Chapter 4. Overview of VMware vCloud Networking and Security Data Security
VMware vCloud Networking and Security Data Security provides visibility into sensitive data stored within your organization's virtualized environments.
You can ensure that sensitive data in your vCloud environment is adequately protected and assess compliance with regulations around the world, and you can do it by using reports from data scans performed by vCloud Networking and Security Data Security.
In this chapter, we will discuss the following:
The use cases of vCloud Networking and Security Data Security
Installing vCloud Networking and Security Data Security on a VMware ESXi host
Creating a Data Security policy by selecting regulations or content blades, specifying the inventory to be scanned, and configuring the file filter
Performing a data scan
Reviewing the violation reports that are generated by a vCloud Networking and Security Data Security scan
VMware vCloud Networking and Security Data Security enables you to...
vCloud Networking and Security Data Security architecture
The vCloud Networking and Security Data Security architecture has been defined in the following figure, where you will find similarities with the architecture of other solutions that work with vShield Endpoint, which we described in the previous chapter.
You cannot deploy vCloud Networking and Security Data Security unless you install vShield Endpoint for each ESXi host on your vSphere Datacenter. Once you install vShield Endpoint, you can use VMware vCloud Networking and Security Manager to deploy a vCloud Networking and Security Data Security virtual appliance on each ESXi host. The virtual appliance is based on the EPSEC framework, so it includes an agent that works with the vShield Endpoint service to scan virtual machines by communicating with them through the vShield Thin Agent that is included in VMware Tools. The Thin Agent driver is the software in the guest VM that offloads security events via the hypervisor to the vShield...
vCloud Networking and Security Data Security installation
As mentioned previously, you can install vCloud Networking and Security Data Security only after installing VMware vCloud Networking and Security Endpoint. vShield Data Security requires the vShield Endpoint Thin Agent (included in the VMware Tools) and the hypervisor module (MUX module) for communication between the service virtual machine and the virtual machines that are being scanned.
So, before you start the Data Security installation, first verify that the vShield Endpoint has been installed on the host and guest virtual machines.
Let us get started with the installation process:
Log in to the vCenter Server where you have vCloud Networking and Security Manager registered.
On the Home screen, select Hosts and Clusters.
Select the ESXi host where you want to install the vCloud Networking and Security App.
On the right-hand pane, click on the vShield tab. Here you can see the relevant EPSEC-related information (currently, Endpoint is...
Defining the vCloud Networking and Security Data Security policy
In order to detect sensitive data in your vCloud environment, you need to first define a security policy. There are three things to be specified when you create a Data Security policy:
Regulations and standards: A regulation is a data-privacy law. It is used for protecting PCI, PHI, and PII information. Your company may need different regulations for data compliance. vCloud Networking and Security Data Security gives an option to select the regulations that your company needs to comply with. When you run a scan, vCloud Networking and Security Data Security identifies sensitive data in your organization that violates the regulations in your policy. As discussed earlier, all available regulations are incorporated in the vCloud Networking and Security Data Security library.
Participating zone: By default, your entire vSphere infrastructure is scanned by vCloud Networking and Security Data Security. If you want to scan a subset...
Scanning statistics and reports
There are a number of items displayed in the Reports tab that include the following:
Current scan status: This mentions the status of the current scan.
Scan statistics: This is a pie chart that displays the number of virtual machines that have been scanned, are being scanned, and are waiting to be scanned.
Violation information: This displays information about the top regulations that have been violated and the virtual machines on which the most violations have been reported.
Scan history: This mentions the start and end time of each scan, the number of virtual machines scanned, and the number of violations detected. You can click on Download Complete Report in the Action column to download the complete report for any scan.
After a Data Security scan completes, vCloud Networking and Security displays two reports:
vCloud Networking and Security Data Security analyzes the data on the virtual machines in your vSphere inventory, which is the base of your vCloud environment, and reports the number of violations detected and the files that violated your data security policy.
You can install vCloud Networking and Security Data Security only after installing vShield Endpoint.
A data security policy determines the inventory to scan and which regulations are applied to the data. You can use the violation reports to determine where data resides so that you can verify whether it is adequately protected.
