IBM PowerSC. Une sécurité étendue et à la carte. Client Technical Sales IBM Corporation

Transcription

1 IBM PowerSC Une sécurité étendue et à la carte Client Technical Sales

2 Les attaques ont évoluées... 2

3 3

4 PowerVM delivers firmware-based security Unlike x86-based products such as VMware, the PowerVM hypervisor is secure by design. IBM is the only vendor that has designed the virtualized environment from bare metal through the hypervisor. PowerVM hypervisor is part of the digitally-signed firmware with strong cryptography which makes it impossible to remotely install a modified fileset into the EPROMs of Power Systems. There are zero vulnerabilities reported against PowerVM by US CERT or by MITRE Corporation PowerVM is certified at a CC Evaluated Assurance Level 4+ & Remember, zero is a number too a very good number in the Security domain. 4

5 PowerSC - Security and Compliance PowerSC provides a security and compliance solution designed to protect data centers virtualized with PowerVM enabling Higher Quality Services. Client Pain Points PowerSC Solution Complexity and time required to comply to industry standards Simplifies management and measurement of security & compliance Time and skills to prepare for security audits 5 Reduces cost of security & compliance Difficulty detecting security exposures in virtualized environments Improves detection and reporting of security exposures Lack of visibility and control over virtual networks Improves the audit capability to satisfy reporting requirements Virtualized environments provide new security issues Provides virtualization aware security extensions

6 Un nouveau produit depuis octobre 2011 et en octobre

7 PowerSC : les fonctionnalités possibles Security and Compliance Automation Real-Time Compliance Trusted Logging Trusted Boot Trusted Network Connect and Patch Management (TNC) Trusted Firewall Power SC Trusted Surveyor 7

8 PowerSC les différents éditions 8

9 PowerSC Requirements Hardware Requirement: Power 710 (8231-E1C), Power 730 (8231-E2C), Power 720 (8202-E4C), Power 740 (8205-E6C, 8492-DW3 and 8493-SV3), Power 770 (9117-MMC) and Power 780 (9179-MHC) servers only. 9

10 PowerSC Security and Compliance Automation Power5 IBM Power6 IBM Power7 PCIDSS Payment Card Industry Data Security Standard v1.2 Sarbanes-Oxley Act and COBIT US department of Defense (DoD) Security Technical Implementation Guide (STIG) HIPAA is Health Insurance Portability and Accountability Act Template can be customize for your own requirements VM AIX VIOS Ligne de commande IBM System Director avec AIX Profile Manager plug-in 10

11 PowerSC Security and Compliance Automation AIX Profile Manager est un plug-in Systems Director qui est conçu pour simplifier la gestion using the AIX Profile Manager de configuration Simplified AIX sur deconfiguration multiples systèmes XML Profiles Env var XYZ= Yes AIX security profile. tuneable N System Administrator Extract Env var XYZ= Yes AIX security profile tuneable N System A 11 Set Env var XYZ= Yes AIX security profile tuneable N System N System N N Systems Compare Env var XYZ= Yes AIX security profile tuneable N System C

12 PowerSC Security and Compliance Automation Plus de fichier journaux à lire, un visuel dans IBM System Director 12

13 Power SC Real-Time Compliance Surveille les modifications de fichiers d'une liste de fichiers prédéfinis En cas de changement sur un fichier, vérifie la compliance Utilisation de l'infrastructure événement d'aix (AHA FS) Utilisation de la comande aixpert Envoit d' alertes Via Sur 13 (doit être configuré) SNMP trap (mécanisme optionnel) Compliances transgressées Evénement de fichiers modifiés Les administrateurs peuvent faire suivre les couriels comme des SMS sur leurs téléphones VM AIX

14 Power SC Real-Time Compliance Deux options de surveillance : Surveillance Contenu vérifie si le contenu d'un fichier a été modifié Surveillance Attribut vérifie si les permissions sur le fichier ont changé Il est possible de configurer les deux fonctions de surveillance pour un même fich Le type de surveillance d'un fichier peut être modifié à n'importe quel moment Change User histsize attr Ligne de commande 14

