TheSaffaGeek

My ramblings about all things technical


Leave a comment

VCAP-CID Objective 1.5 – Determine Security and Compliance Requirements for a Conceptual Design

Knowledge

Identify relevant industry security standards.

  • For security standards there are a few and for these they are normally for government,finance,military and telecommunications. There are a few standards each of these keep to and they largely overlap into the next point of compliancy. For example here in the United Kingdom there are a few cloud vendors who run community clouds where they assure they meet business impact levels and each of these levels determines the requirements for protection. A really good article straight from the UK government is here where information security is defined based on a number of criteria. A lot of government and military companies keep data in IL2 or IL3 and vSphere 4.0 and 4.1 were actually verified to meet IL3 compliancy. Recently they are still EAL4+ and FISMA certified.
  • For your conceptual design you will need to know what abstraction is required based on whatever the relevant security standard is and most likely have to sit down with the compliancy officer and determine what they feel is required for them to approve your solution meets their security standards.

Identify relevant industry compliance standards.

  • There are a number of compliance standards that are used  from various companies who process credit cards, hospitals who keep peoples personal data to companies who have to keep to specific regulations. There are a number of these and some are only applicable in specific countries but the ones I think are the most likely to be seen in a vCloud environment are:
    • Sarbanes-Oxley
    • Health Insurance Portability and Accountability Act (HIPAA)
    • Federal Financial Institutions Examination Council (FFIEC)
    • Payment Card Industry Data Security Standard (PCI DSS)
    • International Organization for Standardization (ISO) 17799
    • National Institute of Standards and Technology (NIST)
    • International Organization for Standardization (ISO) 27001
  • A really great example of this is the Architecture Design Guide for Payment Card Industry (PCI) document by VMware. This is PERFECT in showing the kinds of things you need to keep in mind and the varying mechanisms to achieve this. The document goes much deeper than conceptual but seeing as you will have to go from conceptual to logical and then to physical it makes sense to learn it now.
  • Another great document by VMware that is mentioned on the blueprint is the Infrastructure Security: Getting to the Bottom of Compliance in the Cloud document.

Explain vCloud security capabilities.

  • This along with the two points above are covered  perfectly in appendix B of the vCAT Architecting a VMware vCloud pdf. For the conceptual design this is more around isolation and multi-tenancy but the whole of appendix B gives a great break down of the kinds of security that is possible within vCloud and the mechanisms and products that can be used to achieve this.

Identify the auditing capabilities of vCloud technologies.

  • This is the vast mechanisms such as logging,log retention, syslog shipping and firewall logging via vCNS to name but a few that are possible via vCloud. Appendix B of the vCAT covers these off really well and the retention policies mentioned in the Architecture Design Guide for Payment Card Industry (PCI) document cover off the kinds of auditing you may be requested to do. For conceptual this isn’t very applicable and I’m amazed it is actually mentioned here.

Skills and Abilities

Based on customer requirements, determine auditing requirements for a vCloud conceptual design.

  • These would be determined in design workshops and discussions with different subject matter experts within the customer around what they are looking to audit/log and if there are any compliancy standards they needs to meet. If they are a service provider who provides public cloud to the general public then there is a very good chance they have to meet PCI compliancy for example and so retain logs and do auditing to ensure security and allow retrospective inspection. For a conceptual design auditing isn’t something you would put in your “napkin” design but knowing if you need additional auditing does mean you have to design to be prepared for this in the logical and physical designs.

Based on customer requirements, determine security requirements for a vCloud conceptual design.

  • A large portion of this is the same as above as with security requirements around compliancy includes auditing also.  For example if it is a private cloud that is being designed but it is for a hospital, then HIPAA standards need to be met and so certain security measures need to be applied. For conceptual this is mainly around separation, defence in depth and usage of two factor authentication to name a few off my head. How different zones within the cloud offering are separated and secured also need to be planned for and conceptually designed.

Based on customer requirements and vShield Edge security capabilities, determine the impact to a vCloud conceptual design.

  • For this you need to know what vShield Edge is capable of doing and in what use cases each of these would be used. A perfect document that describes this is the vShield Edge Design Guide Whitepaper. The actual impact to a conceptual design is mainly that vShield Edge allows isolated virtual datacentre’s hosted on a common physical infrastructure instead of needing siloed physical infrastructures. The separation via the vShield Edge firewall is in most cases more than sufficient but knowing where physical separation is required (PCI for example) is also very important.
  • vShield Edge also provides IPSec VPN capabilities which are very important for the security of your cloud infrastructure. Knowing that the vShield edge can provide this along with NAT,Load balancing and most importantly for this section firewall capabilities via one device means you don’t need multiple devices like in a traditional multitenant design.

