An introduction to Zero Trust virtualization-centric security
This post will be the first in a series that examine what I think are some of the powerful security capabilities of the VMware NSX platform and the implications to the data center network architecture. In this post we’ll look at the concepts of Zero Trust (as opposed to Trust Zones), and virtualization-centric grouping (as opposed to network-centric grouping).
Note: Zero Trust as a guiding principle to enterprise wide security is inspired by Forrester’s “Zero Trust Network Architecture”.
What are we trying to accomplish?
We want to be able to secure all traffic in the data center without compromise to performance (user experience) or introducing unmanageable complexity. Most notably the proliferation of East-West traffic; we want to secure traffic between any two VMs, or between any VM and physical host, with the best possible security controls and visibility – per flow, per packet, stateful inspection with policy actions, and detailed logging – in a way that’s both economical to obtain and practical to deploy.
Trust Zones of Insecurity
Until now, it hasn’t been possible (much less economically feasible or even practical) to directly connect every virtual machine to its own port on a firewall. Because of this, the Continue reading
An introduction to Zero Trust virtualization-centric security
This post will be the first in a series that examine what I think are some of the powerful security capabilities of the VMware NSX platform and the implications to the data center network architecture. In this post we’ll look at the concepts of Zero Trust (as opposed to Trust Zones), and virtualization-centric grouping (as opposed to network-centric grouping).
Note: Zero Trust as a guiding principle to enterprise wide security is inspired by Forrester’s “Zero Trust Network Architecture”.
What are we trying to accomplish?
We want to be able to secure all traffic in the data center without compromise to performance (user experience) or introducing unmanageable complexity. Most notably the proliferation of East-West traffic; we want to secure traffic between any two VMs, or between any VM and physical host, with the best possible security controls and visibility – per flow, per packet, stateful inspection with policy actions, and detailed logging – in a way that’s both economical to obtain and practical to deploy.
Trust Zones of Insecurity
Until now, it hasn’t been possible (much less economically feasible or even practical) to directly connect every virtual machine to its own port on a firewall. Because of this, the Continue reading
An introduction to Zero Trust virtualization-centric security
This post will be the first in a series that examine what I think are some of the powerful security capabilities of the VMware NSX platform and the implications to the data center network architecture. In this post we’ll look at the concepts of Zero Trust (as opposed to Trust Zones), and virtualization-centric grouping (as opposed to network-centric grouping).
Note: Zero Trust as a guiding principle to enterprise wide security is inspired by Forrester’s “Zero Trust Network Architecture”.
What are we trying to accomplish?
We want to be able to secure all traffic in the data center without compromise to performance (user experience) or introducing unmanageable complexity. Most notably the proliferation of East-West traffic; we want to secure traffic between any two VMs, or between any VM and physical host, with the best possible security controls and visibility – per flow, per packet, stateful inspection with policy actions, and detailed logging – in a way that’s both economical to obtain and practical to deploy.
Trust Zones of Insecurity
Until now, it hasn’t been possible (much less economically feasible or even practical) to directly connect every virtual machine to its own port on a firewall. Because of this, the Continue reading
The 24 Rules I Work By – Infographic
I came across this infographic from Anna Vital of Funders and Founders and loved it. As relevant as some of it is, there is an obvious focus on running a startup and not working in IT. Because of that I thought it might be useful to do something similar around the ‘rules’ I work by; my workplace and career philosophy […]
Author information
The post The 24 Rules I Work By – Infographic appeared first on Packet Pushers Podcast and was written by Steven Iveson.
Perspective on Arista IPO and Market Positioning
For the last 20 years, a “silicon moat” that has protected Cisco and other networking vendors from market competition. Arista was one of the first startups to embrace merchant silicon,open source software and a modern software development methodology to focus on core value like reliability and features.
The post Perspective on Arista IPO and Market Positioning appeared first on EtherealMind.
Briefing: HP Helion, Virtual Cloud Networking, FlexFabric 7900, SDN and OpenStack at HP Discover
HP Discover is happening this week and have three announcements that I'm summarising here. They are Virtual Cloud Network (VCN), FlexFabric 7900 switch and a supporting package of consulting to implement cloud in your organisation.
The post Briefing: HP Helion, Virtual Cloud Networking, FlexFabric 7900, SDN and OpenStack at HP Discover appeared first on EtherealMind.
Introduction and LAB tutorial of HP Helion Community Edition, the OpenStack based “cloud” system that can give you a personal cloud!
For best article visual quality, open Introduction and LAB tutorial of HP Helion Community Edition, the OpenStack based “cloud” system that can give you a personal cloud! directly at NetworkGeekStuff.
Hewlett-Packard (HP) is a long enterprise supporter of cloud technologies and early this year, they released publicly HP Helion Community Edition (CE). HP Helion is HP’s OpenStack based cloud system with which HP plans to provide value added services (both in sense of software and service) with the upcoming release of HP Helion Enterprise edition later this year. In this article, I plan to introduce you to the HP Helion CE, quickly guide you through the installation, basic operations and in the end get you a quick view on the OpenStack architecture in general.
