Attention NAC vendors who continue to barrage me via email/blog postings claiming I don't understand NAC: You're missing the point of this post which basically confirms my point; you're not paying attention and are being myopic.
I included NAC with IPS in this post to illustrate two things:
(1) Current NAC solutions aren't particularly relevant when you have centralized and virtualized client infrastructure and
(2) If you understand the issues with offline VM's in the server world and what it means to compliance and admission control on spin-up or when VMotioned, you could add a lot of value by adapting your products (if you're software based) to do offline VM conformance/remediation and help prevent VM sprawl and inadvertent non-compliant VM spin-up...
But you go ahead and continue with your strategy...you're doing swell so far convincing the market of your relevance.
Now back to our regular programming...
-- ORIGINAL POST --
From the "Out Of the Loop" Department...
Virtualization is causing IPS and NAC appliance vendors some real pain in the strategic planning department. I've spoken to several product managers of IPS and NAC companies that are having to make some really tough bets regarding just what to do about the impact virtualization is having on their business.
They hmm and haw initially about how it's not really an issue, but 2 beers later, we're speaking the same language...
Trying to align architecture, technology and roadmaps to the emerging tidal wave of consolidation that virtualization brings can be really hard. It's hard to differentiate where the host starts and the network ends...
In reality, firewall vendors are in exactly the same spot. Check out this Network World article titled "Options seen lacking in firewall virtual server protection." In today's world, it's almost impossible to distinguish a "firewall" from an "IPS" from a "NAC" device to a new-fangled "highly adaptive access control" solution (thanks, Vernier Autonomic Networks...)
It's especially hard for vendors whose IPS/NAC software is tied to specialty hardware, unless of course all you care about is enforcing at the "edge" -- wherever that is, and that's the point. The demarcation of those security domain diameters has now shrunk. Significantly, and not just for servers, either. With the resurgence of thin clients and new VDI initiatives, where exactly is the client/server boundary?
Prior to virtualization, network-based IPS/NAC vendors would pick arterial network junctions and either use a tap/SPAN port in an out-of-band deployment or slap a box inline between the "trusted" and "untrusted" sides of the links and that was that. You'd be able to protect assets based on port, VLAN or IP address.
You obviously only see what traverses those pipes. If you look at the problem I described here back in August of last year, where much of the communication takes place as intra-VM sessions on the same physical host that never actually touch the externally "physical" network, you've lost precious visibility for detection let alone prevention.
I think by now everyone recognizes how server virtualization impacts network and security architecture and basically provides four methods (potentially in combination) today for deploying security solutions:
- Keep all your host based protections intact and continue to circle the wagons around the now virtualized endpoint by installing software in the actual VMs
- When available, take a security solution provider's virtual appliance version of their product (if they have one) and install in on a host as a VM and configure the virtual networking within the vSwitch to provide the appropriate connectivity.
- Continue to deploy physical appliances between the hosts and the network
- Utilize a combination of host-based software and physical IPS/NAC hardware to provide off-load "switched" or "cut-through" policy enforcement between the two.
Each of these options has its pros and cons for both the vendor and the customer; trade-offs in manageability, cost, performance, coverage, scalability and resilience can be ugly. Those that have both endpoint and network-based solutions are in a far more flexible place than those that do not.
Many vendors who have only physical appliance offerings are basically stuck adding 10Gb/s Ethernet connections to their boxes as they wait impatiently for options 5, 6 and 7 so they can "plug back in":
5. Virtualization vendors will natively embed more security functionality within the hypervisor and continue integrating with trusted platform models
6. Virtualization vendors will allow third parties to substitute their own vSwitches as a function of the hypervisor
7. Virtualization vendors will allow security vendors to utilize a "plug-in" methodology and interact directly with the VMM via API
These options would allow both endpoint software installed in the virtual machines as well as external devices to interact directly with the hypervisor with full purview of inter and intra-VM flows and not merely exist as a "bolted-on" function that lacks visibility and best-of-breed functionality.
While we're on the topic of adding 10Gb/s connectivity, it's important to note that having 10Gb/s appliances isn't always about how many Gb/s of IPS traffic you can handle, but also about consolidating what would otherwise be potentially dozens of trunked LACP 1Gb/s Ethernet and FC connections pouring out of each host to manage both the aggregate bandwidth but also the issues driven by a segmented network.
So to get the coverage across a segmented network today, vendors are shipping their appliances with tons of ports -- not necessarily because they want to replace access switches, but rather to enable coverage and penetration.
On the other hand, most of the pure-play software vendors today who say they are "virtualization enabled" really mean that their product installs as a virtual appliance on a VM on a host. The exposure these solutions have to traffic is entirely dependent upon how the vSwitches are configured.
...and it's going to get even more hairy as the battle for the architecture of the DatacenterOS also rages. The uptake of 10Gb/s Ethernet is also contributing to the mix as we see customers:
- Upgrading from servers to blades
- Moving from hosts and switches to clusters and fabrics
- Evolving from hardware/software affinity to gird/utility computing
- Transitioning from infrastructure to service layers in ???the cloud???
Have you asked your IPS and NAC vendors who are hardware-bound how they plan to deal with this Tsunami on their roadmaps within the next 12 months. If not, grab a lifejacket.
/Hoff
UPDATE: It appears nobody uses trackbacks anymore, so I'm resorting to activity logs, Google alerts and stubbornness to tell when someone's referencing my posts. Here are some interesting references to this post:
- Mike Fratto - NWC NAC and Virtualization Immersion Center
- Dana Hendrickson - SecureAccessCentral
...also, this is right on the money:
- Chris Silva - Forrester
I think I'll respond to them on my blog with a comment on theirs pointing back over...
