Intrinsic Security: Take security to the next level

The other guys will have you believe that more is better. You have a problem, just buy a solution and patch the hole. Security operations too siloed? Just cobble together some integrations and hope that everything works together. 

 

VMware thinks differently. We believe that “integrated” is just another word for “complexity.” And clearly, complexity is the enemy of security. 

 

Integrated security is bolted–on security. An example would be taking a hardware firewall and making it a blade in a data center switch. That’s what the other guys do. It makes it more convenient to deploy, but it doesn’t actually improve security. 

 

Security always performs better—and is easier to operate—when it’s designed–in as opposed to bolted–on. At VMware, we call this intrinsic security. When we think about security, being able to build it in means you can leverage the intrinsic attributes of the infrastructure. We are not trying to take existing security solutions and integrate them. We are re-imagining how security could work. 

 

Enterprises that want to learn how we’ve built security directly into Continue reading

Simplify your micro-segmentation implementations

Micro–segmentation is a critical component of Zero Trust. But, historically, micro-segmentation has been fraught with operational challenges and limited by platform capabilities.  

 

Not anymore.  

 

VMware NSX enables a new framework and firewall policy model that allows applications to define access down to the workload level. NSX does this by understanding application topologies and applying appropriate policy per workload. Creating zones in the data center where you can separate traffic by application simultaneously helps stop the spread of lateral threats, create separate development, test, and production environments, and meet certain compliance requirements. 

 

VMworld attendees who want to learn more about how to set up micro-segmentation in their data centers should consider the following sessions: 

 

 

Permit This, Deny That – Design Principles for NSX Distributed Firewall (ISNS2315D) 

Micro-segmentation is something that is certainly easier said than done. Although micro-segmentation allows applications to define access down to the component level, the operation of such an environment can be daunting without structure and guidance. In this session, you’ll learn how to develop a Continue reading

Improve the Security of Hub Container Images with Automatic Vulnerability Scans

In yesterday’s blog about improvements to the end-to-end Docker developer experience, I was thrilled to share how we are integrating security into image development, and to announce the launch of vulnerability scanning for images pushed to the Hub. This release is one step in our collaboration with our partner Snyk where we are integrating their security testing technology into the Docker platform. Today, I want to expand on our announcements and show you how to get started with image scanning with Snyk. 

In this blog I will show you why scanning Hub images is important, how to configure the Hub pages to trigger Snyk vulnerability scans, and how to run your scans and understand the results. I will also provide suggestions incorporating vulnerability scanning into your development workflows so that you include regular security checkpoints along each step of your application deployment.  

Software vulnerability scanners have been around for a while to detect vulnerabilities that hackers use for software exploitation. Traditionally security teams ran scanners after developers thought that their work was done, frequently sending code back to developers to fix known vulnerabilities. In today’s “shift-left” paradigm, scanning is applied earlier during the development and CI cycles Continue reading

IT Leader Channel at AnsibleFest 2020

Whether you have automated different domains within your business or are just getting started, creating a roadmap to automation that can be passed between teams and understood at different levels is critical to any automation strategy. 

We’ve brought back the IT Decision Maker track at AnsibleFest this year after its debut in 2019, featuring sessions that help uplevel the conversation about automation, create consensus between teams and get automation goals accomplished faster. 

 

What you can expect

There are a variety of sessions in the IT Decision Maker track. A few are focused on specific customer use cases of how they adopted and implemented Ansible. These tracks are great companions to our customer keynotes, including those from CarMax and PRA Health Sciences, that will dive into their Ansible implementation at a technical level. This track aims to cover the many constituents of automation within a business and how to bring  the right type of teams together to extend your automation to these stakeholders. 

Newcomers to AnsibleFest will get a lot out of this track, as many of the sessions are aimed at those with a beginner’s level knowledge of Ansible Automation Platform and its hosted services. Those Continue reading

IBM set to spin-off managed service business to focus on hybrid cloud

IBM doesn’t want any distractions on the road to becoming a prodigious hybrid-cloud player, and today it eliminated one of those diversions by spinning off the $19 billion Managed Infrastructure Services unit of its Global Technology Services division.The move creates an as-yet-unnamed firm, tentatively dubbed “NewCo,” which won’t actually be created until 2021 but will quickly be a big provider of managed infrastructure services. It will employ about 90,000 staffers, have more than 4,600 clients in 115 countries—including more than 75% of the Fortune 100—have a backlog of $60 billion in orders, and more than twice the scale of its nearest competitor, IBM stated. That would include Accenture, Fujitsu and Huawei.To read this article in full, please click here

Community Networks: Improving Connectivity for All in Haiti

The COVID-19 pandemic reminds us of the historic transition brought about by the Internet. Its place is real in our lives today and tomorrow. Celebrate, pray, play, study, work, express yourself … these verbs have been conjugated thousands of times everywhere thanks to the Internet. In Haiti, many suffer from the glaring inequality between Internet access in rural and urban areas. It is clear that tackling these problems comes down to building a safe path towards decentralization of Internet infrastructure here.

