Building E2E Security for Cloud DCNs

Security has always been at the heart of every DCN, and this is set to continue as SDN introduces even greater security challenges. Huawei provides security sub-solutions for the forwarding, control, and application layers, and integrates Huawei firewall, IPS/IDS, sandbox, security manager, and CIS series security products to further implement security across the network. This provides a closed loop from single-point defense to DCN-wide collaborative defense, enabling a rapid response to internal threats as well as effective isolation to prevent spread.

CLOUD DCN SECURITY CHALLENGES

1. Providing effective security services is challenging, particularly those capable of satisfying the new requirements of cloud and SDN- based DCs.

As DCs evolve toward cloudification and SDN, DCNs are deployed and provisioned in a dramatically different manner, and the same is true of applications. Specifically, this new deployment will be dynamically on demand and feature elastic scaling capabilities. However, this also poses new requirements for the deployment and provisioning of DCN security services.

a. Security services are complex and time-consuming to provision.

Security devices are usually deployed in a dispersed manner, covering risk points such as different DC zones and borders. When deploying a security service for a new application, it is necessary to plan and configure the service on multiple security devices. The entire process is both complex and time-consuming.

b. Security capabilities offer limited automation.

Security capabilities provided by OpenStack include only basic firewall capabilities such as security policies, with additional security services requiring complex and inefficient manual configuration.

c. Security capabilities are redundant.

In order to deal with traffic bursts, each security device is required to maintain extra capabilities which are often redundant and a waste of resources.

2. Blurred security borders and increasingly complex threats.

a. In cloud-based and SDN-based DCNs, the virtualization of servers and Layer 2 networks makes it impossible to define tenant network borders as before, which, in turn, leads to blurred security borders.

The physical borders of static and native networks are now replaced by dynamic and virtual logical borders. Virtual Layer 2 traffic on a virtual Layer 2 network is forwarded by vSwitches, and so traffic becomes invisible and difficult to detect. In addition, the logical network topology can change at any time based on moment-to-moment service requirements, meaning legacy security architecture based on traditional physical borders cannot provide appropriate protection.

b. Internal attack sources lead to zero trusted zones.

Cloud DCN resources are highly integrated. As tenants can no longer be isolated at the physical layer, it is difficult to protect them against security threats. If VMs in a DCN become zombie hosts (online hosts controller by an attacker), attacks may be launched from within the network. Traditional security countermeasures cannot offer defense in these cases.

c. Legacy security methods cannot detect and defend against new threats such as advanced persistent threats (APTs).

An APT is a network attack and intrusion behavior directed against enterprises, and designed to intercept core data.

APTs usually exploit zero-day vulnerabilities or utilize advanced evasion techniques (AETs). Through internal penetration and privilege escalation, APTs covertly mine data over a long period of time. Remotely controlled APTs can lead to data damage, loss, and leakage. Legacy detection based on accurate signatures cannot detect and defend against APTs.

3. Security management and O&M become increasingly complex.

a. Security policy management is complicated and applies without awareness of applications.

b. DCs usually operate a large number of security policies (such as in the financial industry), and managing all of these policies based on IP addresses would be a daunting task. In addition, these policies cannot be associated with the status of service applications, meaning they cannot be adjusted according to service changes.

DC security devices are separately deployed in order to form security silos, and individual security threats are detected and processed by DC zones. As such, central prevention and processing is not possible, and a security protection system with a larger protection scope is beyond reach. As a result, there are no effective guidelines for security O&M.

c. Investigating and handling security threats is challenging, leading to slow response times.

A large number of security device threat logs are stored separately and can only be analyzed by professionals, which is both inefficient and ineffective. The Mean Time to Recovery (MTTR) from security threats is long, security response is slow, and the loop closure rate is low. In addition, manual investigation is required to trace and analyze threat events, leading to high ОРЕХ.