How VMware wants to reinvent the SAN

VMware is out with Virtual SAN today, which aims to virtualize the storage layer

VMware has released a virtual Storage Area Network (Virtual SAN), which the company says will usher in a new era of policy-driven and virtual machine-centric storage provisioning.

SANs are typically made of disparate storage components aggregated to create a pool that can be tapped by compute resources. Traditionally, SANs have been set up using external storage boxes which are then controlled by a switch; they’re ideal for dynamic storage needs.

VMware is taking a different approach for Virtual SAN, however. Instead of using external storage arrays that are pooled, Virtual SAN is a software-only product that runs on x86 servers that an enterprise may already have. It creates the shared storage pool out of the internal storage resources of the servers. This means Virtual SAN can be deployed as an overlay approach without the need to invest in new hardware.

Virtual SAN also takes a somewhat novel approach to provisioning the storage. Traditionally, SANs have worked by setting up Logical Unit Numbers (LUN) or other connections between the storage and the compute. Instead, Virtual SAN is integrated directly in with the kernel of VMware’s ESX hypervisor. That allows virtual machines to dictate how much storage they need and then the Virtual SAN software automatically provisions it.

Users set templates or policies related to how much storage their VMs can request, how fault tolerant the storage should be (and therefore how many copies of it there will be) and what sort of performance it requires (solid state versus hard drive). Then, when the VM is spun up, Virtual SAN automatically provisions the necessary storage within the parameters of the policies that have been established.

Simon Robinson, research vice president for storage at the 451 Research Group likes the idea. “Our research has been telling us for years that IT and storage managers are pretty tired of all the complexity involved in managing storage - managing LUNs, volumes, RAID levels, etc., and server virtualization makes it even more so,” he says. “For organizations that are well down the virtualization path, having a VM-centric way of managing their storage makes a lot of sense.”

Virtual SAN has been in development for three years and in beta for about a half year, since VMware announced it at VMWorld 2013. In that time 12,000 customers have signed up for the beta. Ryan Hoenle, director of the non-profit Doe Fund, is a VMware compute virtualization customer and has been testing Virtual SAN in its DR platform. “It’s really a no-brainer when the hypervisor you want to use also includes this virtualized storage,” he says. Virtual SAN allows the Doe Fund to have redundancy where Hoenle needs it and not pay for redundancy where he doesn’t. “We get that same sort of flexibility from a storage perspective that we gained from a compute perspective when we went to VMware.”

VMware isn’t alone in taking this policy-driven and hypervisor-integrated approach to a SAN. Robinson notes that there are a variety of startups doing this as well, but they take a slightly different approach. Companies like Nutanix and SimpliVity offer converged infrastructure systems which combine other features such as deduplication, compression and sophisticated snapshots into their platforms, for example. Some startups also enable multi-hypervisor support. But, one advantage to VMware’s Virtual SAN is that it is “baked in” with existing VMware tools. “Virtual SAN represents a major validation of this approach, and that will be good for all players,” Robinson says.

With Virtual SAN, VMware is finishing off the trifecta of its software defined data center (SDDC) strategy. The company is already clearly established in the compute virtualization market with a leading platform there. It bought Nicira and is working on its network virtualization strategy. Storage can be thought of as a last frontier for VMware to conquer, and Virtual SAN is a piece of that strategy.

VMware spokespeople say that they don’t expect Virtual SAN to replace an existing SAN or NAS (network attached storage); they see it as a complementary platform that is especially helpful for use cases such as disaster recovery, test and development, and virtual desktops. It’s generally available starting today, priced at $2,495 as stand-alone software.

---

Best Microsoft MCTS Certification,
VMware Exams Training  and more exams log in to Certkingdom.com

Network firewalls aren't dead yet

After 20-plus years of service, the technology remains a core part of the IT security stack despite its long predicted demise

Phil Cummings says network firewalls will continue to be a critical piece of Health Information Technology Services -- Nova Scotia security portfolio for one simple reason: nothing's come along to replace them.

