WHITE PAPER Content-Aware Identity & Access Management in a Virtual Environment | June 2010

content-aware identity & access management in a virtual environment

Chris Wraight
CA Security Management

we can

Content-Aware Identity & Access Management in a Virtual Environment

table of contents
executive summary
SECTION 1 Virtual security challenges are more problematic Virtualization technology allows It to respond and reduce operating costs Physical security is well established Virtualization technologies can be more difficult to secure than physical machines Managing roles, identities, and applications Controlling privileged users Data sprawl grows rapidly Inadequate auditing hampers compliance SECTION 2 Protecting the virtual environment SECTION 3 CA Content-Aware IAM provides superior protection Seamlessly secure physical and virtual environments Control identities Control access Control information Verify control SECTION 4 Conclusions SECTION 5 References SECTION 6 About the author

04 04 04 04 05 05 06 06

06

08 08 08 08 09 09

10

10

10

Content-Aware Identity & Access Management in a Virtual Environment

executive summary
Challenge
the identity and access management challenges that exist in the physical worldidentity management, application security, access control, managing sensitive data, user activity logging, and compliance reportingare even more critical in the virtual environments that are growing in use as It seeks to streamline its operations and reduce operating costs. In fact, in a virtual environment, the security challenges multiply rapidly and introduce new risks. Where an organization might have had a single application server, in a virtual environment they could see that quickly evolve to thirty servers. How can security be maintained, not only on a physical machine, but also on the virtual machines it hosts, and the applications running on those virtual machines? And how easy is it for an organization to manage this from a central location?

Opportunity
Organizations have begun to quickly adopt virtualization technology to help them streamline their operations and reduce operating costs. Recognizing that their exposure to security risks is increased due to the nature of the virtualization environment, It should seek to extend their security solutions from the physical server environment to the virtualization environment as seamlessly as possible. In an ideal situation, the organization should be able to manage both environments from a single location with the same software solutions.

Benefits
CA Content-Aware IAM solutions that help protect our customers in the physical world seamlessly extend to similarly protect virtual environments by controlling identities, access, and information usage. Key benefits of the solutions in a virtual environment include privileged user management of virtual administrators, fine-grained access controls on virtual hosts and guests, enhanced user activity and compliance reporting in virtual environments, sensitive data discovery on virtualized systems, and extension of identity and access management capabilities to virtual systems and applications.

03

Content-Aware Identity & Access Management in a Virtual Environment

Section 1: Virtual security challenges are more problematic

Virtualization technology allows IT to respond and reduce operating costs Its increased use of virtualization technology is due to the benefits of streamlined operations and reduced operating costs. But in a virtual environment, the security challenges multiply rapidly and introduce new risks. Where an organization might have had a single application server, they could see that quickly evolve to thirty servers. How can security be maintained, not only on a physical machine, but also on the virtual machines it hosts, and the applications running on those virtual machines? And how can an organization control and manage this from a central location? As an example, a Fortune 50 company takes up to six months to deliver a server to their internal customer, which is five months and three weeks too long for them to remain competitive. By using virtualization technology, they expect to reduce that interval to five business days. From an operating cost perspective, by using virtualization technology, It can approach 100% utilization of a physical server. In return, they may reduce physical space requirements, which, in turn, may also reduce their real estate, personnel, bandwidth, and HVAC costs. Physical security is well established Over the past fifty years, security for physical It operations has become well established. Whether the security involves controlling physical access to a server (e.g. rack-mounted server cages) or identity management software, rules, processes, and best practices have been established. Security software has evolved to provide It with the right tools to manage the physical environment. In addition to identity management, application security, access control, information control, user activity logging, and reporting are all solutions being used effectively today. Virtualization technologies can be more difficult to secure than physical machines Regardless of whether it is a physical or virtual environment, the need for complete security management remains. According to Gartner, through 2012, 60% of virtualized servers will be less secure than the physical servers they replace, dropping to 30% by YE 15.1 Meeting compliance regulations, managing and governing identities, controlling access, as well as finding, classifying, and controlling how information is used, are the biggest challenges facing It as they migrate to virtual environments. Virtualization technologies enable the execution of multiple operating system instances, or virtual machines (VMs), on the same physical piece of hardware. Each VM functions as if it were its own physical machine with a dedicated operating system and hosted applications. the layer within the virtualization platform that enables hardware resource sharing among VMs is called the hypervisor. When we want to identify the risks of virtualization, we first need to understand how virtualization is different from traditional physical environments. In the physical server environment, native operating system security does not provide protection for mission-critical data and resources at the level needed to meet regulatory compliance and security best practices, and this carries over to the virtualization environment. the virtualization host becomes more critical as it hosts many virtual machinesnot
04

