One of the reasons why the corporate jets or company they're adopting an 860 is due to its security
is that unless it's to provide a tight layer of security and the security is very much uniform throughout
the VM containers cloud everywhere you have this uniformity.
First of all and we have the visibility into how we can push the policy security policy from the management
plan to the controller and the data plan not only this but we have really at once type of security as
well that we discuss in the upcoming slides.
So it's very granular in terms of like we can apply.
So for example micro segmentation.
We have distributed firewall.
We have a gateway firewall.
We can integrate with IBS ideas.
So the summary of all these things is that that because we have so much control about VM workload cloud
integration everything is control and manage from one of the controller.
So for example from the management plane.
So that's the reason we have the full control visibility and then we can apply advance layer of security.
And that's the key we have inside the NSX.
So let's dig deeper inside.
What type of security features we have.
And one by one will go in a study about that.
So first of all say for example striking with firewall we have two different type of firewall.
One is here you can see the distributed firewall and other mode is if for example Gateway firewall so
we can integrate both against the great firewall the distributed firewall although they are implemented
at the hypervisor colonel level and that's the reason they can deliver micro segmentation act the work
load cable or the winning level.
So you see that it's very close to the workload and there we can create segments and then we can provide
some sort of security.
So for example my NSX TI or Cisco ACA model all these new data center solution they are supporting are
they have a zero crust model even NSX Key also they're by default they're not trusting in anything today
they are they having the zero crust model if you want to trust something you have to create to rule
from the management plan and you have to push through the data plan.
So we'll see that they have this hypervisor kernel Dave DFW building and then the micro segmentation
because they have such type of a structure they are supporting very tight layer of micro segmentation
there are few cases that people they have the Cisco ACA but skillful micro segmentation and other security
features on top of ACA.
They are using other software data centers software or automation solution like NSX.
So that's again one of the popularity we have because we can very easily in in ECI or in other datacenter
solution provide the rules like we can do inside NSX.
Yeah I mean you can see the scalability and the adoption of the NSX fee that they are mighty hypervisor
supported.
Mighty cloud supported mighty container supported.
They can support virtual and the physical form factors.
So everything is supported now it is they're agnostic to compute domains supporting hypervisor manage
with a different compute managers means there are my tie compute support and my hypervisor supported.
And that's the reason that they can do this micro segmentation because see this is huge feature inside
and it's actually this micro segmentation this firewall it can sense layer three layer four layer 7
and they can put metadata inside the application or they can sense the application with their metadata
so they can take that make a data in the zip packet they can insert that McGarrigle so firewall can
identify oh this particular small bit of data belongs to a studio be honest with your peers or if it's
a crime then according to that they can take action as per whatever rules we have created and as it's
figured we firewalls of the centralized so here we can see the second flavor that we have the firewall
gateway so one is distributed firewall either one is the gateway firewall and in conjunction with say
DFW and Gateway firewall they can work together and they can provide tight layer of security.
Apart from that this gateway and the distributed firewall they can integrate with IP as I guess system
as well.
So remember what's the key we have we are able to track the application idea or the maker giga and then
we can take the action.
So my firewall can take action my IP is ideas can sense the application signature and take the action
the agency.
Now we have more and more set of security features so we have firewall we have distributed of firewall
so firewall in terms of the closer to deliver firewall we can create segmentation in the network we
can integrate with IP as ideas apart from that we can create dynamic grouping of objects into logical
common construct like groups so that is again when enhanced feature we have now so in general when we
Australia is a firewall I them we can create the group of objects for example network or maybe some
sort of port number or maybe some sort of protocol subnet et cetera et cetera means 3 4 groups we can
create is a firewall but in datacenter it's important that you can create group including various tag
virtual machine name virtual machine names subnets and segments.
So here we have much more granularity not we are only dependent upon the.
So for example the server or the IP or any type of application but we have a range of variables that
we can grouped together inside the grouping system.
