Installing GravityZone-in-a-Box (GZiaB) in a VMware vSphere Environment..

This post is in continuation with my previous post which introduced the new launch of Bitdefender's endpoint security product for SMB segment called "GravityZone-in-a-Box (GZiaB). I would suggest you to read thats article to get an overview about the product, - "Bitdefender's GravityZone-in-a-Box - A thoughtful solution for Endpoint security!"

As promised before, I will now showcase step by step instructions to deploy this solution in your vSphere Infrastructure. As mentioned before GZiaB is a single virtual appliance with all the roles installed within, it is extremely simple to deploy and configure. Without further a do, lets being with the deployment.

DEPLOY GZiaB OVF

1- Deploy the OVA Template using vCenter Server

2- Browse of the GZIAB.ova file and click on Next

3- Review the details and click on Next

4- Give the Appliance a Name and Select the Folder where you want to deploy the appliance and click Next.

5- Select the appropriate Network Port Group and Click on Next. The IP settings will be configured later in the appliance interface.

6- Review the settings and click Finish to deploy the OVF.

Now, we will power on the Appliance and do the first time setup.

**********************************************

SETTING UP GZiaB

1- Once the appliance is powered on you need to setup for the password for the built-in admin. The username of this admin is "bdadmin". Right click and open a VMRC console to this appliance.

2- Now you need to use the same password to login and setup the appliance.

I will go through setting up each of the setting for my environment by selecting each option.

3- The following settings need to configured. Use your keyboard for going through the options and setting them up.

4- Start with setting up the host name and domain details.

5- Setup the network configuration.

6- Setup up MDM options if you need that for external communication.

7- If you select option 5 you will notice that all the roles which were deployed separately in Gravity Zone are bundled together in the GZiaB virtual appliance making it a true "IN A BOX" solution.

So that sets up the appliance for us. Now we need to use the web console IP to open the web interface on the webpage and start configuring the solution and protecting virtual machines.

CONFIGURING GZiaB

1- Use a web browser to open the web console to configure it. Remember this User Name and Password is for your subscription with BITDEFENDER. Create one if you do not have one by clicking on the link - I don't have a MyBitdefender Account.

2- Once logged in License the product

3- Create a root account. This is the super admin user which you will use to login into the appliance. You can create more users with Role Based Access Control which I will showcase later.

So far you have 3 passwords, one for bdadmin, 2nd one for your bitdefender subscription account and the third is the root account which I have named as 'wickedsunny'. Once the account is created we will get on the Home Page of the appliance.

4- Close the preview screen to get to the configuration page.

5- Now you have 6 Menus on the top of the screen. Let's quickly tour them one by one.

6- Click on the Integration Tab to integrate with AD.

7- Click on Virtualization to add the vCenter Server as shown in screenshots below

8- Provide the credentials for the vCenter Server to complete the integration

The vCenter Resources with now synchronize with the appliance and might take a few minutes.

9- Select the Settings tab and configure the Mail Server, Proxy and Time Source under Miscellaneous tab.

10- Click on the update Tab to update the GZiaB appliance.

12 - Make sure you the correct update settings. You can update the same using the Update Server option.

13- The Certificates and License Status tabs are self-explanatory. Let's jump to the Account section and create a user. You can also pull down the user from the AD integration.

14- And finally the Logs TAB which shows the Audit Logs.

PROTECTING WORKLOADS USING GZiaB

Now that we have the appliance read, we can logout and login with the administrator use which we created in STEP 13. This will give us a new interface which will help us to protect the workloads. While I will encourage you to explore the options on this screen, since there are various options you have to setup your own  customized Anti-Malware policies, I will go with the Default Policy to protect one of the VMs in my lab.

1- Click on Network Tab  Select the Resource Pool/Cluster or Datacenter where your workload is located from the left pane. This is similar to the inventory objects in the vCenter. Select the VM where you want to install the Anti-Virus client and click on the Tasks button on the Left top corner and click on Install Client.

2- Confirm the IP address and credentials for this workload. You can setup multiple account or have a domain account pushed as local administrator through AD policies. Select the credential and click on Save

3- Click on Network - Tasks to check the status of the install. Once done, you would see that the agent is installed via network on the Target machine and the defined policy starts working with immediate effect.