Content-Aware Identity & Access Management in a Virtual Environment

only one. the hypervisor serves as a single management point to all VM images and control over many critical services, creating a vulnerability leverage point. A person with hypervisor access is analogous to a root user in the UNIX world; this person can do anything to any of the hosted machines. Compromising the hypervisor to download an image or introduce a rogue VM is equivalent to bypassing physical security to break into a server room in order to steal a machine or introduce an unauthorized machine to the data center. Virtualization management applications can be bypassed and the hosting operating system or virtualization console can be accessed directly by privileged users. We used to have servers stacked away in our server room with tight physical controls in place to control access to the boxes. In a virtual environment, servers are files that can be copied from the Host. Copying a server image is equivalent to stealing a server from the server room. Furthermore, machine memory can be accessed from the hypervisor, compromising transmitted information like passwords and encryption keys. So, safeuarding access to the virtualization hosteven remote accessis critical. the modern virtual data center is highly distributed, unlike the traditional mainframe. Risks that were previously mitigated using physical security must now be handled by It security. Managing roles, identities, and applications If identities are not well managed in the physical world, then attempting to implement a virtual environment will exacerbate the identity and access problems that exist today. Using software to clearly define and manage users and roles is what many companies do today. this then coordinates with an identity management solution to confirm that users are only granted the appropriate privileges. If not managed properly, uncontrolled, overprivileged users will be able to wreak havoc on a greater number of systems and applications in a virtual environment. On the other side of the security spectrum is the need to manage secure access to applications, by users as well as other applications or services. In a virtualized environment, application servers will come online and go offline as computing demands ebb and flow. A scalable access management platform to provide proper fine-grained access controls needs to be in place before virtualization of many applications can take place. this enables organizations to leverage a reliable and secure platform for both the physical and virtual environments. Controlling privileged users Normal users are identified and controlled by the operating system and application security. they may make mistakes or attempt misuse; however, provided the controls are correctly set, they should not be able to breach confidentiality or damage the system. the privileged user has elevated privileges on the servers. the privileged users access is not controlled by the operating system security, and his/her username and/or password is typically shared between administrators, making him/her mostly anonymous. Virtualization makes the problem worse. the administrator not only has leverage over the physical host, but also all of the virtual sessions running on it. He/She can also have access to sensitive data and have an impact on business continuity. Without an independent access control solution, multiple privileged users in various roles have the ability to interact with numerous components of a virtualization deployment. this inadequately regulated access to the hypervisor presents the potential for significant damage to the enterprise through the compromise of valuable information
05

Content-Aware Identity & Access Management in a Virtual Environment

and disruption of critical services. VM images can be copied, along with the data and applications that they hold. these images can be brought back online on an unsecured network, making it easier for an intruder to access the contents managed within the copied image. A well-meaning developer at a large insurance company made a clone of a production VM and launched it in a QA environment. the company had no controls on access, so the developer was allowed free access to QA, Development, and Production environments. When he turned on the copy of the system, the machine behaved as though it was in production. the developer ran some claims scenarios in order to test functionality, and didnt realize that the system was actually cutting checks and kicking off the process to mail the checks to customers. One customer received two checks for a claim that was already in process and called to ask about which one should be cashed; this was the way the company found out what was occurring. this is the nightmare scenario for many It organizations. Data sprawl grows rapidly As virtualized servers grow, so too does the amount of sensitive company data residing on them. Personal medical files, proprietary product plans, employee records, and credit card data is information that needs to be located and prevented from leaving the organization. How can an organization keep track of this information, especially if VMs may come online and go offline? Inadequate auditing hampers compliance Given the leverage the virtualization platform has on the stability of the entire data center and on the integrity of the data it manages, it must be viewed as critical infrastructure. As a result, the virtualization platform is subject to tight regulatory requirements. Organizations must track the interaction that each user has with the virtualization platform and within each of the VMs it hosts. However, native audit capabilities provided by operating systems are too coarse to be effective and are vulnerable to tampering and to snapshot manipulation. Auditors, until lately have not been virtualization savvy, and virtualization audit issues havent yet been regularly flagged. But this is changing, as seen by the recent updates to various common regulations such as PCI. Access to the hosting operating system must be tracked and audited to prove controls have maintained its integrity and effectiveness. Similarly, within each VM, access gained to each guest operating system is subject to the same regulatory compliance requirements.