For the past 15 years, Cummings, a security administrator at HITS-NS, has been responsible for managing the enterprise firewalls that are used to protect the 20,000-user network the company manages for the Nova Scotia government.

Over that time, Cummings has seen firewalls evolve from relatively rudimentary tools for blocking threats at the network edge to sophisticated, policy-based, traffic filtering and intrusion prevention systems.

"We see firewalls becoming more than just a block" on the network, Cummings says. "We see a lot of perimeter firewalls taking more of an enforcement role in protecting the desktop" and mobile devices.

Networks firewalls are seen by some observers as an anachronism in an industry obsessed with the latest and shiniest security tools. Networks firewalls aren't sexy. They've been around for more than 20 years, plugging away as the threat landscape changes beyond recognition.

But rather than fading away like respectable mature technologies should, firewalls have stubbornly remained a vital part of enterprise security stacks.

For one thing, they still offer a reasonably strong first line of defense against an array of threats. Despite talk by some experts that perimeter technologies have become useless against modern malware, firewalls do block a lot of junk that would otherwise inundate enterprise networks. The technology continues to be critical in enabling network segmentation and in ensuring critical business and corporate systems are separated.

For most companies, a firewall is the only device that is designed and deployed inline as part of the network infrastructure. It remains in the best position to filter and regulate traffic flowing into the corporate network.

Firewalls have also evolved over the years to become a 'Swiss-army knife' of security technologies. A growing number of firewalls now integrate capabilities previously found in separate, standalone security devices.

Gartner says such emerging firewall technologies will eventually "subsume" mainstream deployments of new intrusion prevention system (IPS) appliance technology over time.

Not bad for a technology that some had predicted would have faded away by now.

Vendors such as Palo Alto Technologies -- whose products are used at HITS-NS -- embody next generation firewall technology.

Founded in 2005 by a former Check Point Software Technologies engineer, Palo Alto is now one of the hottest security companies. Palo Alto is bankrolled by some of Silicon Valley's most influential venture capitalists and has 65 of the Fortune 100 companies on its list of 16,000 customers.

Palo Alto's firewall products are considerably different from the stateful inspection firewalls of the past that basically gave companies a choice of blocking something entirely at the perimeter, or letting it all through.

Palo Alto firewalls are application aware, said Lee Klarich, senior vice president of product management.

Instead of blocking Skype or Facebook entirely, companies can use Palo Alto's firewall products to control what users can do with these applications. Want to enable Webex, but only for a select set of users? Palo Alto has an app for that, Klarich says.

"What we would say first and foremost is our platform is designed to safely enable applications" instead of blocking them due to security concerns," Klarich said. "We go way beyond a traditional firewall."

The products natively integrate firewall, intrusion detection, intrusion prevention and URL filtering functions and enable visibility and control over everything flowing into and out of a corporate network.

"Newer firewalls have more identity and application functionality built in," says Pete Lindstrom, principal at Spire Security.

Along with permit/deny functions for connections on different network ports, the latest firewall technologies also include functions for monitoring applications running on Internet ports 80 and 443, he said. That's a big deal at a time when a lot of Web applications and malware use the same entryways into the corporate network.

"It allows administrators to know what is going in and out the front door," Cummings says. "And because you know what is going on, you can assess the risk and control it."

The key is that next-generation firewalls can enforce contextual access controls based upon users, applications, locations, time-of-day and other factors, said Jon Oltsik, an analyst at Enterprise Security Group. Think of new firewalls as network security services, he says.

"These services won't go away but may morph into different physical and virtual form factors. What enterprise organizations really want is central control and distributed policy enforcement across all network security services -- physical, virtual and cloud-based. Think single pane-of-glass control," Oltsik said.

Several other firewall vendors, including Check Point, Fortinet and Juniper, have taken a cue from Palo Alto and are rushing to market with newfangled firewalls that offer a set of integrated capabilities.

Each of the companies are moving along at a different pace, but they already have the full attention of enterprises and of investors, if their market capitalizations are any indication.

"The modern firewall must be flexible in deployment and serve as a platform for security services," said Michael Callahan, vice president of product marketing at Juniper Networks. In the next few years expect to see firewalls incorporating diverse sets of threat intelligence information from the cloud and within a network. Such data will be used to actively defend against attacks in real-time, he said.

