Leveraging Oracle Solaris Security and Performance ... · PDF fileSolaris11.1 Solaris 11.2 Solaris 11.3 Solaris 11.4 Solaris 11.5

Copyright©2017, Oracleand/oritsaffiliates.Allrightsreserved.|

LeveragingOracleSolarisSecurityandPerformanceBenefitsinOracleCloud[GEN7018]

BillNesheimVP,OracleSolarisEngineering

October2,2017


SafeHarborStatementThefollowingisintendedtooutlineourgeneralproductdirection.Itisintendedforinformationpurposesonly,andmaynotbeincorporatedintoanycontract.Itisnotacommitmenttodeliveranymaterial,code,orfunctionality,andshouldnotberelieduponinmakingpurchasingdecisions.Thedevelopment,release,andtimingofanyfeaturesorfunctionalitydescribedforOracle’sproductsremainsatthesolediscretionofOracle.


SolarisProductDirectionContinuousDeliveryofSecurity,StabilityandSoftwareEnhancements

SeamlessUpgradesEnableAgileIncorporationofNewCapabilitieswithGuaranteedCompatibilityfor1,000’sofOracle,ISV,andCustomerApplications

SmallerMore

Frequent

LessDisruptive

Quicker

Simpler

SolarisContinuousDeliveryModel

HighRisk Complex Disruptive

LegacyMajorReleasesSlowAdoption

SlowandExpensiveRe-Qualifications


Yoursecurefoundationforcloud-readyenterpriseUNIX™innovationOracleSolaris11

HWbasedapplicationprotectionTimeandrolebasedaccessmanagementImmutableVMs;integratedcompliancevalidation

EngineeredforOracleDB&EnterpriseApplicationsZero-Overhead,SecureVirtualizationExtremeScalability

1-Stepnetworkbasedupdate&rollbackContinuousdeliveryBuiltinmigration,archivalandrecoverytools

OneOS,anycloud1000’sofapplicationsApplicationBinaryGuarantee


Ourcommitmenttoapproachableinnovation

T4 T5, M5,M6 M7 S7 M8

ASLRSvcbundlePeruserauth.

KernelZonesPTP

DAX,SSM,Compliancereporting

PF,KMIPMulti-factorauthentication

Much moretocome!

Solaris 11.1 Solaris11.2 Solaris11.3 Solaris11.4 … Solaris11.5…

Solaris112011 2012 2013 2014 2015 2016 2017 2018 2019 2020

7+yearsandcountingofseamlessinnovationdelivery#pkg update

SolarisBinaryCompatibilityprotectsyourapplicationsoftwareinvestment


SolarisContinuousDelivery

• Security– KMIP–Multi-factorauthentication– SSMenhancements– Packagesigningenhancements–MITKerberosV5update->14.4

• OracleDatabaseIntegration–OICforDatabase12.2– eXtended ReliableConnectedTransport

• Platform– SPARCM8,FujitsuSPARCAthena++– IntelSkylake– Broadcom25Gb,Intel10GbEEthernet– DAXAPIsforSPARCM7,M8

• Diagnose-ability&Maintain-ability– FastSRIOVI/Ofailover– SCSItracing–Watchpoints viaSSM

Newcapabilitiesdeliveredinrecent11.3SRUs


]

ThreePillarsofCyberSecurity


Solarispreventsabuseormisuseofcredentials

Multi-FactorAuthenticationStandards-basedOne-TimePasswordandSmartCardsupport

ControlledSystemAccessLeastprivilegemodelwithtime,roleandfilebasedauthorizationlimits

RemoteAuditing,LoggingandAlertingPer-objectauditing;tamper-proofremotelogging

CloudSecure


]

Solarishelpsyoumaintainasecureplatform


Source:VerizonDataBreachInvestigationsReport,2016

KnownVulnerabilitiesareRegularlyExploited

74%

OFORGANIZATIONSTAKE3MONTHS+

TOPATCH


SolarisDeliversSafe&SimpleSystemUpdates• SolarisImagePackagingSystem

– Repositorybaseddistributionoverthenetwork

– Automaticdependencymanagement– IntegratedupdatesofOracleSolarisZones

• BootEnvironments– BasedonZFSsnapshotsandclones– Enforcesbestpracticesforsystemupdate– Fasttocreate,zerocost– 100%reliable

• OracleCPUprovidespredictableupdateschedule

CloudSecure


AgeOldProblemsofBufferOverflowandMemoryCorruptionSolvedSolarisonSPARCProtectsDatainMemory