Section 2: Protecting the virtual environment

It organizations have begun to quickly adopt virtualization technology to help them streamline their operations and reduce operating costs. Recognizing that their exposure to security risks is increased due to the nature of the virtualization environment, It should seek to move their security solutions from the physical server environment to the virtualization environment as seamlessly as possible. In an ideal situation, the organization should be able to manage both environments from a single location and extend software solutions used in the physical world. Identity and access management solutions are critical to confirming that systems and applications are well managed and controlled.
06

Content-Aware Identity & Access Management in a Virtual Environment

the authorized people and security processes that have already been defined should be leveraged to secure and manage the virtual environment. As seen in Figure 1, a content-aware identity and access management solution encompasses several areas. to the left, role and access policy management are outside the virtual server; this solution is defining the various roles of users that are going to be accessing the virtual machines (VMs). On the right, system and application access is being brokered by security software. the applications will be running on the VMs, e.g., a database, ERP, etc. Sometimes this software will also run on a VM as well and it could occasionally be offline. In the middle are the virtual systems and applications. Here, multiple VMs will run an assortment of applications that are critical to the business. they can be running all the time, or just when demand requires. A privileged user management application, along with fine-grained access control, will control privileged userswhat they can and cannot doboth getting to a VM in the first place, or an application running in the VM itself. Compliance reporting will collect activity from all the logs in the environment. As with other areas, the VM could be offline and must be accounted for even though it is not active. As soon as the VM comes online, it needs to be able to begin logging user activity. Information protection facilitates the management of the data sprawl that accompanies VM sprawl so that it remains under control, and sensitive company information can be identified and prevented from leaving the organization via unauthorized means.

Figure 1

A content-aware identity & access management virtual environment

07

Content-Aware Identity & Access Management in a Virtual Environment

Section 3: CA Content-Aware IAM provides superior control

Seamlessly secure physical and virtual environments CA Content-Aware IAM solutions helps organizations control identities, control access, and control information use across their entire environment. these solutions provide protection in the physical world and seamlessly extend to protect virtual environments by controlling identities, access, and information usage, and providing compliance reporting. Key benefits of the solutions in a virtual environment include privileged user management of virtual administrators, fine-grained access controls on virtual hosts and guests, enhanced user activity and compliance reporting in virtual environments, sensitive data discovery on virtualized systems, and extension of identity and access management to virtual systems and applications. Control identities CA Identity Manager provides an integrated identity administration solution, serving as the foundation for user provisioning, self-service requests, and other key processes. With the growing number and types of users requiring access to critical applications, the line between privileged and unprivileged users is not always clear. A robust provisioning solution like CA Identity Manager will allow you to keep better control of all your users, documenting who requested and authorized entitlements and privileges and why they did so. By implementing a workflow-based policy for approvals, you can confirm that users get what they need to do their jobs effectively and efficiently, within the boundaries of corporate policies. CA Role & Compliance Manager is designed to remove the fire drill from your security and compliance initiatives by automating identity governance processes and providing continuous identity controls. Given the heightened security risk associated with virtualization, it becomes more critical to validate that user access to these environments is appropriate through periodic certification or attestation. CA Role & Compliance Manager automates these processes while checking security policies, such as segregation of duties, to highlight violations to business managers or resource owners during certification. Proper identity controls minimize the risk of unauthorized users accessing virtualized systems and applications. Strong governance processes and controls give organizations the confidence needed to leverage virtualization. Control access With advanced security management capabilities and enterprise-class site administration, CA SiteMinder provides the centralized security management your organization needs to authenticate users and control access to web applications and portals regardless of whether they are on physical or virtual servers. this robust solution addresses the critical need for automated tools that can centrally manage your web users and their access to web applications, portals, and services. As new virtual applications come online, CA SiteMinder transfers the SSO experience from physical servers to the virtualization environment by bringing them under a single authentication and authorization platform and removes the need to develop new security mechanisms for virtualized applications.
08

