Hi,

I’m pleased to announce to availability of the official release of the vSphere 5.1 Hardening Guide. The guide is being released as an Excel spreadsheet only. This guide follows the same format as the 5.0 guide.

All reference and documentation URL’s and code samples have been updated for 5.1. The guide is available here

The permanent home will be here soon: http://vmware.com/go/securityguides

Also available is a separate document containing the Change Log for the guide. The Change Log is available here

Thanks to everyone who contributed feedback on the Public Drafts and also the team at VMware for their outstanding work in making this guide possible.

mike

Hello? Is this thing on?

A brief intro for those that don’t know me and my new role. My name is Mike Foley. I’m a Sr. Technical Marketing Manager, working for Charu Chaubal in VMware’s Technical Marketing group. My primary role is that of technical marketing support for security of the core vSphere platform. I come from RSA, where I was their virtualization evangelist/go-to guy for many years. My personal blog is at http://yelof.com and I’m on Twitter as @mikefoley.

I would like to announce the **draft** release of the vSphere 5.1 Security Hardening Guide.  This initial draft release has taken the 5.0 guide and updated it for 5.1. What it does NOT contain at this time is a complete review of functionality around the new 5.1 SSO capabilities. We are working on those parts and hope to have an updated draft very soon.

We’d love to hear your feedback, good and bad, on the contents of the guide. I would encourage you to post your reply in the Security and Compliance Communities forum but if you have more sensitive concerns, send it to me at mfoley@vmware.com.

The vSphere 5.1 Security Hardening Guide has been posted to the VMware Communities in the “Security and Compliance” area, in the Documents tab.  Thanks to everyone who provided feedback on the Public Draft, and also to the team at VMware who contributed to this guide in many significant ways.

Thanks,
mike foley

Written by Jeremiah Cornelius - Security Architect – VMware Global Strategic Alliances

VMware vShield Endpoint enables Symantec Endpoint Protection 12 – offloading anti-virus and anti-malware agent processing to a dedicated secure virtual appliance – streamlining deployment and monitoring for your VMware environment.

One year ago, there was really only a single option available if a VMware customer wished to use the vShield Endpoint introspection possible on vSphere to protect servers or virtual desktops.  As 2013 begins, the number of partner solutions has grown to a half-dozen and continues to grow. It’s probably an understatement to call the latest of these, “much anticipated”.  The introduction I’m referring to is Symantec’s Endpoint Protection 12.1.2. With the mid-December availability of Symantec’s entry to the field of virtual guest protection, we welcome a new year.

Symantec has been working with the VMware vCloud Security team for several years. Now, I’m glad to see that our shared customers can begin to enjoy the rewards of our strategic alliance.

“We collaborated closely with Symantec so that VMware vShield Endpoint and Symantec Endpoint Protection 12 will work together… our customers need the right security solutions to embrace virtualizing business critical applications and to accelerate cloud adoption.”

Parag Patel, vice president, VMware

Symantec support for VMware vSphere and View deployments delivers the opportunity for a unified solution across your entire infrastructure. Managing operations of both physical and virtual endpoints through single, uniform policies and management, Symantec Endpoint Protection coupled with vShield Endpoint – can now improve virtualization consolidation ratios, and prevent anti-virus storms in the software-defined data center, along with the traditional protection, already relied upon. I’m also glad that the new Symantec Endpoint Protection release continues offering improvement in the detection engine and behavior-based blocking of “zero day” attacks. Technologies like Insight and SONAR allow reduction of anti-virus scans and maximum performance. Effort has been also made to simplify your deployment and updating while improving the quality of reporting.

The additional benefit I’d like to share with customers for coupling Symantec’s protections with vShield Endpoint is the additional layer for defense in depth – agent-less and directly from the VMware Cloud infrastructure, without further guest configuration. This improves your overall security posture and compliance for the growing number of virtual machines deployed in testing, development, and private cloud deployments.