Callahan says pointing to new "intrusion deception" technology built into the Juniper's latest firewalls. The technology, gained from its $80 million acquisition of Mykonos in 2012, is designed to identity and stop malware attacks both early in the process and after a network is penetrated.

"By leveraging visibility into endpoints, internal network traffic and the network edge, the technology can detect malware in places where other [products] cannot," Callahan said.

Over the next few years, new generation firewall technologies are likely to be integrated even further into the enterprises. Even advances like software defined networking are unlikely to diminish the need for firewalls, argues Jody Brazil, founder and CTO of security vendor FireMon.

"Nowhere have I seen anyone say that this increased move toward automation will eliminate the need for firewalls," says Brazil. "In fact, just as we've seen with virtualized networks, there will be an increased demand for firewall technologies to support both existing processes and some of these newly emerging models."

Trends like SDNs will not lead to the demise of the firewall but will reemphasize the need for them, he predicts. "Firewalls may not be sexy but they [are] the underlying backbone of all IT security infrastructure. And that's not changing anytime soon, if ever," Brazil said.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Businesses told to lockdown Bitcoin wallets against malware threat

Malware designed to steal digital currency from Windows PCs has risen with Bitcoin value since beginning of last year, says studyBusinesses considering accepting Bitcoins or other forms of cryptocurrency should be prepared to battle a rising number of malware aimed at emptying digital wallets.

[Why security pros should care about Bitcoin's troubles]
That's the takeaway from a new study by SecureWorks, computer maker Dell's security unit. Researchers found that the number of malware targeted at stealing cryptocurrency from Windows PCs increased along with the rise in value of Bitcoin since the beginning of 2013.

As of January of this year, SecureWorks had identified on the Internet 100 unique families of malware capable of stealing wallet files or digital currency from users' exchange accounts. The increase in the number of cryptocurrency-stealing malware made it "one of the fastest-growing categories of malware," the study said.

While Bitcoin is not the only type of cryptocurrency, it is the most popular and the most valuable. The price has ranged from a high of roughly $1,150 in early December to a low of $420 Feb. 25. Bitcoin's price on Thursday was about $565. Other digital currencies include Namecoin, Litecoin, Dogecoin, PPCoin and Mastercoin.

The recent shutdown of Mt. Gox, which once had the largest market share of all digital currency exchanges, highlights the risk of cryptocurrency traded over the Internet. The Bitcoin exchange closed this month after cybercriminals stole $400 million. The heist is under investigation by U.S. federal authorities.

The rising popularity of digital currency has led to its adoption by retailers. Overstock.com became the first major online retailer to accept Bitcoins, and industry observers expect others to follow. The site SpendBitcoins lists many places on the web where people can spend their digital currency.

To protect the digital wallets used in conducting transactions, SecureWorks researchers recommend the use of a "split wallet," which has a portion of the file on the computer connected to the Internet and the rest on a system with no network connection.

The file kept on the Internet-enabled system would let the business track its running balance and perform transactions with customers. On the offline system is the private key for authorizing a transaction before it is transmitted.

Electrum is an example of a split wallet done through software. Examples of hardware-based products include Hardware Wallet and Trezor, which plans to release its product soon.

By using the proper security, businesses can significantly reduce the risk of accepting digital currency, Pat Litke, security researcher for Dell SecureWorks' Counter Threat Unit, said.

"It's simply a matter of understanding how to do it safely, and that's where the general population falls short," Litke said.

[Ransomware like Cryptolocker uses Bitcoin, other virtual currencies for payment]
The SecureWorks study found several categories of PC malware targeting digital currency. One form searched an infected system's hard drive for the typical file names used for wallets, such as "wallet.dat." The file was copied and then sent to a remote server.

Another malware family would set up a man-in-the-middle-like attack in which the address of the recipient in a transaction is altered, so the money goes into the thief's account.

---

Best CCNA Training and CCNA Certification and more Cisco exams log in to Certkingdom.com