Threats against an agency's IT are often aimed at the most valuable asset: the data center. But when security is considered at the very beginning of data center planning, agencies can increase protection and reduce operational costs. A well thought-out defense-in-depth strategy includes multiple layers of security and different overlapping technologies.

A combination of increasing risks from network security attacks and the need for data center consolidation is causing data center managers to adopt an integrated approach to the data center network infrastructure. Integrated security technologies, including secure connectivity, threat defense, and trust and identity management systems, create a self-defending network, and are based on the principle of ensuring that each application and server environment can realize a secure virtual zone across the consolidated IP, storage, and interconnect data center networking infrastructure.

The following discussion examines how two technology leaders, Sun Microsystems and Cisco Systems, are addressing today's data center security needs.

Change and Protection

Today's government data center needs to be able to respond to change as the nation enters a new administration with new programs and priorities. IT is woven into Federal agency COOP plans and as such the data center is the information trust of every agency.

Datacenter architectures must guard information privacy, confidentiality, and data integrity by protecting against unauthorized access to, or tampering with, an organization's data. Such datacenter security can be taken into account from two angles: Infrastructure Stack and OS Stack.

Integrating the infrastructure stack into datacenter design requires addressing issues including physical access, network infrastructure, identity management, business continuity, and encryption:

• Physical security
  Physical access to the systems in the datacenter must be controlled. Untrained or malicious personnel can power off, corrupt, or even remove systems or disk drives if they are given access. Sun's ipConfigure Enterprise Surveillance Manager (ESM) provides enterprise-class video surveillance management to support an unlimited number of cameras, locations, and users on a scalable distributed infrastructure with HTML access. Meanwhile, the Sun Fire X4500 server provides massive storage density and high throughput, allowing longer retention of both medium and high resolution surveillance video - and support for more cameras per server. Cisco Video Surveillance IP Cameras are currently offered as an integral part of the Cisco Video Surveillance Manager solution that can be deployed in the data center.

• Identity Management
  Knowing the identity of all system users, from employees to customers, is mandatory. A single user may exist in multiple domains, such as development, testing, and production, and have different levels of access in each domain. Trying to maintain consistent instances of usernames and passwords manually across domains is difficult. A unified identity management schema ensures that an individual retains the same identity across domains. SUN Microsystem provides Identity Manager 8.0, role-based user provisioning software that features new data export and validation mechanisms to certify access rights and deal with exceptions. Identity Manager not only automates the process of assigning user access to various systems, but also executes a follow-up process for continuously checking what a user actually has access to. It also includes role certification by role owners, approval workflow, and role consolidation.

• Network
  Secure datacenter architecture uses a network design that isolates services to manage security and scalability requirements. Only public, externally accessible interfaces are on routable networks. All other networks are configured as private and are non-routable outside the datacenter. Cisco's network protection solutions mitigate network and host attacks caused by viruses, worms, DDoS attacks, and other malicious network traffic.

• Service Continuity
  System availability, disaster recovery, and business continuity may be mandated by government regulations, and must be addressed as part of an organization's security policy. Sun Cluster software, a key component of SunPlex environment, is designed to deliver high-availability application services to the data center in the event of a disaster. Sun Cluster software extends the Solaris Operating Environment, enabling the use of core Solaris services, such as devices, file systems, and networks, in a virtually seamless manner across a tightly coupled cluster, while maintaining full Solaris Operating Environment compatibility for existing applications.

• Encryption
  Encryption is a mechanism that helps keep confidential data secure, as well as helping to protect against man-in-the-middle attacks. Data may be encrypted by servers, disks, and network devices. The Solaris Cryptographic Framework performs cryptographic functions in the OS itself, making the use of optional encryption-acceleration hardware completely transparent to applications.

Security throughout the entire operating system stack requires addressing issues including Minimization, Solaris Security Toolkit, Audit, Role-Based Access Control, and Trusted Extensions

• Minimization
  Standardized Solaris OS implementations start with a secure-by-default configuration that protects the OS beginning with the first boot. The OS configurations must meet functional requirements as well, and some agencies may require additional OS services to be enabled.

• Solaris Security Toolkit
  The Solaris Security Toolkit helps to automatically harden Solaris OS installations according to business requirements and make them easy to reproduce. In conjunction with the Service Management Facility (SMF), a minimized set of services can be enabled, which prevents enabling unnecessary services during installation.

• Audit
  The Solaris OS provides an extensive suite of tools to audit system functions. By default, these are not enabled, but may be configured as part of a security policy that requires the ability to audit enabled OS services. The Solaris OS includes the Basic Auditing and Reporting Toolkit (BART).

• Role-Based Access Control
  Role-Based Access Control (RBAC) creates specific roles that can be assumed by users to perform tasks. It allows administrators to define roles, the tasks they can perform, and the users that can assume each role. This improves upon the previous all-or-nothing model of root access. In addition, log entries are created when users assume roles, making auditing simpler and more secure.

• Trusted Extensions
  With the introduction of the Solaris 10 OS, features that were formerly part of the Trusted Solaris OS can now be added to any Solaris OS installation. The set of Trusted Extensions (TX) helps to establish multiple levels of security. The flexibility of the Trusted Extensions allows for more than Unclassified, Secret, and Top Secret levels. Agencies can create their own levels such as Public, Internal Only, and Finance to segregate information according to users, their roles, and sensitivity.

• Predictive Self-Healing
  The Solaris 10 OS includes software to monitor the health of system components. The software can detect impending failures and direct an administrator to take certain actions to prevent or reduce unplanned system outages.

Components for Secure Data Centers

Ideally, enterprise data center architecture should achieve optimal end-to-end security, performance, and manageability by integrating security directly into the network infrastructure, using the advanced integrated security capabilities of switching and intelligent storage networking platforms. Cisco provides solutions that enable agencies to secure datacenters from an infrastructure standpoint and create self-defending networks. The various components include:

• Integrated Network Security
  Cisco's network protection solutions mitigate network and host attacks caused by viruses, worms, DDoS attacks, and other malicious network traffic. Deploying these solutions throughout the data center isolates and blocks intruders, rogue applications, and other unwanted traffic.

• Data Center Confidentiality
  Due to governance, risk, and compliance requirements, datacenters must deploy technologies to prevent eavesdropping and the theft of sensitive information. Cisco TrustSec is an authentication and encryption solution that helps ensure that network access for data centers is allowed only for trusted network devices and trusted users.

• Storage Media Encryption
  The Cisco Storage Media Encryption (SME) solution protects data at rest on heterogeneous tape drives and virtual tape libraries in a SAN environment using secure AES algorithms. Cisco SME hardware and software are fully integrated with the Cisco MDS 9000 family.

• Security Agent & Data Loss Prevention
  Cisco Security Agent provides content scanning on the host, which complements the Cisco IronPort appliance's content scanning and protection at the network perimeter.

• Web Application Firewall
  The Cisco ACE Web Application Firewall combines full-proxy application firewall, deep web application and HTML analysis, and high-performance XML inspection and management to truly address the full range of threats associated with new web application services.

• VFrame Data Center
  Cisco VFrame Data Center (VFrame DC) is an orchestration platform that leverages network intelligence to provision resources together as virtualized services. With VFrame DC, customers can link their compute, networking, and storage infrastructures together as a set of virtualized services.

• Cisco MARS
  Cisco MARS can rapidly identify the presence of and path of the attack, and make a recommendation on the best place to stop.

By fully integrating each security component, data centers can mount the strongest defense, to ensure that mission-critical technology remains sound and accessible.