This session will explore how we can leverage containers, network/endpoint virtualization technologies and virtualized security instrumentation, concurrently, to transformationally improve security visibility, security analytics, system resilience and actionable context, greatly increasing our ability to attest that systems will be secure and compliant in any state into which they may be driven. (Source: RSA USA 2016-San Francisco)

1. SESSION ID:
#RSAC
Dennis R Moreau
Transforming Security:
Containers, Virtualization and
the Softwarization of Controls
ASD-W03
Senior Engineering Architect
VMware Office of the CTSO
@DoctorMoreau

2. #RSAC
The Security Problem
2
Security breach rates and losses continue to outpace security spend in “the year of the
breach”.
IT Spend
Security Spend
Security Breaches

3. #RSAC
Complexity: Complex Attack Behavior
HW & FW
OS
Application
Operatin
g
Applicati
on
MMUs
SMM
UEFI
Controllers
Supply Chain…
Overflows
Insertion
Malformation …
dll injection
SVC Vulns
ROP …
OS
Application
Recon & Lateral Movement
……… …
HW & FW
IaaS
SaaS

4. #RSAC
Complexity: Many Required Security Controls
Source: SANS 20 Critical Cyber Controls – Fall 2014
https://www.sans.org/media/critical-security-controls/fall-2014-poster.pdf
!

5. #RSAC
Complexity: Many Security Control Standards
5https://www.sans.org/media/critical-security-controls/critical-controls-poster-2016.pdf
NIST 800-53, ISO 27002, NSA Top 10,
GCHQ 10 Steps, PCI DSS, HIPAA, NERC,
CSA, FISMA, ITIL KPIs, …

6. #RSAC
Complexity: The Balkanization of Security
Security
Controls
Rules,
Lang &
Logic
Control
Boundary
Object
Type
Consoles
Agents
Placement
Constraints
SNORT, FW 5-tuples,
OWASP, YARA, XACML…
End Point, Network,
VLAN, Domain, Process,
OU …
User, Application,
Data Class, Service, DB…
Consoles
Logs, Alerts,
Rules, Workflow…
DB, App, OS,
NAT, LB, L4, L3 …

7. #RSAC
Complexity: No Finish Line
Change!Evolving
Standards
Control
Technology
Growth
Scale
Agility++
New Bus.
Need
New
Regulation
New
Threats
New
Governance

8. #RSAC
Complexity: IT Architecture
Highly Connected
Complex Service Protocols
EP controls with weak isolation
NW controls with weak context
EP <-> NW mismatch
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
…
App2App1 App3 App4
FW
IPS

9. #RSAC
Complexity is the Problem!
Misconfiguration is very common (Gartner: 95%* of FW breaches
attributable to misconfiguration)
*Gartner, Inc. “One Brand of Firewall Is a Best Practice for Most
Enterprises”. November 28, 2012.
*Gartner, Inc. “ …75 Percent of Mobile Security Breaches Will Be the Result
of Mobile Application Misconfiguration”
http://www.gartner.com/newsroom/id/2846017
We need architecturally simplified security provisioning, operation,
response and analytics.

10. #RSAC
Virtualization and the Softwarization of Security
Controls: Enabling Policy Simplification
10

11. #RSAC
Visibility: Micro-segmentation and SW
• Understand Traffic
• Here, > 80% is East-West
• Largely uninspected and
unprotected
• Ops: Clearly not optimized
Source: Networking data from Arkin.net deployments

12. #RSAC
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
…
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
…
App2App1 App3 App4 App2App1 App3 App4
FW
IPS
FW
IPS
Enabled by:
Network Virtualization
Containment & Protection

13. #RSAC
Network Virtualization
GuestvSwitch
Guest
vSwitch
Compute
Isolation
Network
Isolation
V Network Ctrl
V Server Ctrl
Provisioning
Protection
Introspection …
IP Address Space
Routing
Firewall …

14. #RSAC
Transport Network
Network Virtualization: Overlays
L2
L2
Tenant B
L2
L2
L2
Tenant C
L2
L2
L2
VM
VM
VM
VM
VM
VM
VM
VM
L2 IP UDP VXLAN PayloadL2 IP
PayloadL2 IP
PayloadL2 IP
PayloadL2 IP
Overlays
Controller