15 PowerSC Trusted Logging Power5 IBM Power6 IBM Power7 VIOS or later Où sont les logs? Trusted Logging fournit une protection sécurisée et centralisée pour l'audit AIX et pour les fichiers journaux. L'intégration est parfaite dans la virtualisation PowerVM les auditeurs sont sûrs ques des administrateurs de VM AIX ne peuvent pas supprimé ou modifier des fichiers journaux Gestion facilité : Des fichiers journaux centralisés sont plus faciles à gérer, sauvegarder et à archiver VM AIX VIOS Une gestion centralisée garantit la disponibilité des logs même si la VM AIX a été supprimée 15

16 PowerSC Trusted Logging AIX VMs Power5 IBM Power6 IBM Power7 VIOS ou plus récent /var/adm/ AIX log {System logs} vscsi Log Interface Les périphériques de fichiers journaux virtuels sont gérés par les commandes : mkvlog, rmvlog, chvlog et lsvlog Virtual IO Server Virtual IO Server /var/vio/vlogs lpar-01 syslog Immutable Log audit Repository lpar-02 testlog audit LPM est supporté! 16

17 PowerSC Trusted Boot IBM Power7 firmware efw7.4 ou plus récent Permet de valider la confiance en un système Trusted Boot fournit un module vtpm Virtual Trusted Platform Module pour chaque machine virtuelle Une LPAR dédiée délivre l'attestation AIX Avantages : La confiance est visible :Gives ability to display trust of a system Permet de démontrer une conformité de la sécurité Fournit des contrôles et une assurance additionnelles pour des charges de travail virtuels 17

18 PowerSC Trusted Boot IBM Power7 firmware efw7.4 ou plus récent SSH Collector Collector LPAR 1 LPAR 2 Remote Verifier LPAR 1 HMC Maxi 60 partitions par chassis AIX 6.1 TL7 AIX 7.1 TL1 VTPM 1 VTPM 60 VTPM 1 LPAR 2 OpenPTS (AIX ou Linux) VTPM 60 efw 7.4 P7 / P7+ P7 / P7+ P7 / P7+ P7 / P7+ P7 / P7+ P7 / P7+ Un périphérique spécialisé, nommé Trusted Platform Module (TPM) pour : - Stocker toutes les mesures d'authenticité du processus de démarrage - Relier le microcode au système d'exploitation 18

19 PowerSC Trusted Boot IBM Power7 firmware efw7.4 ou plus récent Vérifie l'intégrité de l'image de démarrage d'aix Sécurisé par le périphérique Virtual TPM Protection pour le 'cloud' et le 'DataCenter' 1. Est ce que mon OS a démarré depuis le périphérique défini? 2. Est ce que l'os utilise les arguments de démarrage ad-hoc? 3. Est ce que le noyau de l'os a été altéré? 19

20 PowerSC Trusted Network Connect and Patch Management (TNC) Power5 IBM Power6 IBM Power7 VIOS ou plus récent Trusted Network Connect and Patch Management détecte les machines virtuelles non conformes, par rapport à un niveau souhaité, lors de l'activation de la VM et alerte les administrateurs immédiatement. Notification de système ayant un niveau inférieur via courriel et SMS Simplifie l'audit car la surveillance permanente lors de l'activation des machines virtuelles prouve la compliance au standard de 'patch' mis en place dans l'entreprise VM AIX VIOS Rend visible les systèmes non compliant dans le datacenter et les environnents clouds 20

21 PowerSC Trusted Network Connect and Patch Management (TNC) Clients IP Referrers Power5 IBM Power6 IBM Power7 VIOS ou plus récent (optional) VIOs AIX 6.1 TL6 and + Solution de gestion de patchs efficace AIX 7.1 TL1 and + Security Patch Announced Alert! Unpatched system activated in Data Center Policy AIX 7.1 TL2 DB Policy Server Centralized Policy Decision Point (PDP) Vérifie l'intégrité du niveau final Intégré avec les centres de distributions de patchs AIX : Electronic Customer Care (ECC). AIX Fix Central Console centrale pour la gestion des patchs : Règles de gestion, IBM ECC-Fix Central OR CUSTOMER Central Repository 21 AIX 7.1 TL2 Patch Management Server Centralized Patch Management SUMA (Access) and NIM (Downloaded Fixes) Rapport, Génération de rapport sur le status des patchs des clients, Initie l'installation sur les clients Deux modes (Découverte, Vérification).

