1. Hyper-V Security TipsHyper-V Security Tips Fix the Gaps you Never Knew About Symon Perriman @SymonPerriman Symon@5nine.com www.SymonPerriman.com Thomas Maurer @ThomasMaurer www.ThomasMaurer.com

2. Security Threats to Virtualization

3. Security Threats for Hyper-V Compute Denial of Memory or CPU Network Virus, Malware, Trojan Horses, Denial of Service Storage Data Breach or Loss, Denial of Data Web Denial of Service Active Persistent Threats Cross-Site Scripting (XSS), Man in Middle Virtualized infrastructure attacks “This class of threats called APT is so top of mind for each of us…we want to detect Advanced Persistent Threats and to be able to take action as an organization to isolate and protect ourselves.” - Satya Nadella, Microsoft CEO at Microsoft Ignite - May, 2015

4. Virtualized Environments are Never Secure Security for virtualization is different New Threats End users / tenants Storage devices Network attacks Unidentified Threats New signatures Time bomb / logic bomb Most datacenters are already infected

5. Multi-Layered Agentless Security Virtual Firewall AV Detection on the Network AV Scan on the Disk Network Intrusion Detection Network Anomaly Analysis Extensible to Analytics Systems

6. Virtualization Security Best Practices

7. How a Threat Reaches a VM Hyper-V Virtual Machines Virtual Network Adapters Virtual Switch Hyper-V Host Physical Network Adapter

8. Agentless Host-Level Protection

9. Automatic & Immediate Protection Security for virtualized environments is different Shared environments are never secure It is impossible to guarantee security using traditional “endpoint protection” Requires installation Slows deployment Complicates management Virtualized environments are dynamic Virtual machines Virtual disks Virtual networks Virtual switches

10. Abstract & Hide Security from Users Non-technical users or the public are using your hardware Remove the burden of security from the clients Manage security for the clients Update signatures for the clients Ensure the clients cannot disable security Accidently Purposely with bad intentions

11. Centrally Manage Rules & Definitions Use a recognized industry leader Antivirus / antimalware Intrusion detection Set up a local proxy for extra security

12. Guarantee Isolation & Resource Access Isolation and privacy is critical in a cloud An admin should not access a tenant’s VM A VM cannot affect the host A VM cannot affect another VM Use Quality of Service (QoS) or throttling for memory, CPU, network & storage bandwidth Avoid Denial of attacks

13. Traditional security protect traffic between hosts Does not protect traffic between VMs on the same host Threats can spread if one client becomes infected Virtual Network Types External Internal Private Protect All Virtual Networks Network Security Appliance

14. Universal Virtual Firewall for all VMs Intercept network traffic before it even gets to the VM Manage traffic at the network protocol level TCP, UDP, GRE, ICMP, IGMP, etc. Hyper-V Guest OS List: aka.ms/HyperVGuestOSaka.ms/HyperVGuestOS Server Windows Server 2016 Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2 Home Server 2011 Small Business Server 2011 Windows Server 2003 Client Windows 10 Windows 8.1 Windows 8 Windows 7 Windows Vista Windows XP Linux & UNIX CentOS Debian FreeBSD Oracle Linux Red Hat RHEL SUSE Ubuntu

15. Active Detection of Incoming Threats Immediately identify incoming threats Unencrypted traffic Based on protocol Automatically alert admins Email PowerShell Event Logs 01010011 01111001 01101101 01101111 01101110 00100000 01110010 01110101 01101110 01110011 00100000 00110101 01101110 01101001 01101110 01100101 00100000 01010011 01101111 01100110 01110100 01110111 01100001 01110010 01100101 00100000 00111010 00101001

16. Fast AV Scanning with No Performance Impact Agent-based scanning causes “scanning storms” Decreases VM performance for all clients Reduces VM density on the hosts Optimized scans use Change Block Tracking (CBT) driver Scan only changed blocks on the disk Scan up to 70x faster

17. Automate Security Task Management PowerShell support Task scheduling Enables scalability Ensures consistent SLAs Eliminates human error For tasks with high resource utilization, stagger the action to avoid performance impact

18. Hyper-V Hosts & Clusters SQL Server Security Management Server / VM Redundant Management Group SQL Server SQL Cluster Branch Office SQL Server Sync Management Console | PowerShell | Azure Pack | System Center Enterprise High-Availability for Security

19. Inbound, Outbound & Internal Threat Protection Hyper-V Hosts & Clusters SQL Server Security Management Server / VM Public Internet Normal Traffic Unusual Traffic

20. Extensible to Analytics Platforms Hyper-V Hosts SQL Server Security Management Server / VM Public Internet On-Premises Analytics (Syslog) Cloud-Based Analytics

21. System Center Integration Centralized security management through System Center to protect Hyper-V Infrastructure and VMs Automatically apply security policies to guarantee immediate protection for hosts and virtual machines Accelerate and secure VM deployments with an agentless solution designed for Hyper-V Monitor the infrastructure with Operations Manager Scales to protect the largest enterprises running System Center and the Microsoft Cloud Platform

22. Azure Pack (WAP) Integration Security as a Service (SECaaS) to protect your datacenter, your customers, and their clouds Generate new revenue by offering an higher security tier Meet the latest compliance and regulation requirements with multi-layered unified security Automatically and immediately secure your tenants with non-invasive protection Support more VMs and tenants on each host with the most efficient security solution for Hyper-V Simplify security management for tenants through on/off buttons Firewall, Network Detection & Intrusion Detection Preconfigure firewall templates for different VM roles *Azure Pack (WAP) allows you to run Azure services in your datacenter on your hardware

23. Benefits of Agentless Security Universal virtual firewall for all guest OSes Protect all virtual networks Detect inbound, outbound and internal attacks Fastest disk scans with least performance impact Automatic & immediate protection Centrally manage & update policies Remove burden from end users Security cannot be disabled

24. Summary

25. Summary Security for virtualization is different Protect your datacenter with a virtual firewall, antivirus, antimalware, and intrusion detection system Use an agentless solution for Hyper-V, System Center Virtual Machine Manager, and Azure Pack Use centralized management and reporting with industry standard signatures Email Symon@5nine.com for questionsSymon@5nine.com