
- 31. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– SECURITY POLICY MIGRATION The VMware SDDC Private Cloud The VMware Public Cloud Security Policy Migration Untether workloads from the physical data center for increased flexibility and agility Support data center migration and consolidation projects without need for maintenance windows Simplify transition to cloud by carrying existing security and networking policies with the virtual machine 31
- 32. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– HCX – ANY-TO-ANY CLOUD 32 32 HCX – Any-to-Any • Tether legacy vSPhere 5.1 to next-gen vSphere 6.5 and above • Seamless application mobility between different VMW stacks • Secure L2 Extension w/o need for NSX on site • Automatic VPN connectivity across sites • vMotion and replication across disparate VMW stacks Features Benefits • Move to cloud w/o need to upgrade vSphere on-prem • No need to upgrade networking architecture to extend L2 to cloud • Transform from legacy stack to next-gen SDDC+NSX without downtime • Transform with no change in networking, IP or IT policies • Automatic secure, high performance connection between sites vSphere 5.1+ VCF or VC + NSX HCX Hybridity
- 33. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– vRACK (VIRTUAL RACK) Once enabled, your services communicate with each other across a virtual network (vLAN). • Secure Private connection of all OVH infrastructures around the world. • vRack Enables private connectivity between Data Centers • Customer has the ability to make changes themselves • Allows extending layer 2 networks • Interconnects different environment types on the same VLAN 33
- 34. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– Customer Managed Networks & vRACK OVH POP Open Stack vSphere-as- a-Service Dedicated Server Roubaix Hillsboro Vint Hill Customer DC vSphere-as- a-Service CONNECTIVITY SIMPLIFIED 34
- 35. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– SUMMARY • OVH is a global hyper-scale cloud provider with a rich 20 year history. • OVH Customers have more options for data center locations, more direct connection points to get to the OVH network, more choices & product selection. • Industry leading anti-DDOS protection frontends your OVH based assets whether they are dedicated servers, private cloud computing, or public cloud instances. • Behind that industry leading DDOS protection is security in depth under your control. 35
- 36. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– HOW TO CONTACT US 36 VMworld Booth Location – D313 @ovh and @vcloudair_ovh @ovh and @vcloudair.ovh OVH and vCloud Air powered by OVH ovh.com
- 37. 2017 Proprietary and Confidential©2017 OVH US | Proprietary & Confidential ––– OVH AT VMWORLD 37 Session ID Session Title Time LHC3295BES OVH: Why Optimizing Layer 0 matters Wednesday Sept 13th 2:00 p.m. – 3:00 p.m. LHC2401BE How far is too far? The Hybrid Cloud Distance Factor. Tuesday Sept 12 3:30 p.m. – 4:30 p.m. LHC3296BES Shields Up! Building a True Security Barrier in the Cloud Tuesday Sept 12th 2:00p.m. – 3:00 p.m LHC1951BE Automate Cloud Recovery For When You Are Nuked From Orbit: It’s the Only Way to Be Sure Thursday Sept 14th 9:00 a.m. – 10:00 a.m. LHC1010BES Open your mind: mix Private Cloud, Hybridity and Elasticity all Together Tuesday, Sept 12th 5:00 p.m. – 6:00 p.m. GRC2676BE Building a Paper Trail: How to Secure and Audit a Public Cloud Wednesday Sept 13th 3:30 p.m. – 4:30 p.m.
- 38. 2017 Proprietary and Confidential ––– THANK YOU
Editor's Notes
- Details on DC Builds
- Building own servers, from the racks, to the housing, to the servers themselves
- With OVH you get access to almost any type of infrastructure you will need. If you are like most businesses you have a large number of Vmware based VMs running on-prem. OVH’s private cloud is based on Vmware’s SDDC stack and with the acquisition of vCloud Air, connecting your on-prem to a private cloud has never been easier. If you are looking for public cloud burstability OVH has you covered with Public Cloud provided and run on Openstack. But let’s say you have a workload that has specific requirements and you want access to all parts of the software stack. OVH has Bare Metal servers for you. OVH not only provides differing product platforms to address specific project needs of customers, we also allow the integration of these resources to allow for easy setup and communication between these platforms with our vRack product. A customer may have a piece of each of these all combined into a single solution that suites their needs. Private cloud – vSphere SDDC allowing ease of management by leveraging the same tools you’re used to from VMware. Public Cloud – Get virtualized machines at a per hour/minute cost by leveraging OVH’s public cloud built with Openstack. Dedicated Servers – Have full control of every aspect of your environment by starting from bare metal. Have root and BIOs level access to your hardware, and install what you want.
