1. VMware NSX and Micro-Segmentation
Irish R. Spring
Systems Engineering Manager, NSBU Central

2. Why do breaches still occur?
Today’s data centers are protected by strong perimeter defense…
But threats and exploits still infect servers. Low-priority systems are often the target.
Threats can lie dormant, waiting for the right moment to strike.
Attacks spread inside the data center, where internal controls are often weak. Critical systems are targeted.
Server-server traffic growth has outpaced client-server traffic. The attack spreads and goes unnoticed.
Possibly after months of reconnaissance, the infiltration relays secret data to the attacker.

3. The legacy security model emphasized perimeter security
Data Center
Perimeter
Internet
Perimeter-centric network security has proven insufficient

4. And is incompatible with a world where security is needed everywhere
Adding more internal security…
requires placing more firewalls across workloads
Physical Firewalls
Cost prohibitive with complex configurations
Internet
Virtual Firewalls
Slower performance, costly and complicated
Data Center Perimeter

5. What’s needed: a new architectural approach
Software-Defined Data Center
Applications
Virtual Machines
Virtual Networks
Virtual Storage
Data Center Virtualization
Compute
Capacity
Network
Capacity
Storage Capacity
Location Independence

6. The next-generation networking model
VSWITCH OS
Hypervisor
Software
Network and Security Services Now in the Hypervisor
Software
Load Balancing
L3 Routing
L2 Switching
Firewalling/ACLs
Hardware

7. Visibility NSX is uniquely positioned to see everything NSX
Applications
Virtual Infrastructure
NSX
Physical Network Infrastructure
Internet

8. Granular control becomes possible
NSX vSwitch VM
Hypervisor
High throughput rates on a per-hypervisor basis
Every hypervisor adds additional east-west firewalling capacity
Native feature of the VMware NSX platform

9. Delivering better security automation
NSX vSwitch VM
Hypervisor
Platform-based automation
Automated provisioning and workload adds/moves/changes
Accurate firewall policies follow workloads as they move
Centralized management of single logical, distributed firewall

10. Delivering higher levels of data center security
Micro-segmentation 1 2 3
Isolation and segmentation
Unit-level trust / least privilege
Ubiquity and centralized control VM VM VM

11. Simplifying network security
Production
Development
Finance HR
Security policies no longer tied to network topology
Logical groups can be defined
Prevents threats from spreading
Web VM VM VM VM
App VM VM VM VM DB VM VM VM VM

12. Thank you

13. DES MOINES
th Street
Urbandale, IA 50322
KANSAS CITY
6400 Glenwood St.| Suite 314
Overland Park, KS 66202
OMAHA
5940 S. 118th St.
Omaha, NE 68137