15. #RSAC
Micro-segments: A new policy primitive
App/Svc
Segment
GuestvSwitch
Guest
vSwitch
Guest vSwitch
Aligned Isolation:
• Routing
• NAT
• dFW
Policy Boundary Invariant

16. #RSAC
Simplify: Smaller more aligned policy
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
dFW
…
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
…
App2App1 App3 App4 App2App1 App3 App4
dFW dFW dFW
eFW eFW
Policy here crosses many
apps … App1 – App4
Policy here can align on
one App/Svc
 Much smaller policy sets
 Much more coherent policy
Policy
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
…
----------
----------
----------
----------
----------
Policy
----------
----------
----------
…
----------
----------
Policy
----------
----------
----------
----------
…
----------
----------
Policy
----------
----------
----------
…
----------
----------
Policy
----------
----------
----------
…
----------
----------
Policy
----------
----------
----------
…
----------
----------

17. #RSAC
Simplify: Change with less side effect
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
FW
…
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
…
App2App1 App3 App4 App2App1 App3 App4
FW FW FW
FW FW
Policy change here is coupled
across apps
Policy change here is far safer
 Much simpler mitigation
 Much safer rule deletion
Policy
----------
----------
----------
…
----------
----------
Policy
----------
----------
----------
----------
…
----------
----------
Policy
----------
----------
----------
…
----------
----------
Policy
----------
----------
----------
…
----------
----------
Policy
----------
----------
----------
…
----------
----------
Policy
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
----------
…
----------
----------
----------
----------
----------

18. #RSAC
Simplify: Policy that follows the workload
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
dFW
…
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
…
App2App1 App3 App4 App2App1 App3 App4
dFW dFW dFW
eFW eFW
Only traffic steering determines
protection/visibility
Classification (SG) determines
protection & visibility
 Protection scales with hypervisors

19. #RSAC
Simplify: Default deny posture
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
dFW
…
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
…
App2App1 App3 App4 App2App1 App3 App4
dFW dFW dFW
eFW eFW
Default deny policy here is blunt,
coupled across apps, partial and
weakly scale-able
Default deny policy here is precise,
efficient, scale-able, …
 Recon and lateral in the DC
is much more visible and difficult

20. #RSAC
Simplify: Intrinsic E/W visibility/control
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
dFW
…
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
…
App2App1 App3 App4 App2App1 App3 App4
dFW dFW dFW
eFW eFW
E/W traffic hair-pinned for
visibility at the DC edge
All E/W traffic is visible and
filtered according to policy
 Complete E/W visibility & control
 No hairpin management

21. #RSAC
Control Placement and Segments
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
FW
SC
…
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
…
App2App1 App3 App4 App2App1 App3 App4
FW
SC
FW
SC
FW
SC
FW
SC
FW
SC
Enabled by:
Network Virtualization +
Sofwarization of Security Controls

22. #RSAC
Virtualization and the Softwarization of
Security Controls: Improved Alignment
22

23. #RSAC
≢
Align: NW/EP Control Aligned on Segments
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
FW
IPS
…
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
V
M
…
App2App1 App3 App4 App2App1 App3 App4
FW
IPS
FW
IPS
FW
IPS
FW
IPS
FW
IPS
EPEP EP
EPEP EP EPEP EP
EPEP EP
EP EP
EP EP
EPEP EP EPEP EP EP EP
EPEP EP EPEP EP EP EP
NW Policy(IF, Subnet, DHCP Scope, …)
EP Policy(Asset, HostID, SID, Svr Role, TPM…)EP Identifiers
EP Boundaries
NW Identifiers
NW Boundaries
App
Seg
EP Identifiers
EP Boundaries
NW Identifiers
NW Boundaries
≡
≡
EP
MS
NW
VMID
MSID
EP
NW
NW
P1(MSID)
PN(MSID)
…

24. #RSAC
Align: Coordinated Controls
24
Segment dFW WAF
Detect
Here
OWASP Rules
vFW
Block
Here
FW Rules
Then …
Expensive
detection, so …

