VMware vCloud Security

VMware vCloud Security

Overview of this book

Security is a major concern, in particular now that everything is moving to the cloud. A private cloud is a cloud computing platform built on your own hardware and software. The alternative is to deploy the services you need on a public cloud infrastructure provided by an external supplier such as Amazon Web Services, Rackspace Cloud, or HP Public Cloud. While a public cloud can afford greater flexibility, a private cloud gives you the advantage of greater control over the entire stack. "VMware vCloud Security" focuses on some critical security risks, such as the application level firewall and firewall zone, virus and malware attacks on cloud virtual machines, and data security compliance on any VMware vCloud-based private cloud. Security administrators sometimes deploy its components incorrectly, or sometimes cannot see the broader picture and where the vCloud security products fit in. This book is focused on solving those problems using VMware vCloud and the vCloud Networking and Security product suite, which includes vCloud Networking and Security App, vShield Endpoint, and vCloud Networking and Security Data Security. Ensuring the security and compliance of any applications, especially those that are business critical, is a crucial step in your journey to the cloud. You will be introduced to security roles in VMware vCloud Director, integration of LDAP Servers with vCloud, and security hardening of vCloud Director. We'll then walk through a hypervisor-based firewall that protects applications in the virtual datacenter from network-based attacks. We'll create access control policies based on logical constructs such as VMware vCenter Server containers and VMware vCloud Networking and Security security groups but not just physical constructs, such as IP addresses. You'll learn about the architecture of EPSEC and how to implement it. Finally, we will understand how to define data security policies, run scans, and analyze results.

VMware vCloud Security

Credits

Foreword

About the Author

Acknowledgement

About the Reviewers

www.PacktPub.com

Preface

Free Chapter

Installation and Configuration of vCloud Director

VMware vCloud Director architecture

vCloud management and resource clusters

vCloud Director installation prerequisites

vCloud Director security

Directory (LDAP) services integration

Auditing and logging

Summary

Securing Your vCloud Using the vCloud Networking and Security App Firewall

vCloud Networking and Security App Firewall – use case

vCloud Networking and Security App – communication flow

Installing vCloud Networking and Security App

vCloud Networking and Security App – firewall management

vCloud Networking and Security App – flow monitoring

Summary

Mitigating Threats Using vShield Endpoint Security

EPSEC – use case

EPSEC – key benefits

vShield Endpoint architecture

vShield Endpoint components and intercommunication

vShield Endpoint prerequisites

Installing vShield Endpoint

vShield Endpoint – health monitoring

Summary

Overview of VMware vCloud Networking and Security Data Security

vCloud Networking and Security Data Security architecture

vCloud Networking and Security Data Security installation

Defining the vCloud Networking and Security Data Security policy

Scanning statistics and reports

Summary

Index

Customer Reviews

5 star

4 star

3 star

2 star

1 star

vCloud management and resource clusters

vCloud management cluster is a VMware vSphere High Availability (HA) and vSphere DRS (Distributed Resources Scheduler) cluster that is created to manage a vCloud architecture. A management cluster contains the standard management components, such as ESXi hosts, vCenter Server system, vCloud Director cell servers, database server/s for vCloud Director, and vCenter. A management cluster should have its own shared storage that will store the virtual machines running inside the management cluster. The management cluster should also be separated into a single physical site. We would like to emphasize that for the cloud, it is a must to have a separate management cluster. It is a best practice to place the management components in a management cluster.

You should use vSphere HA and DRS on the management cluster to provide availability for all the management components. For vSphere HA, use the Percentage of Cluster Resources Reserved admission control policy in an n + 1 fashion instead of defining the amount of host failures a cluster can tolerate or specifying the failover hosts. This approach will help you to allow management workloads run evenly across the hosts in the cluster without the need to dedicate a host strictly for host failure situations. But this is not just limited to n + 1; for higher availability, you can add a host for an n + 2 cluster, although doing so is not a requirement of the vCloud private or public service definitions.

You may be wondering why you need a vCenter Server inside your vCloud management cluster. This management vCenter Server will carry clusters that will host cloud workloads. These resources are allocated by vCloud Director as a provider datacenters. Within a distinct vSphere cluster, a provider datacenter translates into a resource pool that is created automatically by vCenter, issued on a request from vCloud Director.

Although you can physically separate the management cluster and resource cluster, it is not a good practice to do so. You should put the management cluster and vCloud consumer resources on the same physical site. If you use a single site, it ensures a consistent level of service. Otherwise, latency issues might arise if workloads must be moved from one site to another.

VMware vCloud Security

VMware vCloud Security

Overview of this book

Related Content you might be interested in

Current Title:

VMware vCloud Security

vCloud management and resource clusters