The mission of the Internet Society Haiti Chapter (ISOC Haiti) is to promote, on Haitian territory and for the benefit of all, the conditions and tools conducive to the development of an information and knowledge society – respectful of Haitian culture and values. Since 1804, our nation has raised its voice for freedom and equality so that every person may live free and in dignity, while banishing Black slavery on our land. Our motto, ‘’unity is strength,’’ reminds us that together we can achieve unimaginable things to change this nation. ISOC Haiti ​​is aware of the challenges and believes it is time for a sustainable plan of action – and not for speech.

Poor quality and expensive Internet access Continue reading

IBM Jettisons Legacy Services To Focus On Hybrid Cloud

Today, the Gerstner era of International Business Machines is over, and the Krishna era is truly beginning, as Big Blue is spinning out the system outsourcing and hosting business that gave it an annuity-like revenue stream – and something of an even keel – in some rough IT infrastructure waters for two over decades. …

IBM Jettisons Legacy Services To Focus On Hybrid Cloud was written by Timothy Prickett Morgan at The Next Platform.

Meet SONiC, the new NOS (definitely not the same as the old NOS)

The open-sourced Software for Open Networking in the Cloud (SONiC) NOS is rapidly growing a community of developers and users that could change the way many networks are run by large enterprises, hyperscalers and service providers.The Linux-based NOS, developed and open sourced by Microsoft in 2017, decouples network software from the underlying hardware and lets it run on switches and ASICs from multiple vendors while supporting a full suite of network features such as Border Gateway Protocol (BGP), remote direct memory access (RDMA), QoS, and  other Ethernet/IP technologies.One of the keys to SONiC is its the switch-abstraction Interface, which defines an API to provide a vendor-independent way of controlling forwarding elements such as a switching ASIC, an NPU or a software switch in a uniform manner, according to the SONiC GitHub community site.To read this article in full, please click here

Considerations for using IaC with Cluster API

In other posts on this site, I’ve talked about both infrastructure-as-code (see my posts on Terraform or my posts on Pulumi) and somewhat separately I’ve talked about Cluster API (see my posts on Cluster API). And while I’ve discussed the idea of using existing AWS infrastructure with Cluster API, in this post I wanted to try to think about how these two technologies play together, and provide some considerations for using them together.

I’ll focus here on AWS as the cloud provider/platform, but many of these considerations would also apply—in concept, at least—to other providers/platforms.

In no particular order, here are some considerations for using infrastructure-as-code and Cluster API (CAPI)—specifically, the Cluster API Provider for AWS (CAPA)—together:

  • If you’re going to need the CAPA workload clusters to have access to other AWS resources, like applications running on EC2 instances or managed services like RDS, you’ll need to use the additionalSecurityGroups functionality, as I described in this blog post.
  • The AWS cloud provider requires certain tags to be assigned to resources (see this post for more details), and CAPI automatically provisions new workload clusters with the AWS cloud provider when running on AWS. Thus, you’ll want to make Continue reading

Link State in DC Fabrics

If you don’t normally read IPJ, you should. Melchoir and I have an article up in the latest edition on link state in DC fabrics.

To make a case for linkstate protocols in DC fabric underlays, an extensive examination of the positive and negative aspects of BGP—and the other available protocols—is essential. Ultimately, it is up to individual operators to decide which protocol is “the best” for their application, a decision based on business and operational—as well as technical—reasons.

Read the whole thing here.

Culture at AnsibleFest 2020

At Red Hat, we’ve long recognized that the power of collaboration enables communities to achieve more together than individuals can accomplish on their own. Developing an organizational culture that empowers communities to flourish and collaborate -- whether in an open source community or for an internal community of practice -- isn’t always straightforward. This year at AnsibleFest, the Culture topic aims to demystify some of these areas by sharing the stories, practices, and examples that can get you on your path to better collaboration. 

 

Culture at AnsibleFest: “Open” for participation

Because we recognize that culture is not a “one size fits all” topic, we’ve made sure to sprinkle nearly every track at AnsibleFest with relevant content to help every type of Ansible user (or manager of Ansible users!) participate in developing healthy cultures and communities of automation inside their organizations. 

Whether you’re interested in contributing to open source communities, learning how others have grown the use of Ansible inside their departments or organizations, or if you’re simply interested in building healthy, diverse, inclusive communities, inside or outside the workplace -- the Culture (cross) Channel at AnsibleFest has you covered. 

 

Be a Cultural Catalyst for Continue reading

Network Automation Products for Brownfield Deployments

Got this question from one of my long-time readers:

I am looking for commercial SDN solutions that can be deployed on top of brownfield networks built with traditional technologies (VPC/MLAG, STP, HSRP) on lower-cost networking gear, where a single API call could create a network-wide VLAN, or apply that VLAN to a set of ports. Gluware is one product aimed at this market. Are there others?

The two other solutions that come to mind are Apstra AOS and Cisco NSO. However, you probably won’t find a simple solution that would do what you want to do without heavy customization as every network tends to be a unique snowflake. 

