Recently I did very quick (time constrained) conceptual/logical design exercise for one customer who had virtualization first strategy and was willing to virtualize his Tier 1 business critical applications. One his requirement was to preclude data visibility for VMware vSphere admins.
I was quickly thinking how to fulfill this particular requirement and my first general answer was ENCRYPTION. The customer asked me to tell him more about encryption possibilities and I listed him following options.
Option 1/ Encryption in the Guest OS
Product examples Microsoft BitLocker, HyTrust, SafeNet, etc.
Very nice comparison of disk encryption softwares is here.
Option 2/ Application level encryption
Product examples Database Encryption in SQL Server 2008 and higher, Oracle Database Transparent Encryption, etc.
Option 3/ Encryption in the Fibre Channel SAN
Example is Brocade SAN Encryption Solution or Cisco MDS 9000 Family Storage Media Encryption.
Option 4/ Encryption in the Disk Array
Data encryption behind storage controllers. Usually leveraging Self Encrypted Disks (aka SED).
Next logical question was ... what is the performance impact?.
My quick answer was that there is definitely performance overhead in software encryption but no performance overhead with hardware encryption as it is offloaded into the special ASICs.
Hmm... Right, the most appropriate answer would be that hardware solutions are designed to have none or negligible performance impact. I always recommend to do testing before any real use in production but that's what hardware vendors claim at least in their white papers. Specifically in option (3) storage IO has to be redirected to the encryption module/appliance in the SAN which should be order of magnitude less that typical IO response time therefore impact on storage latency should be theoretically none or negligible.
However the problem with my recommended options is not performance claim.
The problem is that only option 1 and 2 are applicable to fulfill customer's requirement because option 3 and 4 do encryption and decryption on lower levels and data are decrypted and visible on vSphere layer. Therefore vSphere admin would have visibility into data.
Options 1 and 2 has definitely some performance overhead nowadays generally somewhere between 20%-100% depending on software solution, CPU family, encryption algorithm strength, encryption key length, etc.
For completeness let's say that options 3 and 4 are good for different use cases.
It is worth to say that security is always trade-off.
Software based solutions has some negative impact on performance, medium negative impact on price and also negative impact on manageability. Performance of software based solutions can be significantly improved by leveraging AES hardware offload to modern Intel Processors and performance overhead will be mitigated year by year.
Pure hardware based solutions are not applicable options for our specific requirement but even it would be applicable and they will have none or negligible impact on performance there are drawbacks like huge impact on cost and also some impact on scalability and manageability.
Conclusion
I was very quick during my consulting and I didn't realize what options really fulfill specific customer's requirement. I'm often saying that I don't trust anybody nor my self. This was exactly the case - unfortunately :-(
Time constrained consulting usually doesn't offer the best results. Good architecture need some time for review and better options comparison :-)
I was quickly thinking how to fulfill this particular requirement and my first general answer was ENCRYPTION. The customer asked me to tell him more about encryption possibilities and I listed him following options.
Option 1/ Encryption in the Guest OS
Product examples Microsoft BitLocker, HyTrust, SafeNet, etc.
Very nice comparison of disk encryption softwares is here.
Option 2/ Application level encryption
Product examples Database Encryption in SQL Server 2008 and higher, Oracle Database Transparent Encryption, etc.
Option 3/ Encryption in the Fibre Channel SAN
Example is Brocade SAN Encryption Solution or Cisco MDS 9000 Family Storage Media Encryption.
Option 4/ Encryption in the Disk Array
Data encryption behind storage controllers. Usually leveraging Self Encrypted Disks (aka SED).
Next logical question was ... what is the performance impact?.
My quick answer was that there is definitely performance overhead in software encryption but no performance overhead with hardware encryption as it is offloaded into the special ASICs.
Hmm... Right, the most appropriate answer would be that hardware solutions are designed to have none or negligible performance impact. I always recommend to do testing before any real use in production but that's what hardware vendors claim at least in their white papers. Specifically in option (3) storage IO has to be redirected to the encryption module/appliance in the SAN which should be order of magnitude less that typical IO response time therefore impact on storage latency should be theoretically none or negligible.
However the problem with my recommended options is not performance claim.
The problem is that only option 1 and 2 are applicable to fulfill customer's requirement because option 3 and 4 do encryption and decryption on lower levels and data are decrypted and visible on vSphere layer. Therefore vSphere admin would have visibility into data.
Options 1 and 2 has definitely some performance overhead nowadays generally somewhere between 20%-100% depending on software solution, CPU family, encryption algorithm strength, encryption key length, etc.
For completeness let's say that options 3 and 4 are good for different use cases.
- Option 3 can help you to secure data from storage admin not having access to SAN network or from someone having physical access to disks.
- Option 4 can help you to secure data on disks against theft of physical storage or disks.
It is worth to say that security is always trade-off.
Software based solutions has some negative impact on performance, medium negative impact on price and also negative impact on manageability. Performance of software based solutions can be significantly improved by leveraging AES hardware offload to modern Intel Processors and performance overhead will be mitigated year by year.
Pure hardware based solutions are not applicable options for our specific requirement but even it would be applicable and they will have none or negligible impact on performance there are drawbacks like huge impact on cost and also some impact on scalability and manageability.
Conclusion
I was very quick during my consulting and I didn't realize what options really fulfill specific customer's requirement. I'm often saying that I don't trust anybody nor my self. This was exactly the case - unfortunately :-(
Time constrained consulting usually doesn't offer the best results. Good architecture need some time for review and better options comparison :-)
No comments:
Post a Comment