25. #RSAC
Align: Coordinated Controls
25
Segment dFW WAF
OWASP Rules
vFW
FW Rules
IPS
SNORT Rules
Rule N+1
Rule N+2
…Emergent
Vulnerability
Observed
Anomaly

26. #RSAC
Align: Controls Context
26
Segment dFW WAF IPS AA
OWASP
Rules
SNORT
Rules
vFW
FW
Rules
Protocol
Defn
Resultant Protection Policy
Access
Rules
Order Matters: So topological context is required for many security use cases.
Visibility &
Semantics
here …
… depends on
policy and filtering
here

27. #RSAC
Containers and Operationally Plausible
Default Deny Policy
27

28. #RSAC
Sources of Plausible Micro-segment Policy
1. Provenance, Manifests & Provisioning Information
2. Application Network Behavior
3. Infrastructure Services (or Micro-services) Connectivity &
Dynamics

29. #RSAC
Namespace
Volume Service
Containers: App/Svc Focused Context
29
Ex. Authoritative Context
App Configuration & Resources
Resource Sharing Across Apps
Colocation of Containers
Service Components
Services within a Namespace
Network Dynamics (LB, HA, …)
Example Contextual Structure
RC
Volume Service
Pod
Container
App Env
App
Pod
Container
App Env
App
…
LB

30. #RSAC
Containers: EP Compliance
30
Compliance scan of Docker image
Usage: docker-oscap image IMAGE_NAME [OSCAP_ARGUMENTS]
Compliance scan of Docker container
Usage: docker-oscap container CONTAINER_NAME [OSCAP_ARGUMENTS]
"Vulnerability scan of Docker image"
Usage: docker-oscap image-cve IMAGE_NAME [--results oval-results-
file.xml [--report report.html]]
"Vulnerability scap of Docker container"
Usage: oscap-docker container-cve CONTAINER_NAME [--results oval-
results-file.xml [--report report.html]]
Ref: https://github.com/OpenSCAP/container-compliance

31. #RSAC
Alignment: Network Context
Hosted
Protection
Premise
Protection
LB
SVC
SVC SVC
SVC
SVC SVC
Web
Service
Web Cont Web Cart
SAP MT
SAP
DB DB
Control placement determines:
• Meaning of Log and Alert signals
• Up/Down stream interference
• Affected assets
• Mitigation options

32. #RSAC
But “containers don’t contain”
32
Provider
Attest:
 -----
 -----
 -----
Tenant Tenant Tenant
Audit:
 -----
 -----
 ----
Docker Engine
Operating System instance
App 1
Bins/Libs
App 2
Bins/Libs
App 2
Bins/Libs
Shared: IDs, filesystem, services, resources …
Process and Name Space Isolation
Audit:
 -----
 -----
 ----
Process/Namespace Isolation
… but could be much better
Better Isolation
Isolated Controls (independent)
Mature Security Mgmt (Gartner)
Normalized Policy Locus
Between WL and Hosting
(hybrid/multi-cloud)
Mis-alignment
https://opensource.com/business/14/7/docker-security-selinux
http://www.projectatomic.io/blog/2014/09/yet-another-reason-containers-don-t-contain-kernel-keyrings/
http://blog.docker.com/2014/06/docker-container-breakout-proof-of-concept-exploit/
Gartner: Security Properties of Containers Managed by Docker

33. #RSAC
Directional: Containers + Virtualization
FW (app)
IPS (app)
WAF (app)
NGFW (app)
…
WAF
IPS
NGFW
FW
Logs
Alerts
Behavior
Analytics
Where else might this behavior be expressed?...
Registry
Labels,
Provenance,
Testing
Containers
Docker Daemon
Images
Policy
Same App IDs
Same Boundaries
Shared Context
…
Aligned:
Apps
Server
Network
More actionable context, so response
is more efficient & accurate, reduced dwell time