Memory

Pointer

SPARCProcessor

H/Wcomparespointer�key� withmemory

“lock”

• Prevents3oftheTop5Zero-Dayattackvectors

• Always-onprotectionfortheOracle12cSGA&PGA

• Fullycompatiblewithexisting64-bitapplications

• StudioDiscovertooldeliversmemoryboundscheckingwithoutperformancepenalty

CloudSecure


Cloud-ScaleComplianceReportingSimple&TailorableWaytoVerifyProtection

CloudSecure


]

Solarisgivesyouthetoolstofullyprotectyourdata


FrequencyofDataRecordTheft

EVERYDAY

3,618,139Records

EVERYHOUR

150,756Records

EVERYMINUTE

2,513Records

EVERYSECOND

42Records

InHealthcare,datatheftcostsaround$200,000everyminute

Source:breachlevelindex.com


EncryptEverything,Everywhere,AlltheTime

• Fastest Cryptography intheindustry• State-of-the-artalgorithmswithPKCS#11v2.40• Noperformanceloss• Automatically acceleratesJava,OracleDatabase,OpenSSL/TLS,andcustomapplications

• Meetcompliancewithhighperformancediskencryption

• Interoperatewithany KMIP-Compliant KeyManagementServerincludingOracleKeyVault

Protectedatrest,inmotion,andinmemory

Applications

Java

OracleDatabase

OperatingSystemUtilities

Storage

Virtualization

Firmware

AffordablyCloudSecure


ProtectDatathroughouttheVMlifecycleContinuousprotectionwithOracleSPARC&Solaris

LiveVMs inTransitareFullyEncrypted- NoServiceLoss- NoPerformanceLoss

VM

VM

VM

VM

VM

VM

VM

VM

VM

VM

VM VM

VM

VM

VM

VM

CloudSecure


AdvantagesofOracleSolarisforOracleDatabase

• ResizingSGAwithnodowntime

• 22xfasterDBStartupandShutdown

HighAvailability

• Memoryusageprediction

• Dramaticallysimplifieddataadministration

Utmostflexibility

• MemoryoptimizationsforOracleDatabase

• GuaranteedQualityofService

RealTimeAnalytics

• Embeddederrordetection

• Real-timedatareplication

CompleteIntegratedSolution

CloudEfficient


FindI/OOutliers• AddedDTrace I/OEventTracingtoOracleDatabase12c

• V$viewsforsimplequeries• Avoidcomplexandtime-consumingreportsnapshotanddiagnosis

v$kernel_io_outlierTIMESTAMPIO_SIZEIO_OFFSETDEVICE_NAMEVARCHAR2(513)PROCESS_NAMEVARCHAR2(64)TOTAL_LATENCYSETUP_LATENCY

…

Seedemoat:https://blogs.oracle.com/solaris/entry/database_12c_and_solaris_dtrace

SimpleDatabaseI/ODiagnosisandTuning CloudEfficient


4 VirtualMachines4 Virtual

Machines

26%

4 VirtualMachines

MostEfficientEnterpriseVirtualization

• ZeroOverheadVirtualization– builtin!

• Applicationsrunasfastasbaremetal

• Virtualizeanyapplication,notjusttheeasyones

• Virtualizationbydefault

+ +

VirtualizationPerformanceLoss

SPARC + VM + SolarisC+VM+S

~1%4 Virtual

Machines

VMSoftware

CloudEfficient


YOURAPP

Simple,SecureCloudScaleDeploymentandComplianceFromDevelopmenttoProduction

Securedeployment

SetCompliancePolicy

ComplianceAudit

CreateyourapplicationVMs

1-stepsecureimagecreation

CloudAgile


OracleSolaris11

Built-inInvestmentProtection

V2V

P2V

OracleSolarisZonesSystemPreflight

Checker

• 20+yearsofbinarycompatibility– ApplicationsjustworkonnewerSolarisreleases

• Fast&simplemigration:– Reduceriskwithautomatedchecksbeforeyoumove

– Toolsmoveyouquicklyandsimply

–MigrateyourS10environmentsinminutes

Solaris10Zone

FUSIONAPPLICATIONS

OracleSolaris10

Solaris10Zone

DATABASE

DATABASEOracleSolaris10

SolarisZone

FUSIONAPPLICATIONS

CloudAgile


PrivateCloud&EnterpriseSystemsOracleCloud Cloud@Customer

OracleSystemsTechnologiesPowerAllOfOurInfrastructure

Servers– Storage– Networking– Virtualization– OperatingSystemsDevelopmentTools– ManagementTools

SameTechnology,SameArchitecture,SameSkillSets


Availabletoday!

