Category: Written while at RSA

Feb 11

Securing Virtual Desktops with Brian Gracely & TheCloudcast.Net

On Thursday, Feb 9th, I drove from RSA HQ in Bedford, MA to EMC HQ in Hopkinton to spend some time with Brian Gracely (Twitter:@bgracely)and do a podcast and whiteboard session on security and virtual desktops.

Brian is the Director of Technology Solutions and Strategy at EMC and one of the co-hosts of TheCloudcast.(NET) along with Aaron Delp. (Twitter:@aarondelp) If you haven’t heard of The Cloudcast you’ve been missing out! It’s a wealth of knowledge sharing with some of the real leaders in the virtualization and cloud space.

This was my second time on The Cloudcast. My first time was as part of a panel at VMworld 2011 where I discussed vCloud and security with Brian, Aaron and VMware’s Chris Colotti, (Twitter:@ccolotti) a vCloud rockstar.

I really enjoy these social media opportunities! I like sharing knowledge but more than that, I like hanging out with people smarter than me. It really raises my game and gets the creative juices flowing!

Out of discussions like this I’ve come up with novel ways to solve problems, opened my eyes to a different way of thinking and even came up with a patent application that I’m hoping to be able to talk about soon.

In our discussion, Brian and I built upon some of the points I made in a previous blog posting on Virtual Desktops and Security. Take a moment to read that and then listen to the audio and check out the video whiteboard.

So, without further adieu, I’d like to redirect you over to our podcast and video on Securing Virtual Desktops and my thoughts on Bring Your Own Device (BYOD).

Securing Virtual Desktops TheCloudcast.(NET)

I hope you enjoy it as much as we did making it and that it helps you in your virtual desktop strategy. If you have questions, reach me on Twitter or send me an email.

Thanks!

mike
@mikefoley

Jan 27

Virtual Desktops and Security–Leverage, Control, Enable

First, IMHO, VDI is not like the virtualization of servers where I consolidate 100 servers into 10 boxes and come out being a hero to finance because I saved $70k in A/C and electricity. The cost savings are not as blatant (and easy) as that.

Instead, in my view, VDI is an enabling technology for governance, risk and compliance. Primarily because the desktop infrastructure is now off of desktop/laptop hardware and back under control of the datacenter. This infrastructure gives me unparalleled visibility into the goings on. I can more easily monitor traffic and actions, control access and respond to bad things. I can now protect my desktops with datacenter class security.

With other technologies like vShield, I can now group VM’s in a way that aligns with the business and apply/enforce policies accordingly. eng-finWith vShield’s new Data Security feature, you are now leveraging the RSA Data Loss Prevention engine to audit your virtual machines.

For example: I can assign policies at the group bases so that the Engineering group will be scanned for PCI data and if found, it will be reported. But the finance folks, because they are trained in PCI, will only be audited. As I add new VM’s to the groups, the VM’s will fall under the appropriate policies with no special configuration. Consistency!

Leverage

Last year I talked with a customer in a government agency about VDI and security. They had a requirement that every time an analyst logs into a desktop, that the desktop was “fresh”. With VDI, that’s easy.

  • The analyst logs into a fresh desktop cloned from a gold master.
  • At the end of the shift, the desktop is moved into a different pool for forensic analysis
  • A new desktop is provisioned.

All easily automatable/scriptable and orchestrated (and you know how much I like automating things!). Because it’s all automatable, you can now do things in a consistent manner. Inconsistent events and actions will be easier to spot and react. And because all of these events are logged and processed by a SIEM I’ve now got a step up on when things DO go wrong!

Control

What this also did for the customer was shrink their window of vulnerability. How so? Well, the desktop was fresh at every shift change. The timeframe for which malware could get a hold was shrunk from weeks/months/years to an 8 hour shift. With 88% of corporations having systems infected with trojan’s and not knowing about them, this can really help mitigate bad stuff lying around!

Enable

VDI is also an enabling technology in that I, as the IT guy, can embrace new trends quicker with less risk. Look how fast the iPad has become part of the enterprise? You only have to Google “iPad Enterprise Adoption” and see study after study on this increasing trend. For example, I was talking with a customer who wanted to replace all corporate laptops for their thousands of field people with an iPad + Virtual Desktop. The key driver for this was that customer data would never resided on the endpoint. If the iPad was lost or stolen, no worries. Go expense a new one and get back to work.

In terms of inter-office usability, consider the situation where your corporate laptop has been infected (don’t let your 15yr old son use it. EVER!) and now, instead of 2 days of re-imaging downtime, the IT guy hands you a thin client and you’re back to work in minutes.

