When using an application-based policy approach, security is a critical part to the application workload. Security is just as important as how much CPU or RAM you give an application workload. The VMware NSX Platform introduces 3 primary use cases when it comes to security for application workloads. We’re going to focus on the first use case: Micro-segmentation and how it relates to Healthcare organizations.
A quick background on why Micro-segmentation is important and security trends in modern data centers. In most modern data centers, there has been a large uptick in the amount of traffic that occurs between systems rather than inbound-and-outbound of systems. This is referred to as East-West traffic within the data center, versus North-South traffic in and out of the data center. In the hardware-base world, security for East-West traffic is sometimes done either by sending the traffic from their applications to their perimeter firewalls or by purchasing hardware appliances to put inside the data center between the applications. This form of security is through isolation and segmentation of the applications. You can do this at the entire application level through concepts such as Trust Zones, achieving what some call macro-segmentation, but when we place security at the workload level we achieve what’s called, micro-segmentation. Micro-segmentation facilitates a Zero-Trust security model. Zero-Trust means that unless communications between systems are explicitly trusted, it’s implicitly untrusted. The application of Micro-segmentation using a hardware-based approach creates a two-fold problem:
Lack of interior controls and security If an organization simply does nothing, no use of micro-segmentation, to secure the East-West traffic within their data center, the perimeter firewall becomes the single point of entry and security to their environment from North-South. This type of defense still provides protection, however once an attacker is able to break through that perimeter, unfettered access around the inside of the environment is rather easy. With no lateral controls, the attack surface is enormous for attackers to work with.
Operationally infeasible and lack of scale If an organization puts in hardware appliances or use the external firewall to facilitate Micro-segmentation for both East-West and North-South traffic firewalling, those systems become operationally difficult to manage. Hardware appliances are costly and only scale to a point. Multiple user interfaces and policies that don’t scale as you add new workloads or even modify existing workloads into your data center and certainly don’t provide mobility in a virtualized environment. As you add new applications you may need to add more firewalls. If a workload needs to move, you may need to move or change the rules associated with that application. And what happens when that application needs to talk to another application? All those rules need to change as well. While this can reduce the attack surface of the application, it’s operationally infeasible to support and lacks scaling as a long term option for customers.
How does the VMware NSX Platform provide a business value around these issues? The VMware NSX Platform uses a software-defined micro-segmentation approach applied at the Virtual Machine workload level to facilitate a Zero-Trust security model. This security is built into the vSphere hypervisor creating a distributed and scale-out firewalling architecture. This architecture provides kernel-level performance and scales as your organization and workload requirements increase without the need to add more specific hardware appliances to the environment.
Let’s focus on Healthcare customers specifically. A recent study by the Ponemon Institute and IBM for 2016, shows that a security breach and exposure of a patient health record is now averaging $355 per record. The average total cost to an organization in the US was $7.01 million and the average number of records breached was around 29,000. Traditional methods of security, like those listed above, are no longer sufficient to prevent attacks. While there is no ‘silver bullet’ to security, Healthcare organizations can provide a layered approach to security that helps reduce their attack surface overall and reduce the potential for exposure. The VMware NSX Platform, through the use of Micro-segmentation, allows Healthcare organizations to accomplish this.
The VMware NSX Platform can provide an application-based security policy around the critical and patient information sensitive applications within the data center. This provides us the ability to effectively control all communication paths both in and out of the application, thus reducing the attack surface of that application immensely.
The EMR/EHR system for Healthcare organizations, represents a mission-critical application for the organization and houses the majority of patient record information. For this example, we’re going to look at a typical installation of an Electronic Medical/Health Records system, EMR/EHR, and how traffic both in and out and between the servers within the application are secured. They can be comprised of several windows/linux and Appliance-based systems. Below is a typical example of the layout of an EMR/EHR system server architecture. Most consist of a client application that connects to the Application Server which has a Database Server connection where the data is stored.
Let’s take a look at traditional security approaches to East-West and North-South traffic isolation, first. You’ll see below that for North-South traffic, the end user workstation could traverse through either a perimeter firewall or an internal data center firewall before it gets to the presentation layer of the EMR/EHR. Also from an East-West perspective, to secure communications between the servers within the application and Shared Services, the traffic patterns will need to traverse through those same firewalls to either allow or block the communications necessary for the application to function. This creates a hair pinning effect that is operationally inefficient.
With the Physical Firewall Policy, we’re now sending all the traffic through the external firewall to do the segmentation for the applications. This firewall could also be an internal firewall between the applications. Nevertheless, the premise stands. Sending all the traffic through that firewall will not scale-out as your workloads increase and this is just one application in this environment. Most Healthcare organizations have hundreds of applications they need to secure.
With the VMware NSX Platform, we instantiate a stateful, Layer 2-4, firewall at the Virtual Machine virtual network card level, which allows us to create security policies based on the application, that can secure the application in the host itself, rather than traversing to an external firewall. This reduces the dependency on the external and internal physical firewalls for allowing and disallowing of traffic both in and out and between the EMR/EHR system and provides a much more operationally efficiency configuration for both network and operational resources.
As you can see, the VMware NSX Platform has Security Policies created for each of the different applications, in this case the EMR App Server, the EMR DB Server, and the Infrastructure Services Servers