SolarisinOracleCloudInfrastructureClassic

• VirtualMachineCompute(x86)

• DedicatedCompute(x86)

• DedicatedCompute(SPARC)


OracleLifetimeSupport

• PremierSupport– ProvidesmaintenanceforyourOraclehardwareandintegratedsoftware(forexample,firmware).MaintenanceandsoftwareupgradesareincludedforOracleoperatingsystemsandOracleVMfortenyearsfromtheirgeneralavailabilitydate- extendedto20yearsforSolaris11

• ExtendedSupportforOperatingSystems– PutsyouincontrolofyouroperatingsystemupgradestrategybyprovidingadditionalmaintenanceandupgradesforOracle

Solarisoperatingsystemforanadditionalfee

• SustainingSupportforOperatingSystems– Maximizesyourinvestmentprotectixon byfurtherextendingsupportforoperatingsystemsandfirmware.Featuresinclude

accesstoOracleonlinesupporttools,operatingsystemupgraderights,pre-existingfixes,patchesandassistancefromtechnicalsupportexperts

HardwareandOperatingSystems

Detailedinformationavailableonline:http://www.oracle.com/us/support/lifetime-support/lifetime-support-hardware-337183.html


ContinuouslymaintainedOpenSourceSoftware• PopularOpenSourceutilities,services,productivityanddevelopertoolsthatcomplementyourOracleSolarisdistribution– Built,maintained,signedanddeliveredbyOracle

• >15003rd partycomponentsaredeliveredwithSolaris11– 148componentsupdatedinSRUsincereleaseofSolaris11.3– 543additionalcomponentstobeupdatedinSolaris11.4

• SelectedupdatedcomponentsareregularlymadeavailableforevaluationviatheSolaris“pre-release”repository


CominginSolaris11.Next…

• Security– EnhancedexploitmitigationwithSPARCSSM

– TrustedServicesviaSMF

• DataManagement– Compressed&resumable replication– Scrubscheduling– Asynchronousdatasetdestroy

• Deployment– Agent-lessconfigurationandmanagementviaREST

– ConfigurationatScaleviaPuppetorChef– ScalableZoneBootEnvironmentManagement

• Networking– 802.1x– NetworkconfigurationviaSMFandAI

SolarisInnovationcontinues

Andmuchmore!


• LongTermInvestmentProtection–OracleSolaris11Supportthroughatleast2034

• Easy-to-applyUpdateStream–Monthlysupportupdates–QuarterlyCriticalPatchUpdates

• 20+yearhistoryofGuaranteedApplicationBinaryCompatibility

• LifetimeSupportforOracleSolarisLegacyenvironments

• Secure,uptodatePlatform– Includesmorethan1500regularlyupdatedwidelyusedopensourcepackages

• Built-inon-prem andcloudplatformmigrationtools

• ContinuousInnovation– NewHWsupportandproductenhancementsincludedinmonthlysupportstream

TheOracleSolarisPromise


AdditionalSystemsContentNotToBeMissedSessionTitle OracleSpeaker Date/Time LocationGEN6456StrategiesforBuildingOpen,Cloud-ReadyInfrastructure

AjaySrivastavaSVP,OS&VMDevelopment

Monday,Oct022:15 PM - 3:00PM

MarriottMarquis(GoldenGateLevel)-GoldenGateA

CON6296LiftandShiftYourOracleSolarisWorkloadstotheOracleCloud

ScottDickson,PeterWilson

Monday,Oct025:45PM- 6:30PM

MarriottMarquis(YerbaBuenaLevel)-Salon13

GEN7353SPARCSystemsUpdate– AdvancingtheSoftwareinSiliconRevolution

Masood HeydariSVPSPARCDevelopment

Tuesday,Oct0311:30AM - 12:15PM


GEN6459OracleLinux– StateofthePenguin

Wim CoekaertsSVPOS& VMDevelopment

Tuesday,Oct0312:45PM- 1:30PM


ComemeetdevelopmentexpertsintheITInfrastructuredemoareainMoscone West


Leveraging Oracle Solaris Security and Performance ... · PDF fileSolaris11.1 Solaris 11.2 Solaris 11.3 Solaris 11.4 Solaris 11.5

Documents