Cloud foundry: Keeping traffic isolated
Wed 9 Apr 2014
At the heart of software as a service is a multi-tenanted environment but can we be sure those virtual LANs are isolated. One way, according to Chris Swan, the CTO of CohesiveFT, is to use software defined networking because it can replace the priesthood of network operations with a robot and an audit trail.
I was having a chat the other day with a Cloud Foundry expert about using software defined networking (SDN) to provide better isolation between tenants in a multi-tenant environment. We concluded that OpenFlow, or VXLAN, or NVGRE would all be able to provide isolation of traffic, but that the real problem would be showing the customer in a meaningful way that their traffic wasn’t (and could not be) intermingled with the traffic of others.
It’s worth going back to how things mostly are today on enterprise networks. When I carve a network up into virtual LANs to provide isolation then I’m trusting in two things:
1) That the network equipment vendor is competent, and has made a switch that will keep packets on one VLAN away from packets on another. There are lots of eyes on this, so it’s a pretty easy decision – if somebody made leaky switches then they’d be called out for it in short order.
2) That the network operations team is competent, and has configured a switch so that it will keep packets on one VLAN away from packets on another. There might be a few eyes on this in terms of audits and spot checks, but mostly the priesthood of network operations is trusted to go about its business in a professional manner. It’s pretty much the same deal for storage when it comes to configuring SANs and NASes (Storage Area Networks & Network Attached Storage).
Software defined things eliminate the priesthoods, and all of their incumbent processes like change requests that glob together into agility choking behemoths such as ITIL. The trusted people have been eliminated and replaced by what – a robot and an audit trail?
The network operations team might well have been providing security theatre rather than any measurable security; but its absence is unnerving. In the world of software defined everything we need something to make up for that absence – trustworthy tools that provide transparency and confidence. The robots are ready to do our bidding, but we’re not quite ready to trust them… yet.
