leveraging oracle solaris security and performance ... · pdf filesolaris11.1 solaris 11.2...
TRANSCRIPT
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
LeveragingOracleSolarisSecurityandPerformanceBenefitsinOracleCloud[GEN7018]
BillNesheimVP,OracleSolarisEngineering
October2,2017
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
SafeHarborStatementThefollowingisintendedtooutlineourgeneralproductdirection.Itisintendedforinformationpurposesonly,andmaynotbeincorporatedintoanycontract.Itisnotacommitmenttodeliveranymaterial,code,orfunctionality,andshouldnotberelieduponinmakingpurchasingdecisions.Thedevelopment,release,andtimingofanyfeaturesorfunctionalitydescribedforOracle’sproductsremainsatthesolediscretionofOracle.
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
SolarisProductDirectionContinuousDeliveryofSecurity,StabilityandSoftwareEnhancements
SeamlessUpgradesEnableAgileIncorporationofNewCapabilitieswithGuaranteedCompatibilityfor1,000’sofOracle,ISV,andCustomerApplications
SmallerMore
Frequent
LessDisruptive
Quicker
Simpler
SolarisContinuousDeliveryModel
HighRisk Complex Disruptive
LegacyMajorReleasesSlowAdoption
SlowandExpensiveRe-Qualifications
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
Yoursecurefoundationforcloud-readyenterpriseUNIX™innovationOracleSolaris11
HWbasedapplicationprotectionTimeandrolebasedaccessmanagementImmutableVMs;integratedcompliancevalidation
EngineeredforOracleDB&EnterpriseApplicationsZero-Overhead,SecureVirtualizationExtremeScalability
1-Stepnetworkbasedupdate&rollbackContinuousdeliveryBuiltinmigration,archivalandrecoverytools
OneOS,anycloud1000’sofapplicationsApplicationBinaryGuarantee
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
Ourcommitmenttoapproachableinnovation
T4 T5, M5,M6 M7 S7 M8
ASLRSvcbundlePeruserauth.
KernelZonesPTP
DAX,SSM,Compliancereporting
PF,KMIPMulti-factorauthentication
Much moretocome!
Solaris 11.1 Solaris11.2 Solaris11.3 Solaris11.4 … Solaris11.5…
Solaris112011 2012 2013 2014 2015 2016 2017 2018 2019 2020
7+yearsandcountingofseamlessinnovationdelivery#pkg update
SolarisBinaryCompatibilityprotectsyourapplicationsoftwareinvestment
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
SolarisContinuousDelivery
• Security– KMIP–Multi-factorauthentication– SSMenhancements– Packagesigningenhancements–MITKerberosV5update->14.4
• OracleDatabaseIntegration–OICforDatabase12.2– eXtended ReliableConnectedTransport
• Platform– SPARCM8,FujitsuSPARCAthena++– IntelSkylake– Broadcom25Gb,Intel10GbEEthernet– DAXAPIsforSPARCM7,M8
• Diagnose-ability&Maintain-ability– FastSRIOVI/Ofailover– SCSItracing–Watchpoints viaSSM
Newcapabilitiesdeliveredinrecent11.3SRUs
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
]
ThreePillarsofCyberSecurity
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
Solarispreventsabuseormisuseofcredentials
Multi-FactorAuthenticationStandards-basedOne-TimePasswordandSmartCardsupport
ControlledSystemAccessLeastprivilegemodelwithtime,roleandfilebasedauthorizationlimits
RemoteAuditing,LoggingandAlertingPer-objectauditing;tamper-proofremotelogging
CloudSecure
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
]
Solarishelpsyoumaintainasecureplatform
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
Source:VerizonDataBreachInvestigationsReport,2016
KnownVulnerabilitiesareRegularlyExploited
74%
OFORGANIZATIONSTAKE3MONTHS+
TOPATCH
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
SolarisDeliversSafe&SimpleSystemUpdates• SolarisImagePackagingSystem
– Repositorybaseddistributionoverthenetwork
– Automaticdependencymanagement– IntegratedupdatesofOracleSolarisZones
• BootEnvironments– BasedonZFSsnapshotsandclones– Enforcesbestpracticesforsystemupdate– Fasttocreate,zerocost– 100%reliable
• OracleCPUprovidespredictableupdateschedule
CloudSecure
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
AgeOldProblemsofBufferOverflowandMemoryCorruptionSolvedSolarisonSPARCProtectsDatainMemory
Memory
Pointer
SPARCProcessor
H/Wcomparespointer�key� withmemory
