Category Archive: VMware

Nov 02

That’s my View and I’m sticking to it

Categories:

VDI, VMware

by

Minimizing the clicks & Better Performance

As some of you may know, I’m a user (and fan) of virtual desktops. I’ve been using a VMware View-based virtual desktop now at EMC for about 2+ years. This works well for me because I use my personal MacBook rather than a company issued laptop. I like to keep that separation between what’s mine and what’s EMC’s. I do all my “EMC” work on the virtual desktop. Email, timecard, etc…

So, when new VMware View clients came out, I jumped over to see what’s new. I’m happy to report that a couple of things caught my eye.

URI Support

Screen Shot 2012-11-02 at 11.33.51 AM

The first is the new URI support for the VMware View client. You can now launch the VMware View client from your browser, passing certain characteristics to the client. The URI would be vmware-view://. That was interesting to me as I wanted the ability to launch a URL with the VMware-View URI for specific use cases. Primarily, I wanted to launch the View client with different sizes. One for fitting well on my Macbook Air screen and another when I’m using an external monitor. I looked into the documentation and found this was trivial to set up.

vmware-view://mike@my.view.server.com/MikeF%20Desktop?desktopProtocol=PCoIP&desktopLayout=1280×854

Obviously, I’ve changed the username and server name and desktop name in the above URL. But, as you can see, I can specify the protocol, PCoIP or RDP and the size of the screen, in this case 1280×854. According to the docs and a blog article by Kristina De Nike at VMware you can change all sorts of things. Here’s a list from the blog.

  • View Connection Server address
  • Port number for View Connection Server
  • Active Directory user name
  • Radius or RSA SecurID user name
  • Domain name
  • Desktop display name
  • Window size
  • Desktop actions including reset, log off and roll back
  • Display protocol
  • Options for redirecting USB devices

Screen Shot 2012-11-02 at 11.37.07 AM

How do I get this so I can just click on a desktop icon, add my password and go? By creating a .URL file using a text editor. This .URL file is understood by both PC and Mac browsers and will do the right thing. Here’s the format:

[InternetShortcut]
 URL=vmware-view://mike@my.view.server.com/MikeF%20Desktop?desktopProtocol=PCoIP&desktopLayout=1280x854

Copy that into your text editor and save it as a .URL file on your Windows or Mac desktop.

How does this work with things like SecurID? <shameless plug for my employer> It works just fine. When I’m at home and I double-click the icon, I’m prompted for my SecurID credentials and then my Active Directory credentials. When I’m in the office on the corporate LAN, I’m just prompted for my Active Directory credentials. Someday, I would LOVE it if 1Password could fill in the login info, but…

Performance

This now leads me to the second thing I found out with the new VMware View clients. I was originally going to have two .URL files on the deskop. One for RDP and one for PCoIP. The reason being is that I use a USB 2.0 to DVI DisplayLink adapter from Monoprice.

image

As you can imagine, it doesn’t really have a lot of horsepower for graphics. Earlier VMware View clients for the Mac running PCoIP would choke horribly on this device. I used RDP for the past year when I wanted my virtual desktop on the monitor connected to the USB/DVI adapter. But lo and behold, I started up the new View client using PCoIP on the 2nd monitor and it works beautifully! I don’t know what VMware changed, but I sure am glad it’s working. I can now resize at will and as I write this, I have a View session going at 1440×1024 with great performance!

So, to wrap up, the new VMware View clients make it easier to launch the client just the way you like them and if you’re using DisplayLink devices like the Monoprice adapter and the DisplayLink 1.8 drivers you’ll get decent performance to boot.

I hope this was helpful. Please share your comments!

thanks,

mike

Tags:

Sep 04

Checkbox Security

Categories:

Automation, IT Security, Virtualization, VMware, VMware, vShield

by

 

Is security something that you feel you HAVE to do? Are you doing the bare minimum required by your auditor? Are you “Checking the box”?

In my role as Virtualization Evangelist, I seem to talk to mostly IT people. I endeavor to educate them on using VMware infrastructure as a layer (or multiple layer) of defense in depth. I spend a LOT of time trying to connect the dots between security and IT. I keep running into the same issues over and over.  The attitude of “I’ve got a firewall and AV so I’m ok” is pervasive.

Newflash: You’re not OK. Just ask your security guy.

There are a lot of really nasty people out there who are trying hard to get at your stuff. Firewalls are porous and AV, well, it’s not going to help you with a zero day attack. I’m not knocking firewalls and AV. They most definitely have their place as part of the “Defense in Depth” story. Just pointing out that they can’t be your ONLY solution.

Checking the Box

Sure, you can implement all the stuff that you HAVE to to check the box. You may even get the thumbs up from your auditor that you’re “Compliant”! But are you SECURE? Are you protecting the assets of the business or just covering the assets? (Read into that what you will :))

What’s needed is a sea-change in approaching security. Using every asset at your disposal is critical. With the changes coming in VMware vSphere V5.1, you’ll now have more security tools at your disposal. For example, in all editions of vSphere V5.1 is the inclusion of vShield Zones and Endpoint, providing you the ability to manage your firewalls at the vNIC level, providing increased isolation between VM’s. This is a great first step in being able to use firewalls and AV at scale.

