So#ware-Defined Security Services Working Group Ini;a;ve

Transcription

1 So#ware-Defined Security Services Working Group Ini;a;ve PoC Setup & Guidelines Copyright 2017 Open Networking User Group. All Rights Reserved Not For

2 Outline ONUG PoC Right Stuff Award How to S-DSS Statement PoC Environment Setup PoC Environment Security Services Judging Criteria

3 ONUG PoC Right Stuff Innova;on Award To celebrate vendor dedication to the development of innovative open cloud-based solutions, ONUG will present the Right Stuff Innovation Awards to those companies that best address the Working Group Initiative Proof of Concept guidelines at ONUG Fall 2017 A panel of independent industry analysts will act as judges using criteria developed by working group members WHY The ONUG Community views hybrid multi-cloud as a fundamental building block for digital transformation, and it s our hope that the Right Stuff Innovation Awards will foster an encouraging and collaborative environment for the vendor community to build the solutions IT executives are looking for to increase options, choices, and agility WHEN 10-minute Proof of Concept (PoC)* presentations will take place within the PoC Theater throughout the 2-day ONUG Fall Conference, and the Right Stuff Innovation Awards will be distributed on October 18, 2017.

4 How to PARTICIPATE To be considered, your company must be demonstrating at ONUG Fall 2017 To schedule your PoC demonstration time, Mira Woods and Emily Hunt and please note if you would like to be considered for an ONUG Right Stuff Innovation Award For FAQ, please visit here:

5 S-DSS Posi;on Statement The S-DSS working group s framework consists of a security architecture that is intent based that wraps policy around workloads, independent upon host model that is bare metal, hypervisor, container and serverless. Policy enforcement is local to the workload and independent upon its physical locaaon be it on or off premises.

6 S-DSS PoC Environment Setup Users Public Cloud B Public Cloud A Analytics (containers) Web Layer (VMs) Internet Data Scientists Caching Layer (bare metal or VMs) ETL Database (bare metal) On-Prem Data Center Database Admins

7 PoC Environment Setup - Descrip;on Hybrid infrastructure deployment Web layer in public cloud A running on VMs Caching layer in on-prem data center running on VMs Database running in on-prem data center on bare metal servers Analytics cluster in public cloud B running as containers ETL (Extract, Transform, Load) from DBs to Analytics Communication needed to make things work Web layer uses caching layer to serve the content Caching layer uses Database for persistent storage Users on the Internet access the Web layer Database Admins (DBAs internal users) need administrative access to Databases ETL process loads data from Databases and uploads it to Analytics cluster Data Scientist (internal users) need access to Analytics cluster

8 PoC Environment Security Services Access Control / Firewall / Microsegmentation Policies Web workloads provides http/https service to the any user on the Internet Caching workloads provide caching service to the Web workloads Database workloads provide database service to the Caching workloads Database workloads provide database service to Database Admins (internal users) Database workloads provide database service to ETL workloads Analytics workloads provide analytics service to Analytics workloads Analytics workloads provide https service to Data Scientists (internal users) Other policies for allowing core services and monitoring the applications All other communication except the above needs to be blocked! Visibility and Analytics Demonstrate the ability to support visibility, analytics, and reporting for security (e.g., telemetry to a SIEM, report of all the connections going into a PCI application for compliance)

9 PoC Environment Security Services Encryption Policies for data-in-transit Traffic between Web layer and Caching layer needs to be encrypted Traffic between ETL and Analytics cluster needs to be encrypted There are a broad range of other security services including, but not limited to, IDS/IPS, Deception, Data Loss Detection/Prevention, and User Behavioral Analytics. Vendors are encouraged to showcase any of these services during the PoC

10 Judging Criteria S-DSS Framework Alignment 70% Are policies bound to workloads? Can the solution enforce policies for on-prem/off-prem/multi-cloud, bare-metal servers/vms/containers/serverless workloads? 20% Are policies portable? Can the policies defined for one environment be applied to another environment? Do the policies continue to be enforced when an application is migrated to a different environment with different IP addresses? 20% Are policies elastic? Are the policies applied to a workload as soon as it spins up? Do the policies continue to be enforced when an application auto scales up/down? 20% Is the solution software-based? Does it support open APIs? Can it be automated/ orchestrated? 10% Are core security requirements satisfied? Does the solution satisfy any or all of the core security requirements needed to support the confidentiality, integrity, and/or availability of the solution? Self evaluation* Coverage of Security Services 20% How many services does a solution provide (access control, authentication/encryption, IDS/IPS, etc.)? Ease of Deployment and Management 10% How easy/hard is it to deploy and manage the solution? Award Threshold: In order to receive the Right Stuff Innovation Award, a vendor must receive at least 70% score * Vendors are encouraged to put together a self-evaluation for the core security requirements needed to support the confidentiality, integrity, and/or availability of the solution. This is NOT part of the judging criterion for ONUG Fall However, this may be considered as judging criterion for future events