“lock”
• Prevents3oftheTop5Zero-Dayattackvectors
• Always-onprotectionfortheOracle12cSGA&PGA
• Fullycompatiblewithexisting64-bitapplications
• StudioDiscovertooldeliversmemoryboundscheckingwithoutperformancepenalty
CloudSecure
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
Cloud-ScaleComplianceReportingSimple&TailorableWaytoVerifyProtection
CloudSecure
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
]
Solarisgivesyouthetoolstofullyprotectyourdata
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
FrequencyofDataRecordTheft
EVERYDAY
3,618,139Records
EVERYHOUR
150,756Records
EVERYMINUTE
2,513Records
EVERYSECOND
42Records
InHealthcare,datatheftcostsaround$200,000everyminute
Source:breachlevelindex.com
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
EncryptEverything,Everywhere,AlltheTime
• Fastest Cryptography intheindustry• State-of-the-artalgorithmswithPKCS#11v2.40• Noperformanceloss• Automatically acceleratesJava,OracleDatabase,OpenSSL/TLS,andcustomapplications
• Meetcompliancewithhighperformancediskencryption
• Interoperatewithany KMIP-Compliant KeyManagementServerincludingOracleKeyVault
Protectedatrest,inmotion,andinmemory
Applications
Java
OracleDatabase
OperatingSystemUtilities
Storage
Virtualization
Firmware
AffordablyCloudSecure
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
ProtectDatathroughouttheVMlifecycleContinuousprotectionwithOracleSPARC&Solaris
LiveVMs inTransitareFullyEncrypted- NoServiceLoss- NoPerformanceLoss
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM
VM VM
VM
VM
VM
VM
CloudSecure
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
AdvantagesofOracleSolarisforOracleDatabase
• ResizingSGAwithnodowntime
• 22xfasterDBStartupandShutdown
HighAvailability
• Memoryusageprediction
• Dramaticallysimplifieddataadministration
Utmostflexibility
• MemoryoptimizationsforOracleDatabase
• GuaranteedQualityofService
RealTimeAnalytics
• Embeddederrordetection
• Real-timedatareplication
CompleteIntegratedSolution
CloudEfficient
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
FindI/OOutliers• AddedDTrace I/OEventTracingtoOracleDatabase12c
• V$viewsforsimplequeries• Avoidcomplexandtime-consumingreportsnapshotanddiagnosis
v$kernel_io_outlierTIMESTAMPIO_SIZEIO_OFFSETDEVICE_NAMEVARCHAR2(513)PROCESS_NAMEVARCHAR2(64)TOTAL_LATENCYSETUP_LATENCY
…
Seedemoat:https://blogs.oracle.com/solaris/entry/database_12c_and_solaris_dtrace
SimpleDatabaseI/ODiagnosisandTuning CloudEfficient
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
4 VirtualMachines4 Virtual
Machines
26%
4 VirtualMachines
MostEfficientEnterpriseVirtualization
• ZeroOverheadVirtualization– builtin!
• Applicationsrunasfastasbaremetal
• Virtualizeanyapplication,notjusttheeasyones
• Virtualizationbydefault
+ +
VirtualizationPerformanceLoss
SPARC + VM + SolarisC+VM+S
~1%4 Virtual
Machines
VMSoftware
CloudEfficient
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
YOURAPP
Simple,SecureCloudScaleDeploymentandComplianceFromDevelopmenttoProduction
Securedeployment
SetCompliancePolicy
ComplianceAudit
CreateyourapplicationVMs
1-stepsecureimagecreation
CloudAgile
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
OracleSolaris11
Built-inInvestmentProtection
V2V
P2V
OracleSolarisZonesSystemPreflight
Checker
• 20+yearsofbinarycompatibility– ApplicationsjustworkonnewerSolarisreleases
• Fast&simplemigration:– Reduceriskwithautomatedchecksbeforeyoumove
– Toolsmoveyouquicklyandsimply
–MigrateyourS10environmentsinminutes
Solaris10Zone
FUSIONAPPLICATIONS
OracleSolaris10
Solaris10Zone
DATABASE
DATABASEOracleSolaris10
SolarisZone
FUSIONAPPLICATIONS
CloudAgile
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
PrivateCloud&EnterpriseSystemsOracleCloud Cloud@Customer
OracleSystemsTechnologiesPowerAllOfOurInfrastructure
Servers– Storage– Networking– Virtualization– OperatingSystemsDevelopmentTools– ManagementTools
SameTechnology,SameArchitecture,SameSkillSets
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
Availabletoday!
