VMware NSX and Micro-Segmentation Irish R. Spring Systems Engineering Manager, NSBU Central

Why do breaches still occur? Today’s data centers are protected by strong perimeter defense… But threats and exploits still infect servers. Low-priority systems are often the target. Threats can lie dormant, waiting for the right moment to strike. 10110100110 101001010000010 1001110010100 Attacks spread inside the data center, where internal controls are often weak. Critical systems are targeted. Server-server traffic growth has outpaced client-server traffic. The attack spreads and goes unnoticed. Possibly after months of reconnaissance, the infiltration relays secret data to the attacker.

The legacy security model emphasized perimeter security Data Center Perimeter Internet Perimeter-centric network security has proven insufficient

And is incompatible with a world where security is needed everywhere Adding more internal security… requires placing more firewalls across workloads Physical Firewalls Cost prohibitive with complex configurations Internet Virtual Firewalls Slower performance, costly and complicated Data Center Perimeter

What’s needed: a new architectural approach Software-Defined Data Center Applications Virtual Machines Virtual Networks Virtual Storage Data Center Virtualization Compute Capacity Network Capacity Storage Capacity Location Independence

The next-generation networking model VSWITCH OS Hypervisor Software Network and Security Services Now in the Hypervisor Software Load Balancing L3 Routing L2 Switching Firewalling/ACLs Hardware

Visibility NSX is uniquely positioned to see everything NSX Applications Virtual Infrastructure NSX Physical Network Infrastructure Internet

Granular control becomes possible NSX vSwitch VM Hypervisor High throughput rates on a per-hypervisor basis Every hypervisor adds additional east-west firewalling capacity Native feature of the VMware NSX platform

Delivering better security automation NSX vSwitch VM Hypervisor Platform-based automation Automated provisioning and workload adds/moves/changes Accurate firewall policies follow workloads as they move Centralized management of single logical, distributed firewall

Delivering higher levels of data center security Micro-segmentation 1 2 3 Isolation and segmentation Unit-level trust / least privilege Ubiquity and centralized control VM VM VM

Simplifying network security Production Development Finance HR Security policies no longer tied to network topology Logical groups can be defined Prevents threats from spreading Web VM VM VM VM App VM VM VM VM DB VM VM VM VM

Thank you

DES MOINES 3600 109th Street Urbandale, IA 50322 515.422.9300 KANSAS CITY 6400 Glenwood St.| Suite 314 Overland Park, KS 66202 816.423.8048 OMAHA 5940 S. 118th St. Omaha, NE 68137 402.408.0581