This document discusses Bracket Computing's solution for achieving PCI compliance on Pivotal Cloud Foundry (PCF). Bracket has developed a security layer called METAVISOR that sits above the hypervisor/cloud infrastructure and below the operating system to provide network, storage and server security controls. METAVISOR can segment a PCF deployment into different security groups (PCI, non-PCI, management) to enforce policies and isolate workloads. When combined with Bracket's management tools, it allows a PCF platform to meet PCI requirements through an added exoskeleton of security controls provided by the METAVISOR layer.
5. COMPANY CONFIDENTIAL—DO NOT DISTRIBUTE/ BRACKET COMPUTING INC.™
The security industry
response…
6
…add an agent
to the OS!
6. COMPANY CONFIDENTIAL—DO NOT DISTRIBUTE/ BRACKET COMPUTING INC.™
The Problem with an Agent….
7
…they have less
privilege than an
Attacker.
Your Agent is Here!
7. COMPANY CONFIDENTIAL—DO NOT DISTRIBUTE/ BRACKET COMPUTING INC.™8
Since The OS Cannot Protect Itself…
CSP OR ON PREM HYPERVISOR
METAVISOR Security Layer
8. COMPANY CONFIDENTIAL—DO NOT DISTRIBUTE/ BRACKET COMPUTING INC.™9
METAVISOR
CSP OR ON PREM HYPERVISOR
Server
Guard
Network
Guard
Data
Guard
9. COMPANY CONFIDENTIAL—DO NOT DISTRIBUTE/ BRACKET COMPUTING INC.™
BRKT: A Security Layer For Every Cloud
APPLICATION APPLICATION
OS
BRACKET METAVISOR
Network Security Storage
APPLICATION APPLICATION
OS
APPLICATION APPLICATION
OS
APPLICATION APPLICATION
OS
ON-PREM PHYSICAL INFRASTRUCTURE AWS PHYSICAL INFRASTRUCTURE GOOGLE PHYSICAL INFRASTRUCTURE
ON-PREM HYPERVISOR AWS HYPERVISOR GOOGLE HYPERVISOR AZURE HYPERVISOR
AZURE PHYSICAL INFRASTRUCTURE
BRACKET METAVISOR
Network Security Storage
BRACKET METAVISOR
Network Security Storage
BRACKET METAVISOR
Network Security Storage
10
10. COMPANY CONFIDENTIAL—DO NOT DISTRIBUTE/ BRACKET COMPUTING INC.™
Bracket PCF Security
11
SHARED FOUNDATION
“PCI” Segment
BRACKET METAVISOR
Diego Cell
Container
“Non PCI” Segment
BRACKET METAVISOR
Diego Cell
Container
“Management” Segment
BRACKET METAVISOR
PCF Router
BRACKET METAVISOR
Ops Manager
Bracket
MCP
Ops Manager
Image +