We also made it easier to acquire the vShield Endpoint part of this. Recognizing the value of ensuring security and compliance audit requirements for the expanding roles of virtualization and private clouds, VMware customers with valid Support and Subscription (SnS) contracts for vSphere Essentials Plus or higher editions are now entitled to vShield Endpoint functionality at no extra cost. This means that vShield Endpoint is now licensed with vSphere, and better positioned to deliver you these benefits with Symantec Endpoint Protection today.

Symantec has additional security solutions that work with VMware vShield and vCloud Networking and Security to create a broad set of solutions for VMware customers, to provide:

• Optimized Endpoint Protection for High-density Virtual Environments
• Orchestrated Data Loss Prevention
• Compliance Across Converged Infrastructure
• Protection for Virtual Data Centers Against Advanced Threats
• Integrated Threat Intelligence

There’s more details and information on these protections, including whitepapers and solutions briefs at – VMware Solutions Exchange and Symantec Partner: VMware.

I spend the majority of my time researching and talking about current threats and vulnerabilities and their subsequent countermeasures.  There are many essential components of an  IT policy for these and most people have a good handle on two of the three most important components.

First and foremost, an effective patch management process needs to be implemented in every organization.  As  non-Microsoft products are increasingly created and used by organizations, patching is not simply a Microsoft issue anymore.  Patching is widely considered a pro-active approach to vulnerability management.  An effective patch management process will effectively plug holes in vulnerabilities before they are exploited.  Most companies have had an effective process around operating system patching (Microsoft Windows, Mac OS, Unix/Linux) and now are starting to focus on application patching that may not be a part of the major software vendors commonly used today.

Second, an effective Antivirus strategy is critical in this defense.  An Antivirus defense can be considered a reactive approach to security and vulnerability management.  Fixing software vulnerabilities will ensure a potential virus cannot attack the insecure software.  But, Antivirus is still a critical component even in an organization that has all systems up to date with patches.  During the year, we see many Zero-day vulnerabilities that are announced and attacked.  A Zero-day vulnerability is a vulnerability that does not currently have a patch to fix the issue.  This can create a headache for organizations as they patiently wait for a vendor to fix the issue.  An effective Antivirus solution will ensure that viruses are discovered and removed before anything malicious can happen to these vulnerable systems.

As you can see, patch management and Antivirus are both effective and critical processes.  In addition, there is a third option that is quite often left out.

This last option I quite often reference to organizations that are grappling a good security policy.  1.  Have a good patch management policy and process.  2.  Ensure all of your assets are covered by some type of anti-virus product.  And 3- Diminish your attack surface.

An attack surface in regards to vulnerabilities is the amount of software programs that are installed on your machine.  If a program is not used, remove the unneeded and unused software from the machine.  This will reduce the number of software programs that must be managed and monitored for potential vulnerabilities.

We all know of machines on our networks that are like a bad episode of Hoarders.  These machines had software programs that were installed to be used in one instance, and the software was left on the machine.  It is important to note that all software has the potential to contain known and unknown vulnerabilities.  Reducing the number of software programs running on a machine will mitigate the potential for attack.   However, one of the challenges of this third type of policy is identifying software on machines.  The benefit of adding in a strategy for managing software on your network is the reduction of the amount of time needed for patch management and virus removal. VMware offers several vulnerability management solutions that allow administrators to identify installed software on many machines on a network, including:

VMware vCenter Protect  Advanced (for organizations of all sizes)
- IncludesPatch Management, Software Asset Inventory, Antivirus protection, ITScripts and Power Management

VMware Go (for the small-to-medium size business)
- Includes Patch Management and Software Asset Inventory

VMware vCenter Configuration Manager (for enterprise organizations)
- Includes Patch Management and Software Asset Inventory

In the image below, I have provided an example of software assent inventory in VMware vCenter Protect and VMware Go.

(VMware vCenter Protect)

(VMware Go)