HP and “clouds”
For a long time HP has been providing cloud solution based on their internal Cloud Service Automation or “CSA” system to enterprise grade customers as part of their portfolio. I had access to several projects using this environment and although I still have mixed feelings about their effectiveness, they were a step in the right direction as classical (now called “legacy”) data-centers are loosing popularity to cloud and other automated systems. The Continue reading
Snort rules for Etumbot
Since publication of the Etumbot blog on Friday, June 6th, we’ve received numerous requests to publish Snort rules for the network indicators described therein. You can find Snort rules for the Etumbot C&C communications on Arbor’s github at
https://github.com/arbor/snort/blob/master/etumbot.rules
While we are not Snort syntax experts, we have performed basic testing for the Etumbot communications we’ve been able to observe over the wire. Specifically, the first three Snort rules for Etumbot RC4 Key Request, Etumbot Registration Request, and EtumBot Ping all triggered successfully when the corresponding network traffic was observed.
Remember to change the SIDs as appropriate for your environment. We also anticipate these rules will be incorporated into the EmergingThreats Open feed in the very near term.
RESTful control of Cumulus Linux ACLs
 |
| Figure 1: Elephants and Mice |
This article demonstrates a self contained real-time Elephant flow marking solution that leverages the visibility and control features of Cumulus Linux.
SDN fabric controller for commodity data center switches provides some background on the capabilities of the commodity switch hardware used to run Cumulus Linux. The article describes how the measurement and control capabilities of the hardware can be used to maximize data center fabric performance:
- Visibility: Cumulus recently added sFlow support, providing the network wide visibility needed for control - see Cumulus Networks, sFlow and data center automation.
- Control: Cumulus Linux Netfilter (ACLs) describes how standard Linux ebtables / iptables configuration files are used to manage the ACL/policy capabilities of the hardware.
For example, the following command creates a filter called Continue reading
Network Diagrams: Font Selection and Production Context. Choosing Slab or Thin fonts
Sometimes it looks right in the drawing tool but doesn't look right in the document. I forgot about balancing the image with the way that it looks on the page with words around it. Another post in my series on Network Diagrams.
The post Network Diagrams: Font Selection and Production Context. Choosing Slab or Thin fonts appeared first on EtherealMind.
Show 191 – Netvisor – the Pluribus Network Hypervisor – Sponsored
Pluribus Networks has a unique approach to Software Defined Networking that turns a network switch into a server and application platform. In this sponsored show, Sunay Tripathi deep dives into Netvisor and explains how it can fit into your network architecture.
Author information
The post Show 191 – Netvisor – the Pluribus Network Hypervisor – Sponsored appeared first on Packet Pushers Podcast and was written by Greg Ferro.
[minipost] Mikrotik/RouterBoard port-knocking example for firewall/NAT openings
For best article visual quality, open [minipost] Mikrotik/RouterBoard port-knocking example for firewall/NAT openings directly at NetworkGeekStuff.
The situation is very simple, you are away from home (imagine visiting a friend or being at work), but you desperately would like to access your internal LAN FTP/Samba/etc… , but you do not have with you your own notebook or any device with a VPN capability to tunnel to your home securely. So what to do ? You do not really want to open your home firewall and NAT whole internet to the internal PC or server on your LAN. Lucky for you, there exists a trick under a name of “port-knocking” where you can send to your home firewall a sequence of TCP or UDP packets with specific ports (the ports act as a password) and your home system can temporarily open the firewall and NAT to only your source IP from which these packets arrived. In this quick example I will show you how to do this on Mikrotik (where I do this for several years now) and I will point you to generic linux tutorial for the same using iptables in links below.
Main Example
Target: I want to access my Continue reading
Giving a Monkey a Loaded Gun
Automating the configuration, provisioning, and management of particular workflows for cloud gets a lot of attention these days. While automation makes perfect sense for deploying workloads faster, there are also other areas where automation can be leveraged to improve the overall operational efficiency of the IT Ops team.
One of these areas is automating the validation of configuration changes. This could mean validating changes deployed via the CLI for existing networks or validating changes made by SDN controllers for those new shiny physical AND virtual networks. It doesn’t matter. Connectivity tests can also be automated. Much more can be automated than configuration and policy for data centers.
I remember doing annual power shutdowns of the data center and IDFs where I worked years ago. I remember doing OS upgrades on critical network devices. I also remember the chaos and the amount of people that needed to be on a bridge validating “everything looked okay” when the devices came back online. Was everything always okay? Hardly, but it wasn’t until business started on the following Monday, those one off issues were uncovered and fixed. If there were tools verifying routing tables, Continue reading
I remember doing annual power shutdowns of the data center and IDFs where I worked years ago. I remember doing OS upgrades on critical network devices. I also remember the chaos and the amount of people that needed to be on a bridge validating “everything looked okay” when the devices came back online. Was everything always okay? Hardly, but it wasn’t until business started on the following Monday, those one off issues were uncovered and fixed. If there were tools verifying routing tables, Continue reading
Cisco COO Claims Amazon as Huge Customer and Other Insights
In this transcript from Seeking Alpha, Gary Moore, Chief Operating Office of Cisco claims that " eight of the global ten over-the-top providers like Amazon are huge Cisco customers". For network architect & strategy types, it's worth reading to see how Cisco intends to extract more revenue from your budget. In particular there are several references to Cisco "analytics service offerings" which Mr Moore states are opportunities for upsell in SmartNet maintenance. It might be worth looking into those products to prepare a "defense against the dark arts" from Cisco account managers.