Well hope this gives you enough information on deploying the solution and using it.To reiterate, this solution is a simple install and configuration and can get you going a few minutes. So go ahead, and secure your environment to ensure efficiency & control on your virtual infrastructure and keep the bad things at bay.

Share and Spread the Knowledge. 

Bitdefender's GravityZone-in-a-Box - A thoughtful solution for Endpoint security!

A few months ago I wrote an article around using vShield Endpoint in vSphere environments for protecting workloads running in your virtual data-center. The primary reason behind writing that article was to encourage VMware users/customers to look at this centralized approach of running anti-virus and anti-malware in the virtual world. This approach not only helps you with avoiding situations such a "ANTI-VIRUS STORMS", it also helps you to ensure that you do not worry about managing anti-virus software and patching for each endpoint in your virtual infrastructure, be it Virtual Desktops (VDI) or Server workloads.

vShield Endpoint is not a complete anti-virus solution as it just works as a gateway between the Anti-virus solution and the Virtual infrastructure. It is important that the customers are able to evaluate and select the right Anti-Virus software provider for their virtual workloads. In my experience of virtualizing a number of servers and end-points, I see an increasing demand from the customers around further simplifying there end user security mechanisms with solutions which can be easily integrated with their existing landscape. While this has been a demand and approach of most of the enterprise customers, I have seen this agility missing in the Small and Medium Business segments. While reasons for this lag vary from organization to organization, there are a few key concerns which I have come across from most of my customers:-

• Different solutions for different Hypervisors.
• Different solutions for different use cases. E.g. VDI, Servers & Mobile devices.
• Difficult to deploy due to multiple moving parts.
• Issues around management due to different entry points for different solutions & use cases.
• Complex licensing models for each use case
• Cost effectiveness

From a customer's standpoint the above mentioned points are valid, since one would not want to leave the complex world of traditional agent based anti-virus solutions, just to land up in another complex world of virtual anti-virus solution which has to be designed, implemented and managed from scratch. This directly compares to the world of server virtualization, which became popular because of the fact that you do not need a team of consultants to build and run a virtual infrastructure as most of the associated frameworks and solutions are just plug & play.

From the point of view of the Small and Medium Businesses, an appropriate anti-virus solution would be something which not only caters to their ever-changing needs, but also provides an easy way to deploy and manage such a solution. Since the IT teams of SMBs do not work in SILOS such as network admins, storage admins, security admins etc, it is very difficult and costly for them to have specialized resources for each silo. Most of the SMB IT Admins are "Master of all trades". (Being a VMware guy, I absolutely love this approach since it is important to understand the entire ecosystem around VMware to understand, deploy, use and manage a vSphere Infrastructure.) While these challenges have been around for a while, there have been very little traction around solving such issues for SMBs.

While I have been working on deploying solutions from various security vendors, I have also worked on the enterprise solution of Bitdefender named Gravity Zone. Gravity Zone has various flavors around protecting end-point & mobile devices and I have worked on their solutions for protecting Virtualized Infrastructure which includes VDI and Server workloads. Bitdefender, in fact was one of the very few vendors which integrated with VMware vShield Endpoint to deploy an agentless security model which allows you to offload anti-virus and anti-malware tasks to a centralized anti-virus appliance. This approach involved the deployment of vShield now known as vCloud Networking and Security solution alongside the Gravity Zone solution.

While Bitdefender like other security vendors concentrated on the enterprise markets all this while, they are finally out with a solution for the SMB space as well called GravityZone-In-A-Box (GZiaB). GZiaB is targeted to solve the challenges faced by SMB segments around anti-malware security for their workloads. Some of the key features of this solution are:-

• Hypervisor Agnostic Solution (common for all  x86 vendors such as VMware, Citrix & MS)
• Provides Unified Management for Virtual, Physical & Mobile endpoints
• Out of the box integration with vCenter and other Hypervisor management solutions
• Easy to deploy with an All-In-One Virtual Appliance
• Comes with a unified licensing model.