22 PowerSC Trusted Firewall VIO Server L p a r ent L p a r L p a r L p a r L p a r IBM Power6 IBM Power7 VIOS ou plus récent Sans PowerSC Trusted Firewall Le trafic entre 2 VLANs est exposé au réseau extérieur Cela à un coût : latence, bande passante réseau et cartes réseau Avec PowerSC Trusted Firewall Le trafic entre 2 VLANs est sécurisé et il reste dans le chassis Economie : latence, bande passante et cartes réseau VIO Server L p a r L p a r L p a r L p a r VIO Server VLANs non sécurisés ent ent TFW L p a r VIOS L p a r L p a r L p a r L p a r L p a r TFW VLANs sécurisés 22

23 PowerSC Trusted Firewall IBM Power6 IBM Power7 VIOS ou plus récent (1) Installation fileset AIX smitty installp (2) Un nouveau périphérique au niveau du VIOS : SVM Secure Virtual machine mksvm (3) Démarrer le filtrage vlantfw (4) Définir les filtres genvfilt, lsvfilt, chvfilt, rmvfilt (5) Mettre à jour les règles du périphérique SVM mkvfilt 23 Supporte tous les systèmes d'exploitation sur Power : IBM i, Linux & AIX SEA, PowerHA, LPM : supportés Dans cette version Toujours supprimé le SVM avant le SEA

24 PowerSC Trusted Surveyor HMC CR6 ou CR7 Compare current state of VM virtual network segregation to defined desired policy. Fourni une visibilité de l'isolation des réseaux virtuels pour prouver la compliance Diminue les coûts d'administration par une génération automatique des rapports de compliance Audit indépendant et gouvernance d'une infrastructure virtualisée Assure des changements de configurations consistents et sécurisés 24 AIX Comment fonctionne PowerSC Trusted Surveyor? Découvre l'infrastructure virtuelle via les HMC Construit un modèle qui est comparé à un état sauvegardé ou à une politique de gestion Affiche une carte montrant les éléments qui ont changés et non compliants Le modèle logique peut être exporté vers un fichier à plat pour documentation et peut être utilisé par d'autres outils.

25 PowerSC Trusted Surveyor HMC CR6 ou CR7 PowerSC Trusted Surveyor 5765-PTS : - HMC 7042-CR6 et 7042-CR7 uniquement Prérequis pour la LPAR AIX où est installé PowerSC TS : - IBM AIX 7 with Technology Level 2 ou plus récent, ou - IBM AIX 6 with Technology Level 8 ou plus récent - OpenSSH - Java SE 6 - Utilisation de RBAC 25

26 Liens de référence IBM Systems Magazine: PowerSC Cover Story Full link stemsmag/ibmsystems_power_201111/index.php#/22%29 PowerSC Portal Full link Disponible depuis janvier 2013 SG

27 Implémentation 27

28 Implémentation sur plateforme de test PowerHA1 p710a-vios1 p710a-vios2 LPAR VIOS p720 V

29 Trusted logging : Quels filesets installer? Sur chaque LPAR AIX Rien à installer sur chaque VIOS (la commande mkvlog est présente!) 29