Explain the logging capabilities of the various VMware products.

If you feel I have covered something incorrectly please let me know as I’m learning like everyone else and I certainly don’t claim to be perfect (near it but not perfect Winking smile ). Also the vBrownbag covered the whole of objective 1 here.

Gregg


Leave a comment

VCAP-CID Objective 1.4 – Determine Availability Requirements for a Conceptual Design

Knowledge

Identify availability options for management components.

  • Availability can achieved within the vCloud architecture in a number of different ways and via differing methods. I’m going to break them up into different categories and i’m not going to cover each one but if you understand the different methods I think when you are reading the vCAT or any other kind of design book you’ll be able to identify them with ease.
    • Redundancy: This is simply creating multiple instances of an important service to ensure that if one or more fail that the solution isn’t impacted by this. There are multiple examples of this but the most simple but one of the most important in my opinion is the creation and usage of multiple vCloud cells to ensure load balancing but more importantly redundancy in the event of a loss of a vCloud cell. You can also cover this further down the stack with Heartbeat in the vSphere layer(even though this has now been made end of life) ,multiple network cards from the physical networking and multiple redundant switches to multiple redundant storage processors.
    • Disaster Recovery/Failover: This is covered in a whole section in the vCAT which goes over methods of utilising products like SRM to configure disaster recovery of the management layer. For conceptual this is more about knowing what is and isn’t possible but also taking the availability requirements of the customer from a business impact analysis where it is deemed the amount of money a customer is willing to lose due to downtime and then equate this to a number of nines. The table below gives an example of the number of times compared to amount of downtime and with the larger the number of nines this will then mean more expensive solutions which you will need to advise your customer about (99.9 can be met by HA for example but 99.99 will require heartbeat and synchronise replication with QoS). For conceptual you don’t cover specific products but knowing that you will need a DR site with fast links between will cover this for example.

HA

Differentiate between management components and resource components.

  • This is simply determining what should be part of your management cluster and what should be part of your resource cluster. I think this is really straight forward as anything in your management cluster is used to provide services to you the vCloud administrator and the resource cluster/s are for your customers to provision to and is the pools of resources you configure as your provider virtual datacentres. The below image is a great example of a conceptual diagram of the management and resource clusters.

conceptual

Skills and Abilities

Explain compatibility of various vSphere high availability features with a vCloud design.

  • This is covered perfectly in appendix A of the vCAT Architecting a VMware vCloud pdf so I don’t see the need to explain it here and i think it is better if you go through that instead. The link to the online documentation centre is here 

Given customer requirements and constraints, determine appropriate customer Service Level Agreements (SLAs) for the conceptual design.

  • This is covered in more depth within objective 1.6 so we will cover this in that section.

Determine how given SLAs impact availability design decisions.

  • This is covered in more depth within objective 1.6 so we will cover this in that section.

Given customer requirements and constraints, determine how to achieve desired availability.

  • From the design workshops and requirements collecting you will have worked out what the customers requirements and constraints are and will then have to work with these to try meet them all. For this it is their availability requirements which will be as I mentioned above their permitted amount of downtime per year along with their RPO’s ,RTO’s , MTD’s and WRT’s. From this you will have to work with their constraints to design a solution that meets their requirements so for example if they have an RPO of 5 minutes for critical systems within the management cluster in the event of a site failure this cannot be achieved via SRM with vSphere replication. For the conceptual design my example isn’t applicable but knowing this kind of limitation will then mean you know conceptually what needs to be created (multiple sites with fast links that have near zero latency for multiple data service providers and storage that can achieve this)

Given customer requirements and VMware technologies, determine availability impact to the conceptual design.

  • I feel this is largely what i have mentioned above but now you are including VMware technologies limitations/capabilities into your thinking which I actually did above. You will need to know what is and isn’t possible with HA for example and how it’s can only provide a certain level of availability and is limited by the amount of restarts it can achieve at once whilst being possibly limited by priority groups.

If you feel I have covered something incorrectly please let me know as I’m learning like everyone else and I certainly don’t claim to be perfect (near it but not perfect Winking smile ). Also the vBrownbag covered the whole of objective 1 here.

