VMware, at the VMworld 2019 conference this week, strengthened its case for an application-centric approach to cybersecurity via updates to VMware AppDefense along with acquiring Intrinsic, a provider of a set of tools for securing serverless computing frameworks.
VMware AppDefense layers a distributed service layered on top of the Platinum Edition of VMware Sphere platform that enables organizations to create a framework for whitelisting interactions between applications. Updates to the VMware AppDefense now enable organizations to run vulnerability reports across an entire application and virtual infrastructure stack along with support for integrity checks for the Windows operating system kernel.
At the same time, VMware vSphere Platinum has now gained visibility and anomaly detection with automated reputation analysis for processes and network behaviors on a per-virtual machine basis. That capability is enabled by a collaboration with Kenna Security to feed risk-based data vulnerability metrics into the VMware AppDefense App Verification Cloud service.
Additional capabilities include being able to initiate remediation actions based on the potential severity of a vulnerability, such as killing processes and network connections, and the ability to initiate remediation actions via the VMware NSX network virtualization overlay.
At the same time, VMware also revealed that a future version of VMware AppDefense would also incorporate the technology that Intrinsic developed for securing serverless computing frameworks.
Tom Corn, senior vice president and general manager for security products, said that move represents the first effort to extend the reach of AppDefense to include cloud-native computing environments. VMware AppDefense, coupled with an endpoint security service VMware is about to gain with the acquisition of Carbon Black, are at the core of its DevSecOps strategy, and rather than thinking in terms of endpoints at devices, the company will employ Carbon Black to secure applications as though they are the endpoint, he said.
In some cases, Corn noted, that will require organizations to embed a lightweight agent within their applications. However, in many cases, platforms such as vSphere or Workspace ONE software will serve as the enforcement point because they already will have the Carbon Black agent software embedded. The Carbon Black agent also will be integrated with VMware Secure State, a real-time security and configuration monitoring service.
The goal is to reduce the number of conflicting agent software strewn across an enterprise by various silos of cybersecurity technologies that don’t do much more than increase the operational cost of cybersecurity, said Corn. VMware is pursuing a more proactive approach focused on securing the entire application environment. That approach includes the web application firewall the company gained by acquiring Avi Networks earlier this year, he said.
VMware already had a multiyear technology alliance with Carbon Black, so it has a good chance of achieving this goal soon once the acquisition is completed. In addition, as part of its DevSecOps strategy, AppDefense is already integrated with a variety of continuous integration/continuous deployment (CI/CD) platforms, Corn said.
It may be a while before VMware fully delivers on that DevSecOps promise, but at the very least the DevSecOps dialogue in the enterprise is about to be elevated significantly.