34. #RSAC
Containers + Virtualization
34
VMworld 2015: NET6639 - Next Horizon for Cloud Networking and Security:
https://www.youtube.com/watch?v=RBJ-KoAM-OQ&feature=youtu.be
Provider
Attest:
 -----
 -----
 -----
Tenant Tenant Tenant
Audit:
 -----
 -----
 ---- Consistent boundary X Stack
Same identifier (msid, vmid)
Alignment … in any state
Independent verification
Authoritative context (OOB)
Control Boundary &
Controls Alignment
VM vServer & vSwitch
Docker Engine
Operating System instance
App 1
Bins/Libs
App 2
Bins/Libs
App 2
Bins/Libs
vSwitch vSwitch vSwitch
Audit:
 -----
 -----
 ----
Audit:
 -----
 -----
 ----

35. #RSAC
Application Blueprint Example - vRealize
35
Application structure and external connectivity are completely
exposed to inform operationally plausible security policy

36. #RSAC
Enterprise Infrastructure & Containers
36
Infrastructural Context
Leveraging of PBS, PBN,
Infrastructural Services
Legacy apps to cloud native apps, on
the same infrastructure
Integration of governance, CJA,
context (for logs, alerts, response
RCA, …)
…
ESX
Photon OS
ESX
Photon OS
ESX
Photon OS
KubernetesMESOS
Photon Cont 1
Photon Cont 2
Photon Cont 3
Create
Get pods
Create Kubernetes
Cluster
Photon
Machine

37. #RSAC
App Behavior Analysis: Arkin Example
37
Insight into application network behavior drives 1st order
operationally plausible default deny posture.

38. #RSAC
Container
38
Intrinsically Captures Application Structure, Provenance, and
Classification (pre-launch)
Always Current Configuration (immutability)
No “intended” vs. “actual” gap
Operations & Security perspectives
Immutability accommodates “moving target” defense techniques
Expose implicit network requirements in App context context.
Expose implicit app deployment requirements
Level of req’d awareness of virtual network topology
Req’d SVCs

39. #RSAC
Refining Micro-Segmentation Using
Analytics
39

40. #RSAC
Sources of Plausible Micro-segment Policy
1. Provenance, Manifests & Provisioning Information
2. Application Network Behavior
3. Infrastructure Services (or Micro-services) Connectivity &
Dynamics

41. #RSAC
Micro-Segmentation: Model & Secure
• Model apps, app tiers, regulatory
scopes, network, org boundaries,
etc.
• Default Deny: Only allow what’s
necessary, Deny everything else.
Source: Arkin.net Screenshot

42. #RSAC
Micro-Segmentation in Action: Modeling Security Groups
Source: Arkin.net Screenshot
Segment by applications, app
tiers, security zones, L2/L3
network boundaries, virtual-
physical boundaries,
organizational levels, etc

43. #RSAC
Micro-Segmentation in Action: Modeling Security Policies
Source: Arkin.net Screenshot
Inter and Intra Segment (VM to
VM) Communication
Some services require internet
access.
“Deny All” to these segments
(…and confirm it)
Allowed access to shared services

44. #RSAC
Micro-Segmentation in Action: Validate Compliance
Source: Arkin.net Screenshot
Runtime Effective Policy between
any two points in the Datacenter

45. #RSAC
Summary
45

46. #RSAC
Summary
46
Complexity is at the heart of today’s security challenge
Virtualization and Softwarization allows app focused placement
and policy alignment
Containerization provides the essential context for realizing an
operationally plausible default deny policy
This resulting in transformationally simpler policy and more
effective protection.

47. #RSAC
Apply: Assess
47
When you return to work:
Evaluate your current policy complexity
Policy set size
Policy testing workflow
Estimate its effect on security policy management
Latency in security policy updates
Estimate the degree of your “default deny” posture
Identify related instances of policy misconfiguration

48. #RSAC
Apply: Dev Ops
48
As move forward in DevOps:
For selected applications determine
Operationally plausible default deny posture by observed logs
Application policy requirements from container
blueprints/manifests
Application component dynamics: continuity, scaling, …
For important and cross application cutting services
Document discovery, election, failover, … protocol dynamics

49. #RSAC
Apply: Plausible Micro-segment Policy
Plausible Policy Information Sources
1. Provenance, Manifests & Provisioning Information
2. Application Network Behavior
3. Infrastructure Services (or Micro-services) Connectivity &
Dynamics

50. #RSAC
Thank You!
Questions?
Dennis R Moreau: dmoreau@vmware.com