Your Portable vCloud Director Lab

How many times have you been called upon to audit, evaluate, or comment on a new technology you've never seen? As auditors we like to experiment, touch, and learn about the technologies we're assessing. Here's a fantastic way to get up to speed on vCloud Director. You can install vCD on a laptop, carry it to a team meeting, and show off the highlights.

Giving credit to the source where I first read about this - Duncan Epping's YelllowBrick blog post found here: http://www.yellow-bricks.com/2011/11/18/doing-a-vcloud-director-proof-of-concept was sent to me by Jeramiah Dooley. Both maintain blogs I highly recommend.

"...no more installing Red Hat, Oracle and vCloud Director. Just download the appliance and deploy it. On top of there is a great vCloud Cloud Director Evaluators Guide which will help you to evaluate the product.

• vCloud Director virtual appliance download (You will need to register for the eval)
• VMware vCloud Director Evaluator’s Guide

If you haven’t done anything with vCloud Director before the following articles might also be worth reading, note that these are 1.0 based articles but most of the content is still valid today.

• vCloud Director Intro
• vCloud Director Demo
• vCloud Director networking part 1, 2, 3a and 3b
• vCloud Director Allocation Models

Here is the list of resources found on the vCloud Director virtual appliance download page under Installation and Configuration. Note that these just scratch the surface of all the resources VMware offers.

Product Documentation

• VMware vCloud Director Evaluator's Guide
• VMware vCloud Director Product Documentation
• vCloud Director Installation and Configuration Guide
• vCloud Director Administrator's Guide
• vCloud Director User’s Guide

Technical Whitepapers

• Requirements for a cloud
• Service Definition for a Public Cloud
• Service Definition for a Private Cloud
• Architecting a Cloud
• Implementation Example for a Public Cloud
• Implementation Example for a Private Cloud

VMware vCloud Director Segmentation: PCI and HIPAA Firewall Controls

This came up last week and I thought I would post here to keep the information easily accessible.

Yes. You can use vCD to segment environments that are required to comply with HIPAA and/or PCI.

The firewall functions in vCD in no way preclude you from using vCD to host production Primary Account Number (PAN) or electronic Private Healthcare Information (ePHI) as long as you comply with all of the other controls required to host the information. Here are the details from the requirements along with specific comments.

PCI has an entire section devoted to firewall controls (Requirement 1: Install and maintain a firewall configuration to protect cardholder data), of which the most restrictive requirements are [1] the ability to implement ACLs, and [2] SPI/Dynamic Packet Filtering.

Link to Data Security Standard | Link to Navigation Document 

Requirement 1.3.6 

Verify that the firewall performs stateful inspection (dynamic packet filtering). (Only established connections should be allowed in, and only if they are associated with a previously established session.) 

HIPAA has specific segmentation requirements for health care clearinghouse functions found here. Although they are specifically called out as Administrative Controls, the definition for this bill is defined as:

Link to 45cfr164.304 

Sec. 164.304  Definitions 
Administrative safeguards are administrative actions, and policies  and procedures, to manage the selection, development, implementation, and maintenance of security measures to protect electronic protected  health information and to manage the conduct of the covered entity's workforce in relation to the protection of that information. 

Note the lack of any detailed requirements – intentionally – to allow a broad range of solutions to fit the requirement.

Link to 45cfr164.308 

164.308(a)(4)(ii)(A)

(ii) Implementation specifications:

    (A) Isolating health care clearinghouse functions (Required). If ahealth care clearinghouse is part of a larger organization, the clearinghouse must implement policies and procedures that protect the electronic protected health information of the clearinghouse from unauthorized access by the larger organization. Sec. 164.304 Definitions