What if you lost your laptop? Well, because your only access to sensitive data is through your virtual desktop and isn’t allowed on an endpoint device like a laptop, the loss of the laptop may not need to be reported to regulatory authorities. Google “Stolen Laptop Data Breach”. And for those that say “but our laptops are encrypted!”, well, only 30% of you are doing that according to a study at the Ponemon Institute funded by Intel.

Back to work in minutes, no regulatory reporting for a stolen laptop. How does Finance measure that productivity gain/potential corporate risk?

In closing

VDI isn’t for the faint of heart nor is it for everyone. However, with the capabilities available today, you can use it to really get back the control you had back in the timesharing days (I miss you VMS!) while being flexible to adopting new technologies in a more secure way.

I’m a huge fan of VDI. I’ve been using it now for well over a year and wouldn’t give it up. I have my personal MacBook Air laptop and the only corporate info on it is some non-NDA presentations. All other EMC “stuff” is done on my VMware View desktop. This keeps that nice separation between what’s mine and what EMC’s very clear. And yes, the SSD in the Air is encrypted with FileVault!

Finally, when it comes to security, it’s no longer sufficient to just run ON a virtual platform. For security to move to the next step, it has to leverage these inherent capabilities that are presented to it. You can start today by considering a virtual desktop strategy. Just don’t forget the security tools!

Thanks,

mike

Jan 25

Computer Security History–The Cuckoo’s Egg and Visibility

Here’s a quick blog article about name dropping…er…my brushes with computer security history.

For those that don’t know, there was a book written in 1989 call “The Cuckoo’s Egg: Tracking a Spy Through imagethe Maze of Computer Espionage”. It’s a fascinating look into one of the first fully documented hacking events in computer history. The author, Cliff Stoll, did a very good job at keeping a log of all the goings on and that information helped set the balls in motion around jurisdiction and information sharing. (credit Wikipedia) The book is set in 1986, long before the Internet and the web. This woke up authorities to the dangers of malicious hacking.

I don’t know or have ever met Cliff unfortunately. I have, however, met three people mentioned in the first few pages. What prompted me to post this was that in my Dinner with Infamy post, some familiar names popped up. In that post, I write about my dinner with hacker Kevin Mitnick. In Kevin’s book, The Ghost In the Wires, Kevin mentions the names of a few friends of mine. One of the people mentioned at the beginning of both books is Andy Goldstein.

Andy is one of the most talented software engineers on this planet. Incredibly brilliant and someone I’m lucky enough to call my friend. I worked with & for Andy back at DEC on the VAX/VMS 6.0 release and I still see him about once or twice a year. Andy helped Cliff with some aspects of computer security at the time. He also taught me a bunch about computer security back in the day. (when I ran one of the first firewalls in DEC!)

Two other people, mentioned in the first page or two are Wayne Graves and Dave Cleveland. In one of my roles in the VMS Development Group at DEC was one of working on the beta releases. As part of that job, I would visit customers who were running beta versions of VAX/VMS 6.0 and make sure the beta was going smoothly. I was their central technical contact during this time.

Wayne worked for http://www.axarosenberg.com/ after his time at Laurence Berkeley National Lab. He ran beta versions of everything and I would fly out to San Fran and stay near his office in Orinda for about 3 days. We’d hang out, drink wine and I’d help him with technical stuff and making sure he had everything he needed for the beta. I did this for about 2 years, flying out every 3-6 months. It got so that the bartender (Seamus) at a pub called Fiddlers Green down near Fisherman’s Wharf would recognize me when I walked in and he’d start pouring me a pint of Guinness. There’s a side story there were I ALMOST got to go drinking with John Lee Hooker and Van Morrison but, alas, I had to leave early to get up to have breakfast the next morning with….

…Dave Cleveland. The other systems admin in the book. He was still working at Laurence Berkeley, in the same office he worked in when Cliff was there. Shortly before heading out to see him, I watched the PBS Nova adaptation of the book.

This video is up on YouTube if you want to watch.

It was filmed at LBL. I went to meet Dave for breakfast the next morning after my close brush with famous rockers and as I was walking thru the halls, I realized that I was in the SAME place that was shown 9 seconds into the video.

Needless to say, that was one of the coolest moments of my geek life. Almost as good as getting ripped with Van who, according to Seamus, the next morning couldn’t find his limo. When I asked where it was, Seamus responded with “Right in front of him!”

That’s my true story and I’m stickin’ too it.

In summary, the same concepts used in this book by Cliff still apply today. Logging actions taken by users (real or hacked), correlating information and understanding your vulnerabilities still stand. The difference is that today, you can’t write your log information in a log book. Things are happening WAY too fast. You need a Security Incident and Event Management tool, especially in the fluid environment of the virtual infrastructure.

Visibility is key. If you’re at EMCworld, I’ll be giving a session entitled “You Can’t Manage What You Can’t See: Visibility for the Virtual World”

I hope to see you there,

mike