SolarisinOracleCloudInfrastructureClassic
• VirtualMachineCompute(x86)
• DedicatedCompute(x86)
• DedicatedCompute(SPARC)
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
OracleLifetimeSupport
• PremierSupport– ProvidesmaintenanceforyourOraclehardwareandintegratedsoftware(forexample,firmware).MaintenanceandsoftwareupgradesareincludedforOracleoperatingsystemsandOracleVMfortenyearsfromtheirgeneralavailabilitydate- extendedto20yearsforSolaris11
• ExtendedSupportforOperatingSystems– PutsyouincontrolofyouroperatingsystemupgradestrategybyprovidingadditionalmaintenanceandupgradesforOracle
Solarisoperatingsystemforanadditionalfee
• SustainingSupportforOperatingSystems– Maximizesyourinvestmentprotectixon byfurtherextendingsupportforoperatingsystemsandfirmware.Featuresinclude
accesstoOracleonlinesupporttools,operatingsystemupgraderights,pre-existingfixes,patchesandassistancefromtechnicalsupportexperts
HardwareandOperatingSystems
Detailedinformationavailableonline:http://www.oracle.com/us/support/lifetime-support/lifetime-support-hardware-337183.html
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
ContinuouslymaintainedOpenSourceSoftware• PopularOpenSourceutilities,services,productivityanddevelopertoolsthatcomplementyourOracleSolarisdistribution– Built,maintained,signedanddeliveredbyOracle
• >15003rd partycomponentsaredeliveredwithSolaris11– 148componentsupdatedinSRUsincereleaseofSolaris11.3– 543additionalcomponentstobeupdatedinSolaris11.4
• SelectedupdatedcomponentsareregularlymadeavailableforevaluationviatheSolaris“pre-release”repository
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
CominginSolaris11.Next…
• Security– EnhancedexploitmitigationwithSPARCSSM
– TrustedServicesviaSMF
• DataManagement– Compressed&resumable replication– Scrubscheduling– Asynchronousdatasetdestroy
• Deployment– Agent-lessconfigurationandmanagementviaREST
– ConfigurationatScaleviaPuppetorChef– ScalableZoneBootEnvironmentManagement
• Networking– 802.1x– NetworkconfigurationviaSMFandAI
SolarisInnovationcontinues
Andmuchmore!
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
• LongTermInvestmentProtection–OracleSolaris11Supportthroughatleast2034
• Easy-to-applyUpdateStream–Monthlysupportupdates–QuarterlyCriticalPatchUpdates
• 20+yearhistoryofGuaranteedApplicationBinaryCompatibility
• LifetimeSupportforOracleSolarisLegacyenvironments
• Secure,uptodatePlatform– Includesmorethan1500regularlyupdatedwidelyusedopensourcepackages
• Built-inon-prem andcloudplatformmigrationtools
• ContinuousInnovation– NewHWsupportandproductenhancementsincludedinmonthlysupportstream
TheOracleSolarisPromise
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|
AdditionalSystemsContentNotToBeMissedSessionTitle OracleSpeaker Date/Time LocationGEN6456StrategiesforBuildingOpen,Cloud-ReadyInfrastructure
AjaySrivastavaSVP,OS&VMDevelopment
Monday,Oct022:15 PM - 3:00PM
MarriottMarquis(GoldenGateLevel)-GoldenGateA
CON6296LiftandShiftYourOracleSolarisWorkloadstotheOracleCloud
ScottDickson,PeterWilson
Monday,Oct025:45PM- 6:30PM
MarriottMarquis(YerbaBuenaLevel)-Salon13
GEN7353SPARCSystemsUpdate– AdvancingtheSoftwareinSiliconRevolution
Masood HeydariSVPSPARCDevelopment
Tuesday,Oct0311:30AM - 12:15PM
MarriottMarquis(GoldenGateLevel)-GoldenGateA
GEN6459OracleLinux– StateofthePenguin
Wim CoekaertsSVPOS& VMDevelopment
Tuesday,Oct0312:45PM- 1:30PM
MarriottMarquis(GoldenGateLevel)-GoldenGateA
ComemeetdevelopmentexpertsintheITInfrastructuredemoareainMoscone West
Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|