Content-Aware Identity & Access Management in a Virtual Environment

CA Access Control (AC) provides the critical layer of protection needed to help effectively protect virtualization platforms. AC operates independently both at the application level and at the operating system level. By enforcing and proving proper administrator access, AC helps protect mission-critical information and services running in the virtual data center. AC protects virtualization deployments at multiple levels: the core console of a hypervisor, operating systems implementing OS-based virtualization, privileged partitions managing hypervisor-based virtualization, and the critical resources in VMs running on all of the above. Support of a wide range of operating systems and virtualization platforms (VMWare, Xen, Hyper-V, etc.) makes Access Control ideal for protecting VMs, especially in a heterogeneous environment. Access Control also allows you to protect privileged users across the It environments beyond the virtualization host itself on databases, network devices, and applications. It also helps simplify user management by consolidating it under a single authoritative source across all operating systems. Control information the CA DLP solution includes a robust and integrated set of products that help organizations manage the risk of uncontrolled information use and prevent data loss as data sprawls onto virtual systems. the CA DLP solution is a scalable, highly accurate, and cost-effective offering that is designed to protect and control data-in-motion on the network and in the messaging system, data-in-use at the endpoint, and data-at-rest on physical or virtual servers and repositories across the enterprise. By leveraging a single set of policies, a unified management platformCA DLPcan find and protect sensitive (e.g., social security numbers) and valuable (e.g., intellectual property) information stored and transmitted throughout the organization. Verify control CA Enterprise Log Manager provides user activity and compliance reporting for identity, access, and data usage across physical, virtual, and cloud environments. It verifies security controls and streamlines reporting and investigation of user and resource access activities to help accelerate and simplify compliance and improve efficiencies. When the auditors ask, It must be able to easily create and provide reports that track any or all entitlements provisioned, including the time, reason, and persons who approved and provisioned them. Likewise, they must also demonstrate when users were deprovisioned following the end of a contract or termination. Deployed as a virtual soft appliance, CA Enterprise Log Manager can be up and running quickly, providing predefined and easy-to-customize reports covering all user activities, including those from hypervisors. It supports commonly used virtualization platforms, including VMware, Citrix, Microsoft, and Cisco, and provides broad coverage across virtual servers, network, storage, and management systems. the results can include rapid time-to-value, better visibility of user activity, and simplified reporting and analysis of virtualization hosts and guests.

09

Section 4: Conclusions
the rapid growth of virtualization technology shows no sign of abating, as the potential benefits to It such as streamlining operations and reducing operating costs are real and significant. Yet It must recognize that the virtualization environment itself creates new security issues, issues that are best addressed with a comprehensive content-aware identity and access management solution. CA technologies provides a robust set of identity and access management solutions that can improve security and simplify compliance in both physical and virtualized environments.

Section 5: References
Securing Virtualized Environments & Accelerating Cloud Computing, white paper by Nimrod Vax. Identity and Access Management for the Cloud: CAs Strategy and Vision CAs Solution for Cloud Security

Section 6: About the author

Chris Wraight has spent 25+ years in the technology world in various positions of product management, marketing, and sales. He is currently working on the Access Control security solution in CA technologies Security Management business. Chris has a B.S. in Management with Computer Applications from WPI.

1 Gartner Research Report Addressing the Most Common Security Risks in Data Center Virtualization Projects, N. MacDonald, 25 January 2010, #G00173434.

Copyright 2010 CA. All rights reserved. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies. this document is for your informational purposes only. CA assumes no responsibility for the accuracy or completeness of the information. to the extent permitted by applicable law, CA provides this document as is without warranty of any kind, including, without limitation, any implied warranties of merchantability, fitness for a particular purpose, or noninfringement. In no event will CA be liable for any loss or damage, direct or indirect, from the use of this document, including, without limitation, lost profits, business interruption, goodwill, or lost data, even if CA is expressly advised in advance of the possibility of such damages. 2315
10