30 Trusted logging : Quels filesets installés? 30

31 Trusted logging : vhost à créer entre le VIOS et la partition AIX 31

32 Trusted logging : vhost créé entre le VIOS et la partition AIX 32

33 Trusted logging : Création des fichiers journaux virtuels Plus besoin de passer la commande cfgdev 33

34 Trusted logging : le détail des fichiers journaux virtuels 34

35 Trusted logging : virtuels adaptateurs 35

36 Trusted logging : Création de l'interface virtuelle coté LPAR AIX 36

37 Trusted logging : Création de l'interface virtuelle coté LPAR AIX 37

38 Trusted logging : Interface virtuelle créée coté partition AIX 38

39 Trusted logging : devices coté partition AIX 39

40 Trusted logging : Ajout interface virtuelle sur autre VIOS 40

41 Trusted logging : Ajout vlog sur l'autre VIOS 41

42 Trusted logging : devices coté partition AIX Vlogs créés vers les deux VIOS 42

43 Trusted logging : configuration pour syslog 43

44 Trusted logging : modification paramétrage coté VIOS Modification à chaud du nombre de fichier journaux de 2 à 3 44

45 Trusted logging : audit 45

46 Trusted logging : vue globale PowerHA1 client id : 24 vhost2 p710a-vios1 vtlog0 /dev/vlog2 /dev/vlog3 /var/vio/vlogs/powerha1 vtlog1 serveur /syslog/powerha1_syslog.000 id : 24 /dev/vlog0 /toplog/powerha1_toplog.000 /dev/vlog1 client id : 34 vhost1 serveur id : 34 p710a-vios2 vtlog0 /var/vio/vlogs/powerha1 vtlog1 /syslog/powerha1_syslog.000 /toplog/powerha1_toplog

47 47

48 Special notices This document was developed for IBM offerings in the United States as of the date of publication. IBM may not make these offerings available in other countries, and the information is subject to change without notice. Consult your local IBM business contact for information on the IBM offerings available in your area. Information in this document concerning non-ibm products was obtained from the suppliers of these products or other public sources. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. IBM may have patents or pending patent applications covering subject matter in this document. The furnishing of this document does not give you any license to these patents. Send license inquires, in writing, to IBM Director of Licensing, IBM Corporation, New Castle Drive, Armonk, NY USA. All statements regarding IBM future direction and intent are subject to change or withdrawal without notice, and represent goals and objectives only. The information contained in this document has not been submitted to any formal IBM test and is provided "AS IS" with no warranties or guarantees either expressed or implied. All examples cited or described in this document are presented as illustrations of the manner in which some IBM products can be used and the results that may be achieved. Actual environmental costs and performance characteristics will vary depending on individual client configurations and conditions. IBM Global Financing offerings are provided through IBM Credit Corporation in the United States and other IBM subsidiaries and divisions worldwide to qualified commercial and government clients. Rates are based on a client's credit rating, financing terms, offering type, equipment type and options, and may vary by country. Other restrictions may apply. Rates and offerings are subject to change, extension or withdrawal without notice. IBM is not responsible for printing errors in this document that result in pricing or information inaccuracies. All prices shown are IBM's United States suggested list prices and are subject to change without notice; reseller prices may vary. IBM hardware products are manufactured from new parts, or new and serviceable used parts. Regardless, our warranty terms apply. Any performance data contained in this document was determined in a controlled environment. Actual results may vary significantly and are dependent on many factors including system hardware configuration and software design and configuration. Some measurements quoted in this document may have been made on development-level systems. There is no guarantee these measurements will be the same on generallyavailable systems. Some measurements quoted in this document may have been estimated through extrapolation. Users of this document should verify the applicable data for their specific environment. Revised September 26,

