Benjamin Thurston
Endpoint Hardening: Fortifying Your Defenses

In the ever-evolving world of cybersecurity, the imperative to fortify digital defenses has never been more crucial. Enter endpoint hardening—a strategic approach that transforms individual devices into cyber heroes. This blog navigates the complexities of endpoint hardening, spotlighting vulnerability remediation, and emphasizing the pivotal role of advanced patch management techniques. As we delve into the critical process of remediation verification through scanning, the urgency of staying ahead of cyber threats becomes apparent. To amplify your defense, discover SnowCap's Patch Guardian service—a comprehensive solution with fully automated tools. It seamlessly integrates into existing tool stacks, offering a layer of protection beyond conventional measures. Trust SnowCap to elevate your cybersecurity posture and navigate the ever-adapting landscape of digital threats. Secure your endpoints, verify your defenses, and usher in a new era of cybersecurity resilience.

Endpoint Hardening: Fortifying Your Defenses

VMware vSphere 6.7 Highlights

FINALLY!

VMware recently released vSphere 6.7 with new enhancements and additions to the product. Some of these key capabilities include simplified management, performance optimization, enhanced security, and cloud integration.

 

Simplified Management

Simplified vCenter Server Appliance (VCSA)

The VCSA now supports Enhanced Linked Mode with an embedded Platform Services Controller. This new feature simplifies the vCenter topology and allows it to scale seamlessly without the need for and external PSC or load balancer.

For over two years we have been promised a fully functional HTML-5 client to replace the C# and Flash based options. Every version has added more functionality (VUM, VSAN, NSX, etc.), but we have not been able to completely discontinue the use of the Flash Web Client. I am excited to say that in 6.7 release, the HTML-5 client contains 95% of the functionality and VMware has gone on the record stating that by Fall 2018 it will be contain 100% of the features included in the Flash version.

Integrated Backup

One of the major issues that occurred for some users with the VCSA was backing up the appliance. Those who previously used MSSQL and a Windows VM usually used their standard backup software, but this was possible with the VCSA DB. Backups were recently included, but now you are able to schedule regular backups through the client without having to use scripting.

 

Platform Efficiencies

Single Reboot Upgrades and Quick Boot

In the past a major upgrade would require two or more reboots of the host to complete. Now with the recent update it takes only a single reboot to complete. Quick Boot is another addition that allows an ESXi host to be restarted without a full reboot which bypasses the lengthy BIOS initialization process. These two features, when multiplied by the number of hosts, can greatly reduce maintenance windows.

Enhanced GPU Operations

Today GPUs are becoming more common in high performance computing. VMware previously supported GPUs for VDI workloads, but now the nVidia Grid technology can also be used for things like AI, machine learning, and business intelligence. Another limitation of GPU enabled VMs was that it was not possible to vMotion them without shutting them down. It is still not possible to migrate a live VM, but it does support suspending the VM and resuming it after migration without having to shut down the running OS.

Persistent Memory Support

VMware’s Persistent Memory Support is an example as to how vSphere is moving to support high performance computing. This allows VMs to leverage newer technologies such as NVMe to greatly improve performance. The diagram below shows where this technology fits into the technology stack and how it can increase performance.

Hybrid Cloud Enablers

Cross Cloud Migration

Also, a noted improvement in the latest version is the ability to perform Cross vCenter Provisioning. The most important thing that this enables is true hybrid cloud, especially when using VMware Cloud on AWS. There is now the ability to seamlessly move workloads between and on premises infrastructure and the public cloud. The following features help enable this.

Mixed Version vCenter

As a part of the update it is now possible to provision between different versions of vCenter. Features such as this are extremely important as some clusters and clouds may be on differing upgrade schedule. A perfect example is that the VMware Cloud is not supported on 6.7, but you may still want to upgrade your internal private cloud, and this is now supported.

Per-VM EVC

Another example of flexibility is per-VM EVC. In the past EVC was configured at the cluster level and affected all VMs. Now you are able to select this at the VM level so that some VMs can still move to older hosts, while others can benefit from the advanced CPU instruction sets at the expense of host mobility.

 

Conclusion

There are additional features that I have not touched on here such as TPM 2.0 support, VM encryption at rest and in motion, and Instant Clone which was previously only available with Horizon View. The official VMware announcement can be found here.

https://blogs.vmware.com/vsphere/2018/04/introducing-vmware-vsphere-6-7.html

There are many significant improvements with this new version of vSphere that warrant investigation, but as with any major upgrade there are caveats, prerequisites, and exceptions. Please reach out to your Account Representative here at SnowCap to setup a call or meeting to discuss your readiness and overall cloud strategy moving forward.