Gregg


Leave a comment

VCAP-CID Objective 2.1 – Determine Catalog Requirements for a Logical Design

Knowledge

Identify what can be included in a published catalog.

  • A published catalog is one that is created in the administrative organisation with all the required components and  vApp templates published to all other organisations in the vCloud environment. Good design practice to only allow the administrative organisation to publish its catalog and deny this ability for all the standard organisations.
  • The components that can be included in a published catalog are:
    • Standardised gold master vApp that can consist of a single virtual machine all the way to 3 tiered offerings like a web service with a web front end, an application server and a database server. These are verified templates that meet regulatory and security standards which ensures consistency across the environment and provides the consumers with verified offerings that can be deployed with ease.Guest customisation changes the identity of the vApp and can be used for post-deployment steps, such as the joining of vApps to domains.
    • vApp Templates which can cannot be deployed but can be deployed (instantiated), creating a vApp that can be deployed and powered on.
    • Media like ISO files for software and applications. These are also verified and commonly customised to ensure standardisation and to provide specific capabilities.

Identify what can be included in a private catalog.

  • A private catalog can have the exact same components but it is controlled by the user/group assigned the Catalog Author vCloud role. This catalog is limited to a specific organisation and good design practice states you should limit the ability to publish this catalog thereby making it a private catalog.
  • This can still contain standardised vApp’s and ISO’s and if you are a service provider this is where the cloud consumer will place their standardised vApp’s and ISO’s so that the organisation can use them but other organisations cannot.

Identify permission controls for catalogs.

  • There are three Predefined roles in vCloud that have varying permissions and rights to make changes and create components in catalogs. A breakdown of the predefined roles and their rights are contained in this documentation centre link

Explain the functionality of a catalog.

    • This should be straight forward as this is VCP-IaaS level and I think all the previous sections define it pretty well also. But just in case i have pasted the VMware definition below:
      • VMware vCloud Director uses the concept of a catalog for storing content. Organizations have their own catalog that they can populate and and share the contents with other organizations and users.

All entities in the catalog are stored in a content repository system. The content repository, a component in the vCloud Director storage subsystem, provides an abstraction to the underlying datastores while offering features to store, search, retrieve, and remove both structured and unstructured data.

Skills and Abilities

Based on application requirements, determine appropriate vApp configuration.

  • As I mentioned for the published catalog and private catalog sections above you can configure vApp’s with multiple tiers to allow the organisations to provision these offerings in their vCloud organisation and maintain standardisation. If a customer asks for a web service offerings then you can provide them with a three tiered vApp with a web front end, an application server and a database server. There may even be a requirement for availability of the offering so you will created multiple front end, application servers and a clustered database back end.
  • Using the web service example this will also require different networking to ensure the security of the offering which will mean different servers connecting to different networks and vCNS endpoint devices being configured as part of the vApp. I am planning on creating a few of these as practice in visio so that I can visualise them and make sure I know what they should look like in case a visio style question comes up or i just need a good mental picture to make decisions for questions.

Determine appropriate storage configuration for a given vApp.

  • This follows closely to what I covered above but now you need to think of the storage offering the vApp components are going to be kept on and what storage you are going to allow the vApp to be deployed onto. Using my trusty web service example you wouldn’t want the database sitting on low end storage as this would severely impact the service.
  • This is what I think they are asking for so if you think i’m wrong then please do tell me as I’m also learning and sometimes it’s difficult to gleam what they mean as this could also relate to fast provisioning.

Given customer requirements, determine appropriate catalog design.

  • I think for this if you have created catalogs countless times and know what you can put in there and that they can be published to specific organisations from other organisations or published to all from the administrative organisation then designing it should be simple enough.

Determine the impact of given security requirements, on a catalog structure.

  • This may be numerous things but there are times when an organisation wants only certain vApp’s and ISO’s in a catalog to be available to certain people and so you can configure the catalog to have certain portions only available to certain people.
  • There are also many organisations who have very customised and important virtual machines which they have converted to vApp templates and they want these secured so that only a certain person can access them and only that person can provision them for people.

If you think I have totally missed something then please do tell me as I’m only learning and I’m certainly not perfect.

Gregg


Leave a comment

VCAP-CID Objective 1.2 – Identify and Categorize Business Requirements

Knowledge

 Identify discovery questions for a conceptual design (number of users, number of VMs, capacity, etc.)

