This IBM Redbooks Solution Guide is an initial guide that introduces cloud security considerations for IBM® Power Systems™. Power Systems are uniquely suited for cloud environments, with their industry leading virtualization, enterprise-class security, elastic scalability, and reliability, availability, and serviceability (RAS). Power Systems provide the necessary memory bandwidth and compute power to deliver performance that big data, analytics, and other compute-intensive cloud services require. The first objectives of this guide are to examine how Power Systems can fit into the current and developing cloud computing landscape, and to outline the proven IBM Cloud Computing Reference Architecture (CCRA) that IBM employs in building private and hybrid cloud environments.

We then take a look at the underlying technology, and hone in on some of the security aspects for the different sub-systems:

- IBM Hardware Management Console

- IBM PowerVM®

- IBM PowerKVM

- IBM PowerVC

- IBM Cloud Manager with OpenStack

If you want to find out more about this topic, we encourage you to also download the accompanying IBM Redbooks publication.

IBM® Power Systems™ are uniquely suited for cloud environments, with their industry leading virtualization, enterprise-class security, elastic scalability, and reliability, availability, and serviceability (RAS). As with most new technology paradigms, security concerns surrounding cloud computing have become the most widely talked-about inhibitor of widespread usage, whether for public, private, or hybrid cloud installations.

In this IBM Redbooks® Solution Guide, we describe some of the processes and tools that should be implemented by system architects or administrators to ensure that your Power System-based private cloud environment is secure. Figure 1 shows an example Power Systems cloud structure.


Figure 1. Power Systems cloud management hierarchy


Did you know?

IBM Power Systems provide a choice of hypervisor, using either IBM PowerVM® or the open source IBM PowerKVM.

PowerVM efficiently uses system resources and imposes a negligible impact on performance, because PowerVM is designed for and built directly into the firmware of all Power Systems. Being part of the firmware also means that PowerVM is secure by design.

IBM PowerKVM presents a choice for organizations looking for a low cost, open source virtualization solution for Linux on Power Systems built on the IBM POWER8™ architecture. IBM PowerKVM provides support for Red Hat Enterprise Linux (RHEL), SUSE Linux Enterprise Server (SLES), and Ubuntu guests.

Business value

Interest in cloud computing is strong among today’s Chief Information Officers (CIOs) and business leaders. In one recent IBM study (Source: Under Cloud Cover, IBM Center for Applied Insights, 2013), it was found that the cloud's strategic importance to decision-makers, such as Chief Executive Officers (CEOs), Chief Marketing Officers (CMOs), finance, Human Resources (HR), and procurement executives, is poised to double from 34% - 72%. The survey found that one out of five organizations is ahead of the curve on cloud adoption and achieving competitive advantage, not just cutting costs and driving efficiency, through cloud computing.

Pacesetters in cloud adoption have reported impressive competitive advantages from cloud computing, but the journey has not been easy. Forty-four percent of respondents believe that cloud introduces greater complexity into their organization. To manage this growing complexity, early adopters are more likely to share the following characteristics:

• Have an enterprise-wide cloud strategy
• Favor open source cloud platforms
• Use a hybrid cloud
• Have executive support for cloud experimentation

• Use cloud infrastructure with confidence that they are secure, compliant, and meet regulatory requirements.
• Leverage existing investment, and extend current infrastructure to implement security for virtual infrastructure.
• Decrease delivery and provisioning time for secure new services through standardization and automation.
• Maintain service-level compliance, accuracy, repeatability, and traceability for the cloud environment.
• Align Information Technology (IT) resource allocation with business goals.

• Cloud-enabled data center, also called Infrastructure as a Service (IaaS)
• Platform Services, also called Platform as a Service (PaaS)
• Software Services, also called Software as a Service (SaaS)
• Cloud service provider (CSP)

• Cloud governance
• Security governance, risk management, and compliance
• Problem and information security incident management
• Identity and access management
• Discover, categorize, and protect data and information assets
• Information systems acquisition, development, and maintenance
• Secure infrastructure against threats and vulnerabilities
• Physical and personnel security

• Manage identities and access:
• Manage data center identities and securely connect users to the cloud (authentication and authorization)
• Provide role-based access to cloud resources, image library, and storage
• Provision user IDs on the virtual machine (VM) for access to the VM or LPAR
• Manage confidentiality and integrity of the storage, images, and metadata associated with the master image
• Privileged administrator management
• Protect virtual infrastructure:
• Secure and protect the virtual infrastructure (VM instances, LPARs, and hypervisors) according to IT Security Policy
• Storage encryption
• Network protection through firewalls and intrusion prevention systems (IPS)
• Host security and vulnerability scanning
• Patch default images:
• Image library and software catalog
• Provide visibility into virtual infrastructure:
• Maintaining audit logs for virtual infrastructure compliance and audit readiness
• Monitoring cloud infrastructure
• Monitor and manage workloads
• Network isolation:
• Implement virtual local area networks (VLANs), physical network separation, firewall devices, and intrusion detection systems as appropriate