The post Cisco COO Claims Amazon as Huge Customer and Other Insights appeared first on EtherealMind.
Understand Etherchannel Load Balancing.
Let’s try to define what EtherChannel is and why it exists nowadays as a powerful feature.
Author information
The post Understand Etherchannel Load Balancing. appeared first on Packet Pushers Podcast and was written by Michał Janowski.
Glue Networks at ONUG 2014
Glue Networks had a presence at the last ONUG, where Tom Hollingworth was able to get an overview from Glue’s founder, Jeff Gray:
As you can see, Glue’s product targets the WAN, and specifically addresses the difficult provisioning tasks that most shops do manually. These include but are not limited to:
- Provisioning (and deprovisioning) of QoS resources for various applications like SAP and Lync based off of need and time of day.
- Bringing up remote sites in a standardized, cookie-cutter manner
- Creating and changing PfR (performance routing) configurations on the WAN.
Jeff visited our Tech Field Day round table at ONUG 2014 and gave us a more detailed introduction to the product:
First, some things I think this product does (or will do) well. The configuration of PfR or QoS en masse is a low-hanging use case I’ve mentioned before and even if I can do it using scripts today, having a single tool that does it in a simple way will provide value. These specific configurations are difficult and error-prone, so anything that tackles this is going to be useful.
I also did enjoy hearing about the options for getting the config onto the device. Jeff listed three options for Continue reading
Glue Networks at ONUG 2014
Glue Networks had a presence at the last ONUG, where Tom Hollingworth was able to get an overview from Glue’s founder, Jeff Gray: As you can see, Glue’s product targets the WAN, and specifically addresses the difficult provisioning tasks that most shops do manually. These include but are not limited to: Provisioning (and deprovisioning) of QoS resources for various applications like SAP and Lync based off of need and time of day.Glue Networks at ONUG 2014
Glue Networks had a presence at the last ONUG, where Tom Hollingworth was able to get an overview from Glue’s founder, Jeff Gray: As you can see, Glue’s product targets the WAN, and specifically addresses the difficult provisioning tasks that most shops do manually. These include but are not limited to: Provisioning (and deprovisioning) of QoS resources for various applications like SAP and Lync based off of need and time of day.Illuminating The Etumbot APT Backdoor
The Arbor Security Engineering Response Team (ASERT) has released a research paper concerning the Etumbot malware.
Etumbot is a backdoor used in targeted attacks since at least March 2011. Indicators suggest that Etumbot is associated with the Numbered Panda group, also known as IXEHSE, DynCalc, and APT12. Although previous research has covered related malware, little has been publicly discussed regarding Etumbot’s capabilities.
Indicators suggest that the Etumbot dropper is delivered via spear phishing and is contained inside an archive file intended to be of interest to the target. The attackers use the Unicode Right to Left Override technique and document icons to disguise malicious executable content as document files. Once the dropper is executed, the backdoor is activated and a distraction file of interest to the target is opened for viewing. ASERT has observed several Etumbot samples using distraction documents involving Taiwanese and Japanese topics of interest, and has also observed recent development activity which indicates that attack campaigns are ongoing.
Once installed, the backdoor connects to it’s Command & Control server and receives an encryption key. RC4 encryption, along with HTTP transactions intended to blend in with typical traffic are used for backdoor communications. Etumbot’s core functionality Continue reading
Platforms, Code, and Why I do it
If you read this site often, you already know I’ve been doing quite a bit of work with Ansible specifically as it pertains to networking. While I will be showing another video very soon in a follow up post, I wanted to take a step back and cover a few things before doing so. The focus here is less about the technology and more my general mindset around automation PLATFORMS, code, open source, and why I do it. Just something I’d like to share because I’m occasionally asked questions around these topics.
Culture
It’s not about the tool, in my case Ansible, it’s about the process, methodology, and ideas that go into thinking differently. For me personally, Ansible just had a lower barrier for entry, but I’ve grown to quite like it. Actually, I liked it from the get-go. In order to effectively embrace platforms like Ansible, there needs to be a change in culture first. It was amazing to see the emphasis on culture during the recent DevOps days in Pittsburgh. I tuned in and out during the live stream and it seemed every time I had a chance to watch, it Continue reading
It’s not about the tool, in my case Ansible, it’s about the process, methodology, and ideas that go into thinking differently. For me personally, Ansible just had a lower barrier for entry, but I’ve grown to quite like it. Actually, I liked it from the get-go. In order to effectively embrace platforms like Ansible, there needs to be a change in culture first. It was amazing to see the emphasis on culture during the recent DevOps days in Pittsburgh. I tuned in and out during the live stream and it seemed every time I had a chance to watch, it Continue reading