  • These questions are ones you are going to ask during the design workshop for the design/project. For the workshop you need to make sure you have the applicable project participants/stakeholders who can join the workshops (depends if you want one big one where people come and go at certain points or multiple ones where you speak to each business unit/ team). For the stakeholder meetings/design workshops I personally like to try bring in the following people, this does vary depending on the project and what has been chosen but 9/10 times these are the people you want to speak to:
      • Virtualisation administrators (if applicable. If not already present then future administrators of the solution)
      • Server Hardware Administrators
      • Backup Administrators
      • Storage Administrators
      • Desktop/OS Administrators
      • Network Administrators
      • Application Administrators (these are very important as their applications may have very specific requirements)
      • Security Officer
      • Project Sponsors
      • End users/ Help desk personnel (this I find is helpful to find out what are the current support desk tickets/problems the company are facing and if these will impact the project in any way. Also these discussions are easy to have in the hallway/over a coffee but have alerted me to unknown risks that would have severely impacted the design and delivery)

vcap

Identify the effect of product architecture, capabilities, and constraints on a conceptual design.

  • I may be looking at this the wrong way but I think this is actually around how specific products architecture, capabilities and constraints isn’t applicable in a conceptual design as for a conceptual design you are only creating a “napkin” design diagram of how the whole environment is going to be delivered.

Skills and Abilities

Relate business and technical requirements to a conceptual design.

  • From one of the VMware service delivery kits available to VMware partners they give a great breakdown of what requirements are and what business and technical requirements are:
    • Requirement – Documented statement that depicts the requisite attributes, characteristics, or qualities of the system
    • Business requirements – Describes what must be achieved for the system to provide value
      • System must provide self-service capability
      • System must provide x% availability
      • System must provide optimal scalability and elasticity
    • Technical requirements – Describes the properties of a system which allow it to fulfill the business requirements
      • System requires a Web portal where users can log in securely and deploy virtual machines based on defined policies
      • System must have fully redundant components throughout entire stack (host, network, storage)
      • System leverages virtualization technology and associated features
  • As mentioned these requirements will be gleamed from the Design Workshops/Stakeholder meetings and then put into the conceptual design. This is where you would work out if the customer requires a private, hybrid, public or even community cloud deployment. For example if the customer requires certain data to remain in a country for regulatory reasons then in the conceptual design you know compute resources, networking and connectivity between that country and the primary site need to be available. The speeds, number of hosts, make of hosts and amount of memory and vCPU are not in the conceptual design as this is the “napkin” design just covering the concept of how it will all work out and may actually change once you get to the logical and physical designs.
Number Requirement
R001 Virtualise the existing 6000 UK servers as virtual machines, with no degradation in performance when compared to current physical workloads
R002 To provide an infrastructure that can provide 99.7% availability or better
R003 The overall anticipated cost of ownership should be reduced after deployment
R004 Users to experience as close to zero performance impact when migrating from the physical infrastructure to the virtual infrastructure
R005 Design must maintain simplicity where possible to allow existing operations teams to manage the new environments
R006 Granular access control rights must be implemented throughout the infrastructure to ensure the highest levels of security
R007 Design should be resilient and provide the highest levels of availability where possible whilst keeping costs to a minimum
R008 The design must incorporate DR and BC practices to ensure no loss of data is achieved
R009 Management components must secured with the highest level of security
R010 Design must take into account VMware best practices for all components in the design as well as vendor best practices where applicable
  • For Technical Requirements a great way of doing it is to break them down into sections like:
    • Virtual Datacentre Requirements – eg: Allocation model Virtual Datacenters reserves 75% of CPU and memory
    • Availability Requirements – eg: VMware vCloud Director (clustering, load balancing)
    • Network Requirements – eg: Organizations have the ability to provision vApp networks
    • Storage Requirements – eg: Different tiers of storage resources must be available to the customer (Tier 1 = Gold, Tier 2 = Silver, Tier 3 = Bronze)
    • Catalogue Requirements – eg: Catalog items are stored on a dedicated virtual datacenter and dedicated storage
    • SLA Requirements – eg: SLA Requirement #1 – Networking 100%
    • Security Requirements – eg: Organizations are isolated from each other
    • Management Requirements – eg: Only technical staff uses remote console access
    • Metering Requirements – eg: Metering solution must monitor vApp power states for PAYG
    • Compliance Requirements– eg: Solution must comply with PCI standards
    • Tenant Requirements – eg: Customer requires the ability to fence off vApp deployments
  • To make sure you are doing the design in a VCDX-like manner which should push you to do it at a very high level, don’t forget to refine the customer-specific technical requirements and validate that they are specific, measurable, accurate, realistic, and testable (SMART).