• National Institute of Standards and Technology (NIST) and the Special Publication 800 series: http://csrc.nist.gov/
• Federal Information Security Management Act (FISMA): http://csrc.nist.gov/sec-cert/
• Federal Risk and Authorization Management Program (FedRAMP): http://cloud.cio.gov/fedramp
• Federal Information Processing Standards (FIPS): http://csrc.nist.gov/publications/PubsFIPS.html
• Common Criteria: http://www.commoncriteriaportal.org/
• Payment Card Industry Data Security Standard (PCI-DSS): https://www.pcisecuritystandards.org/
• Health Insurance Portability and Accountability Act of 1996 (HIPAA): http://www.hhs.gov/ocr/privacy/
• Control Objectives for Information and Related Technology (COBIT): http://www.isaca.org/cobit/
• International Organization for Standardization / International Electrotechnical Commission (ISO/IEC 27001:2005): http://www.27000.org/
• Statement on Standards for Attestation Engagements (SSAE16): http://ssae16.com/
• Homeland Security Presidential Directive 12: https://hspd12.usda.gov
• Financial Services Roundtable / BITS: http://www.bits.org/
• Sarbanes-Oxley (SOX): http://www.soxlaw.com/
• Generally Accepted Privacy Principles (GAPP): http://www.aicpa.org/

• Hypervisors
• Platform management
• Advanced virtualization management
• Cloud management and advanced cloud management
• Guest operating systems (LPARs or VMs)

• Create VMs and resize their processor and memory.
• Attach disk volumes to them.
• Import existing VMs and volumes so that they can be managed by IBM PowerVC.
• Monitor the use of the resources that are in your environment.
• Migrate VMs while they are running (live migration between physical servers).
• Deploy images quickly to create new VMs that meet the demands of dynamic business needs. At the time of writing this publication, IBM PowerVC can deploy VMs using AIX or Linux operating systems.

• IBM Cloud Manager with OpenStack and IBM PowerVC support Lightweight Directory Access Protocol (LDAP) as a user authentication directory. IBM Cloud Manager with OpenStack supports OpenLDAP and IBM Directory Server. IBM PowerVC supports OpenLDAP and Microsoft Active Directory. Connections from the management layer server to the directory server should be encrypted with Transport Layer Security (TLS).
• IBM PowerKVM and PowerVM (VIOS) both support LDAP at the operating system level. However, using LDAP authentication for the hypervisor is not critical, because users access hypervisor resources through other management layers (for example, IBM PowerVC or IBM Cloud Manager with OpenStack).
• Role-based access should be configured for IBM PowerVC and IBM Cloud Manager with OpenStack. Admin, deployer, and viewer are the three default LDAP roles or user groups used in IBM PowerVC. Keystone is the OpenStack component that handles users' identities. IBM Cloud Manager with OpenStack also supports user roles and group membership through the OpenStack user and tenant model provided by the Keystone component.
• Management layers that have a web interface (for example, HMC, IVM, Kimchi, IBM PowerVC, and IBM Cloud Manager with OpenStack) should have Hypertext Transfer Protocol Secure (HTTPS) enabled for user access. Where it is possible to choose which cipher suite is used in Secure Sockets Layer (SSL) handshake negotiation, the strongest suite supported by the user's browsers should be selected. For example, TLS 1.2 might be mandated by some security standards, but might not be supported by all browsers. The authentication process in particular must be encrypted from end-to-end (from user browser to LDAP server).
• Federated identity management is not essential with an on-premises private cloud, but the growing popularity of hybrid clouds requires consideration to be given to federated identity technologies, such as OpenID, OAuth, and Security Assertion Markup Language (SAML).
• Manage privileged administrative user access through processes or tools. Access to privileged user accounts, such as root or padmin, should be managed securely to prevent accountability and compliance issues, and to decrease the risk of sabotage and data loss.

• Encryption of data at rest can be a requirement of some security standards (for example, PCI-DSS or HIPAA). The hypervisor may support encrypted data at the storage area network (SAN) level by use of a disk array with hardware encryption (for example, IBM DS8000®), or an encrypting SAN switch (for example, SAN32B-E4). An alternative solution is to use an encrypted file system on the guest operating system. Encrypted File System (EFS) and IBM General Parallel File System (IBM GPFS™) on AIX, and dm-crypt, Linux Unified Key Setup (LUKS), or Enterprise Cryptographic File System (eCryptFS) on Linux, are examples.
• Encryption of data backups is also a factor to be considered. Tape drives with encryption hardware do not impose any performance degradation. Key management also becomes a priority when managing encryption keys across several separate platforms.
• Packet filtering at the VM host level should also be implemented. On AIX, Transmission Control Protocol/Internet Protocol (TCP/IP) filters are included in the IP Security (IPSec) packages (bos.net.ipsec.keymgt and bos.net.ipsec.rte). The default packet filter for recent Linux distributions is iptables. Some time must be invested to survey what TCP/IP ports must be allowed through the packet filter, based on administration, management, and application requirements. Access should be restricted to the appropriate IP addresses or subnets wherever possible.
• Hosts should also be subject to some degree of "hardening" by removing unnecessary software packages (for example, consider whether an HTTP server package is required on a compute node). This is best done at the image library level, but there are both benefits and pitfalls with multi-purpose images. A better approach is to start with a hardened base image, and require the user to choose packages or functionality from a software catalog at deployment time.
• Standard system administrator best practices should be followed. A non-exhaustive list includes the following actions:
• Enforcing password policy (complexity, aging, and re-use)
• Changing default system and application passwords
• Backing up critical data
• Using Network Time Protocol (NTP) to synchronize time across all systems
• Routine vulnerability scanning is also suggested. Scanning can be done on the local host with health check tools, or done remotely over the network, or preferably a combination of both.