So that again when I want as we have evolved from that area can see that the scope of the policy is
enforcement can be selective with the application or workload level granularity IP discovery mechanism
we have inside in 60 we have the spoof guard so that can block the IP spoofing at the virtual Nick label
we have switched security that can provide restroom control and security against unauthorized traffic
so you can see that the portfolio is increasing is starting from firewall lately firewall distributed
firewall IP is ideas micro segmentation grouping we can group and we can take action we have this spoof
card we can provide such level security et cetera so let's quickly check feels like it's related to
the use case related to micro segmentation because this is one of the huge feature and feel of the company
the one we want NSX to to do this micro segmentation.
Why it is very important because if for example if someone will breach your perimeter is still we are
using that three tier application architecture so we know this thing that now we have three the year.
So we have set for example a web app and.
So we have a web app and.
And suppose someone has to break the gate to a firewall and they get the access to the Web is still
in between web and app.
You have firewall you have security because you have apply the security with respect to micro segmentation.
If someone somehow reaches to application layer it still you have security in between app and Web because
you are in the zero trust model you're not questing anything.
So this the three tier architecture we have inside the more than it's been with data center are the
software defined datacenter solutions right to micro segmentation enable an organization to logically
divide its data center into distinct security segments down to the individual workload level then define
distinct security controls for deliver services such as unique segment.
So you can group your services or the civilian work load and then in between that you can provide distributed
firewall servicing or any type of security services in between.
But once you have group then you can apply policy is central benefit of micro segmentation is the ability
to deny attackers the opportunity to reward locally within their internal network even after they can
breach the perimeter because we are supporting zero cost.
MARTIN The NSX we support micro segmentation actually allow for centrally control operationally distributed
firewall to be attached directly to the work load within the network.
So why does it mean that if you see this diagram.
Let me quickly show you this data so you can see that we have Williams related to finance H.R. and engineering
different different Williams even you have yes it's a hypervisor you may have given hypervisor on top
of that you have the work load.
You can see no in-between So for example finance in nature.
First of all you have firewall security so you have group and then across the group.
So you have this segmentation and you have your gateway firewall and then you have distributed firewall
then you have distributed firewall so you can see that you have this capability that you have your distributed
firewall layer to the wall cloud where you can once it group the elements like finance which are engineering
you can apply those rules.
If someone has breached the perimeter firewall.
Apart from that if we have different different application hosted over different different rhythms are
workloads is still in between that second set of services that still if we want to read somewhere you
have the grouping and the firewall to you can apply to that much security and tight control we have
it NSX and that's the capability we have.
All right.
So their distribution of firewall for the application of security policy to protect the individual workload
you can create the rules and you can protect the individual work load that system.
We have seen in the diagram of additional value of NSX capabilities are not limited to homogeneous environment
but we can extend to Mai Tai hypervisor.
So not only with the region where he is exiled but giving him and other hypervisor is also supported.
This is supporting zero trust architecture so actually we have three here with our three tiered application
to a more precise architecture.
And if we have tight security control we have a zero trust policy or zero trust model.
So we are not trusting even someone breach the perimeter the gate to a firewall is still inside the
work load are inside the groups that we have we can apply the firewall rules correct.
This answer the increase of instigation of network attacks and insider threat or inside trade that frequently
even you can see the inside track mitigation is also there too someone has access to it still they can
go and access app or they have restricted access to app and then finally your main thing that's the
database for each system in the organization network trust of underlying network is remove and appearing
because we find both system within the network limits possibly electoral is too small a movement of
the attacker so whatever we have this goes so far the somebody is this particular diagram in this diagram
you can see various things that we have restricted so first of all you have Gateway firewall then you
have distributed firewall lets nothing what kernel module install over hypervisor on inside the hypervisor
then you can create grouped you have you can create intelligent groups here we have group related to
VM but groups related to various things we can create then we can to create micro segmentation so you
have the groups across the groups you can apply the policy and they will create as a micro segmentation
where we have the zero trust model and finally everything that we are restricting is that this firewall
and the gateway firewall we can integrate with the IP as ideas system apart from that we study that
we can apply some sort of switch security 6 numbers so one two three is four this is five and number
six is that you can use is spoof guard you can apply switch security at Okay so these are the security
parameters and measures we have and will continue this is extreme security in the upcoming sections
as well.