Gather customer inventory data.

  • This is what is going to be on the new vCloud system whether it is existing workloads or new workloads. A good way of getting this if the customer allows it is to run a VMware Capacity Planner collection on the existing workloads that are going to be migrated in so you know sizes, I/O and current state analysis values. The Capacity Planner can only be run by VMware partners so if this isn’t possible for you then manual collection and recording is going to be required. Another method is via the VMware vCloud Planner which is another tool only available to VMware Partners so maybe getting a VMware partner in to do this for you prior to the project running would be a good idea
  • Also knowing what the customer already has can help you understand possible future constraints for example that all their current servers are IBM and so this is likely to be the server platform for this design.
  • There may also be a requirement to use existing legacy physical kit already present in the datacentre which needs to be recorded and fully understood so that the risks and constraints of using this infrastructure are fully understood. For example if you are using legacy network switches which can’t do stretched VLANs this will impact your design substantially if you have two sites and a requirement for the Management cluster to be failed over/migrated in the event of a disaster.

Determine customer business goals.

  • This is plainly what is the customer looking to gain from the deployment of this solution? At the end of the project what do they hope to achieve? These are sometimes not as clear as you may hope as people have different ideas of what they want the solution to achieve so as the architect you will need to take all these business requirements, set expectations if they are unrealistic due to varying reasons like cost or pre-selected hardware and then define them and get sign off from the customer that they agree to these before any additional work is done. This is very important as if these aren’t defined and agreed to by the customer then scope creep can happen which could cause the project to fail.

Identify requirements, constraints, risks, and assumptions.

  • I’m not going to go into great depth here as I think the definitions of each will give you a good idea of what each is. During the design workshops/stakeholder meetings these are worked out, recorded and agreed to by the customer. Always remember that for any design you need to collect all of these and then look at it in a holistic manner and understand the impacts of each decision.
    • Requirements – Documented statement that depicts the requisite attributes, characteristics, or qualities of the system. See above portions around Business and Technical requirements plus the examples.
    • Constraints – Requirements that restrict the amount of freedom in developing the design
      • Hardware which already exists and must be used (for example,host or storage array)
      • Physical limitations (distance between sites, datacenter space)
      • Cost $$$
    • Risks – Potential issues that may negatively impact the reliability of the design
      • Lack of redundancy for specific hardware component
      • Support staff has not had any training
    • Assumptions – Suppositions made during the design process regarding the expected usage and implementation of a system
      • Provides a sounding board for design decisions which must be validated
      • Hardware required is installed before vCloud implementation
      • Network bandwidth is not a limiting factor for external end users
      • Appropriate training is provided to existing technical staff
    • For assumptions and risks I like to get these highlighted to the customer right away as you normally don’t want any assumptions if possible and for the assumptions you record in your design you want these to be realistically clarified already so that the assumptions are only there to ensure that if what they promised would be there isn’t you can refer them to the assumptions they signed off.

Given customer requirements and product capabilities, determine the impact to a conceptual design.

  • This I think is covered above in places but is also something you can only really learn from actually doing a design and understanding how requirements shape a design and what impacts each of them have. On a conceptual design it isn’t as much of an impact as in a logical and physical design but limitations like keeping workloads in specific geographies and the capability of vCloud stretched clusters between the two locations for example are something that will impact the conceptual design. I would also read the Service definitions listed below in the recommended tools from the blueprint and the implementation examples from the vCAT.

Tools

If you feel I have missed something or am wrong on something then please do comment as I don’t proclaim to be the best and am always learning and welcome constructive criticism and feedback

Gregg


Leave a comment

Presenters wanted for the EMEA #vBrownbag

The EMEA vBrownbag team are currently looking for presenters to present on the EMEA #vBrownbag which is run live every Tuesday at 7PM GMT/BST. Currently we are covering several tracks which include:

-VCP5-DT exam blueprint objectives

-VCP5-IaaS exam blueprint objectives

– VCAP5–CID exam blueprint objectives

-VCAP5-CIA exam blueprint objectives

– Anything related to VMware or would interest VMware focused IT people. These can be VMUG presentations or even prep for a conference

If you are interested in presenting then please fill in the form here: http://professionalvmware.com/brownbags/vbrownbag-presenter-sign-up/

Also please spread the word about the podcast and that we are always looking for presenters.

Gregg