• Cloud administrators must be diligent in ensuring that their image library is kept current with regards to security patches. More sophisticated cloud managers have more advanced tools for maintaining image libraries.
• Compliance tools, such as endpoint managers or management frameworks, can be beneficial in keeping VMs, hypervisors, and management servers up to date with security patches.

• All layers of the Power Systems stack support syslog for logging system events. All management nodes and virtual machines should be configured to forward syslog messages to an event management system at the least. The use of a security information and event management (SIEM) solution is highly suggested, particularly one with advanced threat protection (ATP).
• In addition to syslog, SIEM systems might have event or audit agents that are required to be installed on the end-points (management servers or VMs).
• Time must be invested to produce a baseline of events processed by the event manager with minimal false positives. Procedures must be in place for first responders to act on escalated events in a timely manner.

• Management interfaces, such as HMC, IVM, and hypervisors, need to be kept isolated from networks used for VMs, and from other networks.
• In addition, networks used for functions, such as live migration and backups, should not be accessible by the user.
• Use the appropriate combination of VLANs, physical network separation, and firewalls as deemed appropriate. Again, the use of next-generation firewalls with integrated IPS and advanced threat protection (ATP) is highly suggested.
• With increasing uptake of hybrid clouds, virtual private networks (VPNs) also become a requirement. Two-factor authentication is usually a requirement for VPN access.

1. The user logs in to a self-service graphical user interface (GUI) using a web browser. Security considerations include the following factors:
• The HTTPS connection should be encrypted with appropriate key lengths and ciphers.
• An LDAP user directory should be used.
• LDAP authentication should be encrypted end-to-end.
• The identity lifecycle should be managed in an enterprise-wide manner.
2. When authenticated, the user should be granted access to appropriate resources based on the user's functional role. Additional fine-grained access controls can be implemented with enterprise-wide access management tools.
3. Required VM images are selected from a pre-configured image library. Stored images in the image library should have all appropriate management tools installed, and required security policies (end-point management agents, password policy, and so on) should be applied.
4. Images should then be provisioned onto a dedicated VM network. Segregation of different functional networks (management networks, workgroup or team networks, staging and production networks, and so on) should be enforced with the appropriate combinations of VLANs, physical network separation, firewalls, and access control lists (ACLs). The use of next-generation firewalls with IPS and ATP is highly suggested.
5. Host security of the VM should be installed or updated when deployed. This might include updating end-point manager policies, configuring logging destinations for event management, or installing specific user keys for access to the VM.
6. There might be too many combinations of application software versions to allow pre-configured images of every combination to be stored in the image library. Software would then be installed and updated from a software catalog post deployment.

• IBM Offering Information page (to search on announcement letters, sales manuals, or both):

http://www.ibm.com/common/ssi/index.wss?request_locale=en
On this page, enter <solution name; remove angle brackets>, select the information type, and then click Search. On the next page, narrow your search results by geography and language.
• IBM Redbooks publication: Cloud Security Guidelines for IBM Power Systems, SG24-8424
  http://www.redbooks.ibm.com/redpieces/abstracts/sg248242.html
• IBM Redbooks publication: IBM PowerVM Virtualization Managing and Monitoring, SG24-7590

http://www.redbooks.ibm.com/abstracts/sg247590.html
• IBM Redbooks publication: IBM PowerKVM Configuration and Use, SG24-8231

http://www.redbooks.ibm.com/abstracts/sg248231.html
• IBM Redbooks publication: IBM PowerVC Version 1.2.1 Introduction and Configuration, SG24-8199

http://www.redbooks.ibm.com/abstracts/sg248199.html
• IBM Redbooks publication: IBM Power Systems HMC Implementation and Usage Guide, SG24-7491

http://www.redbooks.ibm.com/abstracts/sg247491.html
• IBM Redbooks publication: IBM Power Systems Hardware Management Console Version 8 Release 8.1.0 Enhancements, SG24-8232

http://www.redbooks.ibm.com/abstracts/sg248232.html
• IBM Redbooks publication: IBM SmartCloud: Building a Cloud Enabled Data Center, REDP-4893

http://www.redbooks.ibm.com/abstracts/redp4893.html
• IBM PowerVM product page

http://www.ibm.com/systems/power/software/virtualization/
• IBM PowerKVM product page

http://www.ibm.com/systems/power/software/linux/powerkvm/
• IBM PowerVC product page

http://www.ibm.com/systems/power/software/virtualization-management/
• IBM Cloud Manager with OpenStack product page

http://www.ibm.com/systems/x/solutions/cloud/cloud-manager-openstack/