Solve the paradox Less Downtime – More Security LinuxCon Berlin, Germany October 4, 12:10 – 13:00 Hannes Kühnemund SUSE Product Management
Downtime Considerations for your digital architecture Take a holistic approach … - End-users (Business) are interested service availability - Application, OS, Cluster, VM, Server, Network, Storage, People, Processes... ... because we understand that components will fail, ... - Failure tolerant architecture, identify weak links ... acceptance of any downtime is decreasing and it is critical to ... - Seek to reduce both planned and unplanned service downtime ... strike a balance. - Cost of IT continuity vs. business impact 2
Downtime Quiz planned Regular cadence - monthly - quarterly - yearly On the weekend In alignment with all stakeholders Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 3
Downtime Quiz planned unplanned Regular cadence - monthly - quarterly - yearly On the weekend In alignment with all stakeholders Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 4
Downtime Quiz planned unplanned Regular cadence No cadence - monthly - quarterly - yearly On the weekend In alignment with all stakeholders Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 5
Downtime Quiz planned unplanned Regular cadence No cadence - monthly - quarterly - yearly Usually on Christmas Day On the weekend In alignment with all stakeholders Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 6
Downtime Quiz planned unplanned Regular cadence No cadence - monthly - quarterly - yearly Usually on Christmas Day On the weekend No alignment with stakeholders In alignment with all stakeholders Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 7
Downtime Quiz planned unplanned Regular cadence No cadence - monthly - quarterly - yearly Usually on Christmas Day On the weekend No alignment with stakeholders In alignment with all stakeholders Only one particular problem fixed Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with - SUSE Manager 8
Downtime Quiz planned unplanned Regular cadence No cadence - monthly - quarterly - yearly Usually on Christmas Day On the weekend No alignment with stakeholders In alignment with all stakeholders Only one particular problem fixed Combination of Taks - software updates / configuration - hardware exchange of defect parts - datacenter maintenance / AC Optimizable with Optimizable with - Various technologies available - SUSE Manager 9
Minimize Unplanned Downtime RAS System UPS Rollback High Availability Virtualization and GEO RAID Load Balancer Live Patching 10
Strike the balance? 11
Strike the balance? Security No Downtime 12
Since 2005, more than 75 data breaches in which 1,000,000 or more records were compromised have been publicly disclosed. But what about the non-disclosed ones? 13
Vulnerabilities Year # vulnerabilities 10000 2010 4258 8000 2011 3532 6000 2012 4347 4000 2013 4794 2014 7038 2000 2010 2011 2012 2013 2014 2015 2015 8822 Rank Operating System # vulnerabilities 2015 Vulnerability type 2015 1 Apple OS X 384 Operating 28% 2 Microsoft Windows Server 2012 155 System 38% Browsers 3 Canonical Ubuntu Linux 152 Mobile Devices 4 Microsoft Windows 8.1 151 ... Applications 18% 16% 11 The Linux Kernel 77 Source: [http://www.cvedetails.com] & [https://nvd.nist.gov/] & [http://www.gfi.com/blog/2015s-mvps-the-most-vulnerable-players/] 14
In a data center, not so long ago … 15
In a data center, not so long ago … Linux Kernel Nov-11, 2015 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 16
In a data center, not so long ago … Linux Kernel Nov-11, 2015 CVE-2015-6937 CVE-2015-7872 CVE-2015-7990 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 17