Also, and here I go again, you need to leverage automation. Measurement of critical assets and those measurements feeding into a GRC solution like RSA Archer can help you wrap a workflow around things that need to be fixed and track if/when they do get fixed. It’s critical that the IT organization work with security by providing them the data they need to provide better security with minimal impact to the business.

What I present to customers

As I call out in my recent presentation, “Understanding the Measured Risks of Cloud Security”  this attitude of securing with just a firewall isn’t good enough. Also read the blog post “The Palace of Harmonious Virtualization” as well

I want to hear from you!

What I’d love to hear from is customers that ARE using the virtual infrastructure to provide new ways of securing their environments. Reply here or send me an email. I’d love to showcase some of your thoughts as well.

Thanks,
mike

This post has no tag

Jan 27

Virtual Desktops and Security–Leverage, Control, Enable

Categories:

IT Security, VMware, vShield

by

First, IMHO, VDI is not like the virtualization of servers where I consolidate 100 servers into 10 boxes and come out being a hero to finance because I saved $70k in A/C and electricity. The cost savings are not as blatant (and easy) as that.

Instead, in my view, VDI is an enabling technology for governance, risk and compliance. Primarily because the desktop infrastructure is now off of desktop/laptop hardware and back under control of the datacenter. This infrastructure gives me unparalleled visibility into the goings on. I can more easily monitor traffic and actions, control access and respond to bad things. I can now protect my desktops with datacenter class security.

With other technologies like vShield, I can now group VM’s in a way that aligns with the business and apply/enforce policies accordingly. eng-finWith vShield’s new Data Security feature, you are now leveraging the RSA Data Loss Prevention engine to audit your virtual machines.

For example: I can assign policies at the group bases so that the Engineering group will be scanned for PCI data and if found, it will be reported. But the finance folks, because they are trained in PCI, will only be audited. As I add new VM’s to the groups, the VM’s will fall under the appropriate policies with no special configuration. Consistency!

Leverage

Last year I talked with a customer in a government agency about VDI and security. They had a requirement that every time an analyst logs into a desktop, that the desktop was “fresh”. With VDI, that’s easy.

  • The analyst logs into a fresh desktop cloned from a gold master.
  • At the end of the shift, the desktop is moved into a different pool for forensic analysis
  • A new desktop is provisioned.

All easily automatable/scriptable and orchestrated (and you know how much I like automating things!). Because it’s all automatable, you can now do things in a consistent manner. Inconsistent events and actions will be easier to spot and react. And because all of these events are logged and processed by a SIEM I’ve now got a step up on when things DO go wrong!

Control

What this also did for the customer was shrink their window of vulnerability. How so? Well, the desktop was fresh at every shift change. The timeframe for which malware could get a hold was shrunk from weeks/months/years to an 8 hour shift. With 88% of corporations having systems infected with trojan’s and not knowing about them, this can really help mitigate bad stuff lying around!

Enable

VDI is also an enabling technology in that I, as the IT guy, can embrace new trends quicker with less risk. Look how fast the iPad has become part of the enterprise? You only have to Google “iPad Enterprise Adoption” and see study after study on this increasing trend. For example, I was talking with a customer who wanted to replace all corporate laptops for their thousands of field people with an iPad + Virtual Desktop. The key driver for this was that customer data would never resided on the endpoint. If the iPad was lost or stolen, no worries. Go expense a new one and get back to work.

In terms of inter-office usability, consider the situation where your corporate laptop has been infected (don’t let your 15yr old son use it. EVER!) and now, instead of 2 days of re-imaging downtime, the IT guy hands you a thin client and you’re back to work in minutes.

What if you lost your laptop? Well, because your only access to sensitive data is through your virtual desktop and isn’t allowed on an endpoint device like a laptop, the loss of the laptop may not need to be reported to regulatory authorities. Google “Stolen Laptop Data Breach”. And for those that say “but our laptops are encrypted!”, well, only 30% of you are doing that according to a study at the Ponemon Institute funded by Intel.

Back to work in minutes, no regulatory reporting for a stolen laptop. How does Finance measure that productivity gain/potential corporate risk?

In closing

VDI isn’t for the faint of heart nor is it for everyone. However, with the capabilities available today, you can use it to really get back the control you had back in the timesharing days (I miss you VMS!) while being flexible to adopting new technologies in a more secure way.

I’m a huge fan of VDI. I’ve been using it now for well over a year and wouldn’t give it up. I have my personal MacBook Air laptop and the only corporate info on it is some non-NDA presentations. All other EMC “stuff” is done on my VMware View desktop. This keeps that nice separation between what’s mine and what EMC’s very clear. And yes, the SSD in the Air is encrypted with FileVault!

Finally, when it comes to security, it’s no longer sufficient to just run ON a virtual platform. For security to move to the next step, it has to leverage these inherent capabilities that are presented to it. You can start today by considering a virtual desktop strategy. Just don’t forget the security tools!

Thanks,

mike

Tags: , ,

Older posts «