BETA!BETA!

Building a secure private cloud on Microsoft technologies Private cloud security concerns Security & compliance in a Microsoft private cloud

CommunityCloud Private Cloud Public Cloud Hybrid Clouds Deployment Models Service Models Essential Characteristics Common Characteristics Infrastructure as a Service (IaaS) Platform as a Service (PaaS) Software as a Service (SaaS) Resource Pooling Broad Network Access Rapid Elasticity Measured Service On Demand Self-Service Low Cost Software Virtualization Service Orientation Advanced Security Homogeneity Massive Scale Resilient Computing Geographic Distribution

Operating System Virtualization A Private Cloud presents the OS and virtualization resources as a pool of shared resources The resource pool is created through management, based on business rules and executed through automation. Management You no longer think about numbers of VMs, server ratios, memory or storage but instead on how much compute resources you have access to Your focus now shifts to the applications, where you rely on the pool of resources to supply the right capacity and capabilities

Compute / Network / Storage Management Layer Management Layer Hyper-V based Hypervisor Orchestration Layer Orchestration Layer Admin / Tenant Interfaces AuthN, AuthZ & Auditing

* Source: IDC Enterprise Panel, August 2008 # CIA = Confidentiality, Integrity & Availability

Windows Kernel Server Core Virtualization Stack Device Drivers Windows hypervisor VM Worker Processes Guest Partitions Ring 0 Ring 3 OS Kernel VMBus Guest Applications Root Partition CPU Storage NIC Ring 0 Ring 3 “Ring “-1”

Hardware Hypervisor VM 1VM 2 Virtual- ization Stack Root Partition Drivers Guest Partition Hypervisor VM 1 (Admin) VM 2VM 3 Hardware Drivers Virtualization Stack “The fact is, the absolute last place you want to see drivers is in the hypervisor, not only because the added abstraction layer is inevitably a big performance problem, but because hardware and drivers are by definition buggier than "generic" code that can be tested.” Linus Torvalds,

Portals & Reporting 3 rd Party Solutions

Event Mgmt Service Desk Asset/CMDB Configuration Virtual Security Storage Server Network IT Silos VM Provisioning Process Monitor Service request Stop VM Update request Update request Update & close request Clone new VM Update properties Remove from Ops Manager Test VMDeploy Applications Verify Application Add to Ops Manager Create CI Retire CI Create incident Detach Storage Detach Network Adapter

DataData Perimeter / Access ApplicationApplication HostHost NetworkNetwork  Windows security model for access control and auditing  System Center Data Protection Manager for data availability  Windows security model for access control and auditing  System Center Data Protection Manager for data availability  User identification & authorization  Application-layer malware protection  User identification & authorization  Application-layer malware protection  Host boundaries enforced by external hypervisor  Host malware protection  Host boundaries enforced by external hypervisor  Host malware protection  VLANs and packet filters in network fabric  Host firewall to supplement & integrate IPSec isolation  Controlled access to portals / services using UAG  Controlled outbound access using TMG  Controlled access to portals / services using UAG  Controlled outbound access using TMG Layer Defenses  Patch Management  Application / Host hardening  Patch Management  Application / Host hardening

Data Center’s Physical Servers Guest OS Data-Center Network