Shielded VM and Guarded Fabric Protect VM data from compromised storage, networks, admins and malware John Joyner John.Joyner@clearpointe.com Senior Director, Technology ClearPointe System Center MVP Robert Hedblom @RobertandDPM robertanddpm.blogspot.com

John Joyner Robert Hedblom @john_joyner @RobertandDPM Microsoft MVP Cloud & Datacenter, 9 years Microsoft MVP Cloud & Datacenter, 7 years MSP industry pioneer, Co-author SCOM Unleashed series 20 y IT, 15 y BC, 10 y SC Favorite vehicle is a Jeep Wrangler Favorite food is “dead and cooked”

Shielded VM and Guarded Fabric Protect VM data from compromised storage, networks, admins and malware

Attack Vectors in a Virtualized Environment Source: Washington Univ.

Ransomeware Attack Timeline In the yellow zone is where Shielded VMs show their value. Host is compromised but tenant data is not vulnerable.

Legacy Approach: Protect Host from Hostile Guests Source: RedHat

VMWare NSX “Host Based Firewall” Source: VMWare

Two vectors threaten data on tenant VMs

Security Overview: Windows Server 2016

A Better Approach: Microsoft Shielded VMs Source: Microsoft

Solution: Shielded VM and Guarded Fabric The goal of the Guarded Fabric solution is to provide hosting service providers and private cloud operators the ability to offer their tenant administrators a hosted environment where protection for tenant virtual machine data is strengthened against threats from compromised storage, networks, host administrators, and malware.

Solution Assurances As a cloud service provider or enterprise private cloud administrator, you can provide a secure, “admin-trusted” (or alternatively, “hardware-trusted”) environment for tenant VMs where: You are assured that Windows Server has built-in breach hardening capabilities spanning from secure and measured boot, code integrity and protection for high value operating system security secrets and operations from malicious code on the Hyper-V host, and You are assured that you can provide a secure hardware trusted environment for tenant VMs where the VM data is protected from malicious host administrators and malware.

Solution Topology

Shielded VMs: Building Blocks

Deploy: Shielded VM and Guarded Fabric

You can build an infrastructure for guarded hosts and “shielded VMs”. Scenario Validation 1: You can build an infrastructure for guarded hosts and “shielded VMs”. Hosts can build a cloud service and offer shielded VM functionality using the Windows Azure Pack Portal.

Scenario Validation 2: Tenants can create new or use existing VMs and be able to convert them to shielded VMs. Tenants can use Windows Azure Pack to create and manage shielded VMs in Windows Azure Pack.

Scenario Validation 3: Tenants can export VMs and grant permission to either a cloud service provider or an enterprise cloud operator to be guardian, and are assured of security and data-at-rest encryption. Tenants can create new VMs from a VMM template and be assured that the base images used for template creation are trusted and have not been tampered with. During VM creation from a VMM template, tenants can provide input for computer names and administrator passwords in secure manner without exposing sensitive information to fabric administrators.

Scenario Validation 4: Cloud service providers and enterprise administrators can use Live Migrate or Live (VSM) virtual machines between guarded hosts in the same way they did prior to deploying the Guarded Fabric solution. Cloud service providers and enterprise administrators can back up, checkpoint and restore shielded VMs as per normal procedure.

Operate: Shielded VM and Guarded Fabric

And Then … Discuss: Evaluations: Ask your questions-real world answers! Plenty of time to engage, share knowledge. Discuss: Evaluations: Please provide session feedback by clicking the EVAL button in the scheduler app (also download slides). One lucky winner will receive a free ticket to the next MMS!

Section Header This is the next section

Title Line1 Line2 Line3 Line4 Line5 Line6 Bullet Level 1

Title Code

Text Only with Border Level 1 Level 2 Level 3

Text Only without Border Level 1 Level 2 Level 3

Title Text 1 Level 1 Level 2 Level 3 Text 2 Level 1 Level 2 Level 3

Title Text Text Section 1 Section 2 Level 1 Level 1 Level 2 Level 2

Demo Title