Everything is moving in different directions, at an increasingly rapid rate of change. As new applications are evolving faster than ever, they are adopting more modern application development frameworks. The extension to a multi cloud environment is obfuscating the perimeter, and an entirely new breed of devices is connecting to the network, faster than ever. Unfortunately, despite the increase in security spend the data breaches are coming, faster than ever.
This new norm of accelerated change is not soon to abate. A new framework is needed. As our network and security teams are taking on water, in a constant state of flurry plugging holes as fast as they can, new deployments of infrastructure and applications need to account for a design that isn’t reactionary. The modern network and security apparatus cannot be designed in response to the applications, but built designed for the applications. One that can apply policy for the application based on its identity rather than its zip code. To do this you need a open and policy based approach with a decoupling of location from identity. This is the framework for Cisco ACI.
Baseline Security in ACI
A modern digital business runs 100% of transactions, at some point in its lifecycle from supply chain to ledger, over the digital infrastructure. A disruption in availability is a disruption to the business. A disturbance in confidentiality sends a shockwave throughout the force, felt by all stakeholders from customer to shareholder. The baseline security is the bedrock for the digital business, and key aspect of Cisco ACI is that it was built from the ground up with security in mind. Its innovation to separate location from identity, and create a group based policy structure, expanded the adjacent possible from what traditional networking was capable of. With these innovations, it is possible to create scalable and manageable whitelist security policies for the purpose of standard (network level) macro (OS level), and Micro (App/instance level) segmentation.
In addition, the system itself has been hardened to ensure a chain of trust, and certificate based provisioning with human verification, of all devices brought into the fabric. This allows a “trust, but verify” approach with a separation of duties, with the fabric able to validate the Who and Where of new fabric nodes coming on the network, with a human to validate the Why is correct. This dual verification is enforced for fabric registration to attempt to remove the human induced failures of yesteryear, where miscabling would create an outage, or allow bridging between unintended segments.
And the human aspect is one explicitly considered in the security of ACI. The ability to use role based access control and grouping of applications allows for securely tested application profiles to be created and validated, and the frequent move/add/changes/and deletes to either be policy based (based on attribute), or provisioned by users only into the certified security zones. This decouples and creates a separation of duties between who can configure a policy, and who can configure an endpoint.
To properly secure this system it also needs system level hardening to protect itself. This hardening is based upon the confidentiality, integrity, and availability critical to protecting business critical infrastructure. Code signing and verification, dual factor access controls, encryption of control communication, and audit logs of all activity are table stakes for a modern secure system. While this was not how infrastructure was designed in the past, the new normal has changed the requirements for a modern data center infrastructure. These are the requirements upon which ACI was created, one in which we have accepted the stimulus of constant security threats, and responded in kind with a development in strength.
A future blog will expand upon the other key areas, visibility, and segmentation.
Strongedge.io 