Since the product is targeted towards SMB, the product scales up-to protecting 250 endpoints which would also keep down the price points and make it more attractive for the SMB markets. While the above points are attractive, I have gone ahead and downloaded the evaluation copy of the product and have started using the same in my lab environment. I will post another article which showcases how to deploy the solution. I must say, that the promise of easing out things is certainly kept by Bitdefender since they have squeezed in the different roles of Database, Management Console and Comm server into a single virtual appliance. This will not only makes things easier to manage, but will also reduce the overall cost of running and managing the solution. I guess that explains why they choose the name "Gravity Zone in a Box"

Earlier today, Bitdefender announced that the solution would provide enterprise class security to SMB. Here is an abstract from the Bitdefender GZiaB launch note:-

"GravityZone-in-a-Box provides SMBs a new standard in managing, monitoring and reporting security activities across a broader threat environment. Businesses will better manage reporting for regulatory compliance and audits, following best practices. Like its big brother, GravityZone (launched earlier in 2013), the new solution delivers an enterprise class security management console to manage multiple endpoints, no matter the environment.

GravityZone-in-a-Box, a Citrix Ready security solution verified for VDI-in-a-Box, secures up to 250 endpoints, allows companies to easily manage security for virtual desktops and servers as well as physical and mobile endpoints. This streamlines management and resolves security headaches often suffered by SMBs adopting bring-your-own-device policies for mobile devices"

An important thing which I learned while setting up GZiaB in my environment is that, it does not uses vShield Endpoint as the gateway unlike GZ for virtualized environments. The product by passes the vShield Endpoint integration and sets up to talk directly to the virtual machines for malware protection and all of this managed by a single appliance.

Very soon I will come out with step by step instructions in a deployment article which will help you deploy this solution in your infrastructure within minutes and start protecting your servers or desktop workloads without the worries and concerns mentioned in the before in this article.

Till that time..

Stay Tuned!!!

Share and Spread the Knowledge. 

vShield Endpoint Now Available to vSphere Customers!!

With the Introduction of vSphere 5.1, all the editions (essential plus or higher) of vSphere have the vShield Endpoint component bundled along with them. This basically means that you would no longer have to shell out dollars to use the functionality of Endpoint. This enables you to offload the Anti-Virus tasks to a service virtual machine, which runs on each ESXi server to ensure that all the malicious activities and data can be scanned on this service VM. This protects your virtual machines against virus attacks and other malicious activities. This will also avoid any Storage, CPU or RAM bottlenecks which might be seen in the environment due to traditional Anti-Virus Scans using an anti-virus agent inside each virtual machine.

As mentioned before, with the release of vSphere 5.1, Endpoint functionality is available at no extra cost to customers with valid SnS contract for Essentials Plus or higher. vSphere 5.1.x, 5.0.x and 4.0 U3 customers can download Endpoint from the respective vSphere download pages. No Endpoint license is needed.

Once you have the EndPoint service VM, you can use vShield Manager to configure this for all the ESXi servers in you data-center  Now, you would need to go to your anti-virus vendor and get to the version of antivirus which supports the Endpoint appliance. This will allow you to migrate from the primitive methodology of anti-virus scans and make your virtual infrastructure more robust, secured and efficient.

The diagram below gives you a visualization of how this works using Trend Micro Deep Security:-

Courtesy: Trend's Website

Below is the list of the popular Antivirus vendors who have already developed a solution around vShield Endpoint:-

> McAfee MOVE Antivirus

> Trend-Micro Deep Security

> BitDefender Security for Virtualized Environment

> Kaspersky Security for Virtualization

On the Roadmap (Source: Google Search)

> Symantec Endpoint

> F-Secure

> Sophos

> Lumension

and many more to come......

VMware KB - Downloading and enabling vShield Endpoint on supported vSphere platforms

I can see that most of the existing and new security vendors would develop around Virtualization as they all understand that their products need to adopt the Virtualization and Cloud agility as well. Looking at the benefits this is a more futuristic approach of providing endpoint security in a data-center. I can see this change taking us towards the era of, Anti-Virus as a Service (AVaaS) where-in Security vendors would provide customized endpoint products to data-centers and end users as a commodity service. 

Another contribution to the Cloud from VMware. Kudos!!


***********************************************
Update to Article    Monday, December 3rd, 2012
***********************************************

As per the latest market update, Symantec today announced availability of its first anti-malware software protection that supports VMware's security architecture known as vShield, becoming the latest anti-malware vendor to do so following similar moves by Trend Micro, Kaspersky Lab and McAfee, among others.
Symantec Endpoint Protection (SEP) 12.1.2 can be used to scan, detect, block and remediate against anti-malware....

More can be read here -

http://www.networkworld.com/news/2012/120312-symantec-vshield-264655.html