In a data center, not so long ago … Linux Kernel CVE: Common Vulnerabilities and Exposures Nov-11, 2015 It is a standard naming scheme used by the NVD CVE-2015-6937 CVE-2015-7872 CVE-2015-7990 NVD: National Vulnerability Database (https://nvd.nist.gov/) July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 18
In a data center, not so long ago … Linux Kernel Nov-11, 2015 CVE-2015-6937 CVE-2015-7872 CVE-2015-7990 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 19
In a data center, not so long ago … Linux Kernel Reboot Nov-11, 2015 CVE-2015-6937 Linux Kernel CVE-2015-7872 Dec-11, 2015 CVE-2015-7990 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 20
In a data center, not so long ago … Linux Kernel Nov-11, 2015 CVE-2015-6937 Linux Kernel CVE-2015-7872 Dec-11, 2015 CVE-2015-7990 CVE-2016-0728 CVE-2016-0728 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 21
In a data center, not so long ago … Linux Kernel Nov-11, 2015 CVE-2015-6937 Linux Kernel CVE-2015-7872 Reboot Dec-11, 2015 CVE-2015-7990 CVE-2016-0728 CVE-2016-0728 Linux Kernel Jan-15, 2016 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 22
In a data center, not so long ago … Linux Kernel Nov-11, 2015 CVE-2013-7446 Linux Kernel CVE-2015-6937 Dec-11, 2015 CVE-2015-7872 CVE-2015-7990 CVE-2013-7446 CVE-2015-8019 Linux Kernel CVE-2015-8019 CVE-2015-8539 Jan-15, 2016 CVE-2015-8539 CVE-2015-8660 CVE-2015-8660 CVE-2016-0728 CVE-2013-7446 CVE-2016-0728 CVE-2015-8019 CVE-2015-8539 CVE-2015-8660 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 23
In a data center, not so long ago … Linux Kernel Nov-11, 2015 CVE-2013-7446 Linux Kernel CVE-2015-6937 Dec-11, 2015 CVE-2015-7872 CVE-2015-7990 CVE-2013-7446 CVE-2015-8019 Linux Kernel CVE-2015-8019 Reboot CVE-2015-8539 Jan-15, 2016 CVE-2015-8539 CVE-2015-8660 CVE-2015-8660 CVE-2016-0728 CVE-2013-7446 CVE-2016-0728 Linux Kernel CVE-2015-8019 Feb-10, 2016 CVE-2015-8539 CVE-2015-8660 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 24
In a data center, not so long ago … Linux Kernel Nov-11, 2015 CVE-2013-7446 Linux Kernel CVE-2015-6937 Dec-11, 2015 CVE-2015-7872 CVE-2015-7990 CVE-2013-7446 CVE-2015-8019 Linux Kernel CVE-2015-8019 CVE-2015-8539 Jan-15, 2016 CVE-2015-8539 CVE-2015-8660 CVE-2015-8660 CVE-2015-8709 CVE-2013-7446 CVE-2015-8709 Linux Kernel CVE-2015-8812 CVE-2015-8019 CVE-2015-8812 CVE-2015-8816 Feb-10, 2016 CVE-2015-8539 CVE-2015-8816 CVE-2016-0728 CVE-2015-8660 CVE-2016-0728 CVE-2015-8709 CVE-2016-0774 CVE-2015-8709 CVE-2016-0774 CVE-2015-8812 CVE-2016-2384 CVE-2015-8812 CVE-2016-2384 CVE-2015-8816 CVE-2015-8816 CVE-2016-0774 CVE-2016-0774 CVE-2016-2384 CVE-2016-2384 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 25
In a data center, not so long ago … Linux Kernel Nov-11, 2015 CVE-2013-7446 Linux Kernel CVE-2015-6937 Dec-11, 2015 CVE-2015-7872 CVE-2015-7990 CVE-2013-7446 CVE-2015-8019 Linux Kernel CVE-2015-8019 CVE-2015-8539 Jan-15, 2016 CVE-2015-8539 CVE-2015-8660 CVE-2015-8660 CVE-2015-8709 CVE-2013-7446 CVE-2015-8709 Linux Kernel CVE-2015-8812 CVE-2015-8019 Reboot CVE-2015-8812 CVE-2015-8816 Feb-10, 2016 CVE-2015-8539 CVE-2015-8816 CVE-2016-0728 CVE-2015-8660 CVE-2016-0728 CVE-2015-8709 CVE-2016-0774 Linux Kernel CVE-2015-8709 CVE-2016-0774 CVE-2015-8812 CVE-2016-2384 CVE-2015-8812 Mar-22, 2016 CVE-2016-2384 CVE-2015-8816 CVE-2015-8816 CVE-2016-0774 CVE-2016-0774 CVE-2016-2384 CVE-2016-2384 July December January February March April May June August September 2016 2015 2016 2016 2016 2016 2016 2016 2016 2016 26
Recommend
More recommend