49 Special notices (cont.) IBM, the IBM logo, ibm.com AIX, AIX (logo), AIX 5L, AIX 6 (logo), AS/400, BladeCenter, Blue Gene, ClusterProven, DB2, ESCON, i5/os, i5/os (logo), IBM Business Partner (logo), IntelliStation, LoadLeveler, Lotus, Lotus Notes, Notes, Operating System/400, OS/400, PartnerLink, PartnerWorld, PowerPC, pseries, Rational, RISC System/6000, RS/6000, THINK, Tivoli, Tivoli (logo), Tivoli Management Environment, WebSphere, xseries, z/os, zseries, Active Memory, Balanced Warehouse, CacheFlow, Cool Blue, IBM Watson, IBM Systems Director VMControl, purescale, TurboCore, Chiphopper, Cloudscape, DB2 Universal Database, DS4000, DS6000, DS8000, EnergyScale, Enterprise Workload Manager, General Parallel File System,, GPFS, HACMP, HACMP/6000, HASM, IBM Systems Director Active Energy Manager, iseries, Micro-Partitioning, POWER, PowerLinux, PowerExecutive, PowerVM, PowerVM (logo), PowerHA, Power Architecture, Power Everywhere, Power Family, POWER Hypervisor, Power Systems, Power Systems (logo), Power Systems Software, Power Systems Software (logo), POWER2, POWER3, POWER4, POWER4+, POWER5, POWER5+, POWER6, POWER6+, POWER7, POWER7+, Systems, System i, System p, System p5, System Storage, System z, TME 10, Workload Partitions Manager and X-Architecture are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol ( or ), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A full list of U.S. trademarks owned by IBM may be found at: Adobe, the Adobe logo, PostScript, and the PostScript logo are either registered trademarks or trademarks of Adobe Systems Incorporated in the United States, and/or other countries. AltiVec is a trademark of Freescale Semiconductor, Inc. AMD Opteron is a trademark of Advanced Micro Devices, Inc. InfiniBand, InfiniBand Trade Association and the InfiniBand design marks are trademarks and/or service marks of the InfiniBand Trade Association. Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. IT Infrastructure Library is a registered trademark of the Central Computer and Telecommunications Agency which is now part of the Office of Government Commerce. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. Linear Tape-Open, LTO, the LTO Logo, Ultrium, and the Ultrium logo are trademarks of HP, IBM Corp. and Quantum in the U.S. and other countries. Linux is a registered trademark of Linus Torvalds in the United States, other countries or both. PowerLinux uses the registered trademark Linux pursuant to a sublicense from LMI, the exclusive licensee of Linus Torvalds, owner of the Linux mark on a worldwide basis. Microsoft, Windows and the Windows logo are registered trademarks of Microsoft Corporation in the United States, other countries or both. NetBench is a registered trademark of Ziff Davis Media in the United States, other countries or both. SPECint, SPECfp, SPECjbb, SPECweb, SPECjAppServer, SPEC OMP, SPECviewperf, SPECapc, SPEChpc, SPECjvm, SPECmail, SPECimap and SPECsfs are trademarks of the Standard Performance Evaluation Corp (SPEC). The Power Architecture and Power.org wordmarks and the Power and Power.org logos and related marks are trademarks and service marks licensed by Power.org. TPC-C and TPC-H are trademarks of the Transaction Performance Processing Council (TPPC). UNIX is a registered trademark of The Open Group in the United States, other countries or both. Revised November 28, 2012 Other company, product and service names may be trademarks or service marks of others. 49

50 Notes on benchmarks and values The IBM benchmarks results shown herein were derived using particular, well configured, development-level and generally-available computer systems. Buyers should consult other sources of information to evaluate the performance of systems they are considering buying and should consider conducting application oriented testing. For additional information about the benchmarks, values and systems tested, contact your local IBM office or IBM authorized reseller or access the Web site of the benchmark consortium or benchmark vendor. IBM benchmark results can be found in the IBM Power Systems Performance Report at All performance measurements were made with AIX or AIX 5L operating systems unless otherwise indicated to have used Linux. For new and upgraded systems, the latest versions of AIX were used. All other systems used previous versions of AIX. The SPEC CPU2006, LINPACK, and Technical Computing benchmarks were compiled using IBM's high performance C, C++, and FORTRAN compilers for AIX 5L and Linux. For new and upgraded systems, the latest versions of these compilers were used: XL C for AIX v11.1, XL C/C++ for AIX v11.1, XL FORTRAN for AIX v13.1, XL C/C++ for Linux v11.1, and XL FORTRAN for Linux v13.1. For a definition/explanation of each benchmark and the full list of detailed results, visit the Web site of the benchmark consortium or benchmark vendor. TPC SPEC LINPACK Pro/E GPC VolanoMark STREAM SAP Oracle, Siebel, PeopleSoft Baan Fluent TOP500 Supercomputers Ideas International Storage Performance Council Revised December 2,