Read more …

Network Automation Products for Brownfield Deployments

Got this question from one of my long-time readers:

I am looking for commercial SDN solutions that can be deployed on top of brownfield networks built with traditional technologies (VPC/MLAG, STP, HSRP) on lower-cost networking gear, where a single API call could create a network-wide VLAN, or apply that VLAN to a set of ports. Gluware is one product aimed at this market. Are there others?

The two other solutions that come to mind are Apstra AOS and Cisco NSO. However, you probably won’t find a simple solution that would do what you want to do without heavy customization as every network tends to be a unique snowflake. 

Read more …

Extend Your Fortinet FortiManager to Kubernetes

Companies are leveraging the power of Kubernetes to accelerate the delivery of resilient and scalable applications to meet the pace of business. These applications are highly dynamic, making it operationally challenging to securely connect to databases or other resources protected behind firewalls.

Visibility into Kubernetes Infrastructure is Essential

Lack of visibility has compliance implications. Like any on-premises or cloud-based networked services, Kubernetes production containers must address both organizational and regulatory security requirements. If compliance teams can’t trace the history of incidents across the entire infrastructure, they can’t adequately satisfy their audit requirements. To enable the successful transition of Kubernetes pilot projects to enterprise-wide application rollouts, companies must be able to extend their existing enterprise security architecture into the Kubernetes environment.

In response, Fortinet and Tigera jointly developed a suite of Calico Enterprise solutions for the Fortinet Security Fabric that deliver both north-south and east-west visibility and help ensure consistent control, security, and compliance. Key among these integrations is the FortiManager Calico Kubernetes Controller, which enables Kubernetes cluster management from the FortiManager centralized management platform in the Fortinet Fabric Management Center.

View and Control the Kubernetes Environment with FortiManager

The FortiManager Calico Kubernetes Controller translates FortiManager policies into granular Kubernetes network Continue reading

Pluribus goes big to support larger, multi-vendor data center networks

Pluribus has fine-tuned its switch fabric software to support larger, distributed multi-vendor data centers. Specifically, the company has enabled its Adaptive Cloud Fabric to scale from its current level of support for 64 nodes to up to 1,024 switches in a unified fabric. The scale-up is part of the company's recently upgraded core network operating system, Netvisor One, which is a virtualized Linux-based NOS that provides Layer 2 and Layer 3 networking and distributed fabric intelligence. The NOS virtualizes switch hardware and implements the company's Adaptive Cloud Fabric. Adaptive Cloud Fabric operates without a controller and can be deployed across a single data center, or targeted to specific racks, pods, server farms or hyperconverged infrastructures, the company said.To read this article in full, please click here

Pluribus goes big to support larger, multi-vendor data center networks

Pluribus has fine-tuned its switch fabric software to support larger, distributed multi-vendor data centers. Specifically, the company has enabled its Adaptive Cloud Fabric to scale from its current level of support for 64 nodes to up to 1,024 switches in a unified fabric. The scale-up is part of the company's recently upgraded core network operating system, Netvisor One, which is a virtualized Linux-based NOS that provides Layer 2 and Layer 3 networking and distributed fabric intelligence. The NOS virtualizes switch hardware and implements the company's Adaptive Cloud Fabric. Adaptive Cloud Fabric operates without a controller and can be deployed across a single data center, or targeted to specific racks, pods, server farms or hyperconverged infrastructures, the company said.To read this article in full, please click here

Intel, Nvidia launch new networking processor initiatives

In recent days Intel and Nvidia have introduced or announced new networking products with a common goal of offloading networking traffic to the network processor, thus freeing up the CPU for computational work.Intel announced a new networking initiative to capitalize on what it calls “a perfect storm of 5G, edge buildout and pervasive artificial intelligence” with an expanded lineup of hardware, software and solutions for network infrastructure.This includes enhancements to Intel’s software reference architecture, FlexRAN; Intel virtualized radio access network (vRAN) dedicated accelerator; network-optimized next-generation Intel Xeon Scalable and D processors (codenamed “Ice Lake”); and upgraded Intel Select Solutions for Network Function Virtualization Infrastructure (NFVI).To read this article in full, please click here

Intel, Nvidia launch new networking processor initiatives

In recent days Intel and Nvidia have introduced or announced new networking products with a common goal of offloading networking traffic to the network processor, thus freeing up the CPU for computational work.Intel announced a new networking initiative to capitalize on what it calls “a perfect storm of 5G, edge buildout and pervasive artificial intelligence” with an expanded lineup of hardware, software and solutions for network infrastructure.This includes enhancements to Intel’s software reference architecture, FlexRAN; Intel virtualized radio access network (vRAN) dedicated accelerator; network-optimized next-generation Intel Xeon Scalable and D processors (codenamed “Ice Lake”); and upgraded Intel Select Solutions for Network Function Virtualization Infrastructure (NFVI).To read this article in full, please click here

1 … 868 869 870 871 872 … 3,834