- The incident took offline some of the most popular sites on the web, including Netflix, Twitter, Spotify, Reddit, CNN, PayPal, Pinterest and Fox News – as well as newspapers including the Guardian, the New York Times and the Wall Street Journal. Massive DDos Attack Against Dyn DNS over 1 Tbps Amazon’s web services division, the world’s biggest cloud computing company, also reported an outage that lasted several hours on Friday morning. Major cyber attack disrupts internet service across Europe and US
- As the Internet of Things (IoT) or connected devices are growing at a great pace, they continue to widen the attack surface at the same time, giving attackers a large number of entry points to affect you some or the other way.1 Tbps DDoS Attack Hits OVHIoTs are currently being deployed in a large variety of devices throughout your home, businesses, hospitals, and even entire cities (Smart Cities), but they are routinely being hacked and used as weapons in cyber attacks due to lack of stringent security measures and insecure encryption mechanisms.Also Read: Here's How to Hack IoT Devices.Octave Klaba, the founder and CTO of OVH, revealed on Twitter last week when his company was hit with two simultaneous DDoS attacks whose combined bandwidth reached almost 1 Tbps."Last days, we got [a] lot of huge DDoS. Here, the list of "bigger that 100Gbps" only. You can see the simultaneous DDoS are close to 1 Tbps!," Klaba tweeted.A screenshot posted by Klaba shows multiple DDoS attacks that exceed 100 Gbps, including one that peaked at 799 Gbps alone, making it the largest DDoS attack ever reported.According to the OVH founder, the massive DDoS attack was carried out via a network of over 152,000 IoT devices that includes compromised CCTV cameras and personal video recorders.Must Read: How Drones Can Find and Hack Internet-of-Things Devices From the Sky.IoT-powered DDoS attacks have now reached an unprecedented size, as it is too easy for hackers to gain control of poorly configured, or vulnerable, IoT devices.Late last year, we reported that lazy manufacturers of the IoTs and home routers are reusing the same set of hard-coded SSH (Secure Shell) cryptographic keys, leaving millions of embedded devices, including home routers, modems, and IP cameras open to Hijacking.And the worst part:These insecure IoT or internet-connected devices are no longer in line for security updates, which makes it possible for hackers to hijack these connected devices today or tomorrow.
- Mitigate against 16 different DDOS Attacks
- OVH uses netflow sent by the routers and analyzed by the Arbor Peakflow boxes. Each router sends a summary of 1/2000 of the traffic that is actually passing through it. The Armor boxes analyze this and compare it to the attack signatures. If the comparison is positive, mitigation is ACTIVATED WITHIN SECONDS! The signatures analyzed are based on traffic thresholds of "packets per second" (pps, Kpps, Mpps, Gpps) or "bits per second" (bps, Kbps, Mbps, Gbps) on certain packet types, such as: DNS, ICMP, IP Fragment, NULL IP, UDP , Total Traffic., etc Given that it is necessary for certain thresholds to be triggered, and that only 1/2000 of the actual traffic is analyzed, setting up the mitigation can take between 15 and 120 seconds.
- Prevents virtual machines from altering their existing IP address. IP address does not match the IP address on record vNIC is prevented from accessing the network entirely. Prevents rogue virtual machines from assuming the IP address of an existing vm Ensures the IP addresses of virtual machines cannot be altered without intervention Guarantees distributed firewall (DFW) rules cannot be bypassed
- Hybrid Cloud Manager is available today for Dedicated Cloud Current capabilities include low-downtime migration and stretching Layer 2 networks across on-prem and vCloud Air. HCM also supports WAN optimization for improved performance between these endpoints. The most recent relase features 3 key new enhancements to HCM: Zero-downtime migration/ cloud-to-cloud vMotion Policy migration for customers already using NSX on-prem. This would allow you to carry the NSX firewall settings with the VM as it is migrated to vCloud Air Expanded support for HCM in Virtual Private Cloud Smaller enhancements include egress optimization and other implementation and performance improvements
- VMware's Hybrid Cloud Manager offers vSphere users a seamless option for extending their networks to the cloud. Hybrid Cloud Manager™ provides an optimized, software-defined WAN to increase stretched network performance while reducing WAN traffic up to 50%, enabling networks to stretch in the cloud yet perform almost as if they were local. Not only can the network fabric extend to the cloud but Hybrid Cloud Manager™ also enables zero downtime bidirectional migration of workloads as well as the migration of NSX security policies to vCloud Air Advanced Networking Services. Customers can move VMs up to 20x faster with our optimized network while retaining the same security controls available on-premises. The new version of HCM offers our customers new, advanced networking capabilities to connect the on-prem environment to vCloud Air: Zero Downtime Migration: Move VMs to the cloud without taking the VM offline! Security Policy Migration: Duplicate your internal NSX microsegmentation policy for use with vCloud Air Advanced Networking Services to maintain security controls when migrating applications High Speed Layer 2 tunnel: now customers can stretch their networks at multigigabit speeds, to make the WAN feel more like their LAN, making it faster and easier to move applications to and from the cloud and maintain connectivity to on-prem data center resources HCM will now be sold in 3 tiers of service: Standard, Advanced, and Enterprise
- Riding on our own private backbone we have a network implementation we refer to as vRack. Using VXLAN aware physical networking components, we’re able to interconnect your environments together and allow communication between your workloads within the same VLAN segments. This is regardless of type of solution as well. Open stack public cloud, connected to Vmware SDDC Private cloud, connected to your own custom bare metal solutions. This type of configuration is completely accessible and configurable from the customer side. No need to open a support case to request to configure connectivity between your OVH DC’s and solutions. With vRack connect, you can also take advantage of these same benefits and bring your local VLAN’s to the cloud. Sharing network space simplifies configurations from a networking perspective at the customer level. Let us deal with the complicated configuration between sites, expensive hardware, and maintenance.