51 Notes on HPC benchmarks and values The IBM benchmarks results shown herein were derived using particular, well configured, development-level and generally-available computer systems. Buyers should consult other sources of information to evaluate the performance of systems they are considering buying and should consider conducting application oriented testing. For additional information about the benchmarks, values and systems tested, contact your local IBM office or IBM authorized reseller or access the Web site of the benchmark consortium or benchmark vendor. IBM benchmark results can be found in the IBM Power Systems Performance Report at All performance measurements were made with AIX or AIX 5L operating systems unless otherwise indicated to have used Linux. For new and upgraded systems, the latest versions of AIX were used. All other systems used previous versions of AIX. The SPEC CPU2006, LINPACK, and Technical Computing benchmarks were compiled using IBM's high performance C, C++, and FORTRAN compilers for AIX 5L and Linux. For new and upgraded systems, the latest versions of these compilers were used: XL C for AIX v11.1, XL C/C++ for AIX v11.1, XL FORTRAN for AIX v13.1, XL C/C++ for Linux v11.1, and XL FORTRAN for Linux v13.1. Linpack HPC (Highly Parallel Computing) used the current versions of the IBM Engineering and Scientific Subroutine Library (ESSL). For Power7 systems, IBM Engineering and Scientific Subroutine Library (ESSL) for AIX Version 5.1 and IBM Engineering and Scientific Subroutine Library (ESSL) for Linux Version 5.1 were used. For a definition/explanation of each benchmark and the full list of detailed results, visit the Web site of the benchmark consortium or benchmark vendor. SPEC LINPACK Pro/E GPC STREAM Fluent TOP500 Supercomputers AMBER FLUENT GAMESS GAUSSIAN ANSYS Click on the "Benchmarks" icon on the left hand side frame to expand. Click on "Benchmark Results in a Table" icon for benchmark results. ABAQUS ECLIPSE MM5 MSC.NASTRAN STAR-CD NAMD HMMER Revised December 2,

52 Notes on performance estimates rperf for AIX rperf (Relative Performance) is an estimate of commercial processing performance relative to other IBM UNIX systems. It is derived from an IBM analytical model which uses characteristics from IBM internal workloads, TPC and SPEC benchmarks. The rperf model is not intended to represent any specific public benchmark results and should not be reasonably used in that way. The model simulates some of the system operations such as CPU, cache and memory. However, the model does not simulate disk or network I/O operations. rperf estimates are calculated based on systems with the latest levels of AIX and other pertinent software at the time of system announcement. Actual performance will vary based on application and configuration specifics. The IBM eserver pseries 640 is the baseline reference system and has a value of 1.0. Although rperf may be used to approximate relative IBM UNIX commercial processing performance, actual system performance may vary and is dependent upon many factors including system hardware configuration and software design and configuration. Note that the rperf methodology used for the POWER6 systems is identical to that used for the POWER5 systems. Variations in incremental system performance may be observed in commercial workloads due to changes in the underlying system architecture. All performance estimates are provided "AS IS" and no warranties or guarantees are expressed or implied by IBM. Buyers should consult other sources of information, including system benchmarks, and application sizing guides to evaluate the performance of a system they are considering buying. For additional information about rperf, contact your local IBM office or IBM authorized reseller. ======================================================================== CPW for IBM i Commercial Processing Workload (CPW) is a relative measure of performance of processors running the IBM i operating system. Performance in customer environments may vary. The value is based on maximum configurations. More performance information is available in the Performance Capabilities Reference at: Revised April 2,