When Public Cloud Isn’t Public

One of the key misnomers in cloud technology today is the idea of “public cloud”.  In our work with clients, and especially when discussing Infrastructure as a Service providers such as Amazon Web Services, we invariably have to walk some potential clients off the “public cloud” ledge.  Companies such as AWS are immediately labeled “public” simply because the public can access it.

In fact, we recently worked with a client that asked if AWS could meet the NIST definition of “private cloud.”  The answer is emphatically yes.  NIST defines private cloud as:

[C]loud infrastructure is provisioned for exclusive use by a single organization comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organization, a third party, or some combination of them, and it may exist on or off premises.
– NIST Publication 800-145, The NIST Definition of Cloud Computing, at pg. 3.

It is a simple two-sentence definition, so let us look at what is there and why AWS can qualify as a private cloud.  Quite simply, the use of the AWS Virtual Private Cloud provides the exclusivity that is required for private cloud status.  Per the AWS web site, VPC:

…lets you provision a logically isolated section of the Amazon Web Services (AWS) Cloud where you can launch AWS resources in a virtual network that you define. You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.

The client, of course, does not directly own the physical AWS hardware but the logical isolation afforded by the use of VPC allows the deployed AWS infrastructure to be exclusive to the client.

The second sentence’s key component is that the term “combination”.  In the case of the Federal Government, the combination is key.  As we encourage all of our clients to do, they should own their own account, meaning the Government owns the AWS infrastructure (above the hypervisor), manages that infrastructure, and operates the infrastructure.  If it chooses, a third party provider, such as JHC, can also handle the management and operation – the “third-party” NIST identifies.

At the end of the day, cloud knowledge continues to filter down, and we are always happy to provide as much of it as we can.  I hope that we will quickly dispel the misnomer of AWS and others as public clouds simply because the public can use the infrastructure.  Once deployed correctly, AWS and others transition directly into private clouds.

Matt Jordan is the Cloud Services Manager for JHC Technology. He can be reached at mjordan(at)jhctechology.com, @matt_jhc, or connect with him on LinkedIn.

 

 

 

AWS and Azure Pushing The Pace

Gartner Magic Quadrant for Infrastructure as a Service Cloud

During the past few years, Amazon Web Services has been the dominant player in the cloud infrastructure space, with very little in the way of significant competition. However, a quick spin around the interwebs has shown that status is starting to face some competition. At JHC we’ve been deploying solutions on AWS – from small scale to large scale – for more than four years. During that time, we’ve also kept an eye on Microsoft Azure, a platform JHC principals considered a few years ago for a key project.

As Microsoft moves rapidly forward in its cloud efforts, it’s becoming a bigger player in the space, and certainly a strong alternative to industry-leading AWS. Just recently, in fact, a customer requested that JHC use Azure to host its new global web site and we were happy to oblige. JHC is a Microsoft Certified Partner and Microsoft has always been a key point in our solutions, AWS or otherwise. We use Microsoft products internally and for our clients, hosting solutions for SharePoint 2007, 2010, and 2013 on AWS. We also have a hybrid Office 365 and AWS solution that also works well for our customers.

It all puts us in a great position as the latest Gartner Magic Quadrant report for Cloud Infrastructure as a Service came out, positioning both AWS and Azure in the Leaders quadrant. We’re thrilled at the continued success of both and look forward to leveraging AWS and Azure infrastructure to provide innovative and secure solutions for ourselves and our clients moving forward.

Matt Jordan is the Cloud Services Manager for JHC Technology. He can be reached at mjordan(at)jhctechology.com,　@matt_jhc, or　connect with him on LinkedIn.

How to protect yourself from the HeartBleed Bug?

·       Change your passwords on a more regular basis

·       Sites such as Yahoo, Github, Netflix, Amazon, Paypal Cloudfront have issues new SSL certs for their sites (So these Sites should be good to go)

·        Contact the sites in which you provide some of your most sensitive/private information (financial or not) and ask questions about Heartbleed Bug.

o   Also make sure you ask what you can do to again PROTECT yourself.

Engineers and Admins with systems on AWS please refer to the following website(s) for more information…

* Amazon Linux AMI: https://aws.amazon.com/amazon-linux-ami/security-bulletins/ALAS-2014-320/

* Red Hat: https://rhn.redhat.com/errata/RHSA-2014-0376.html
* Ubuntu: http://www.ubuntu.com/usn/usn-2165-1/

For more information about this vulnerability, please visit

* AWS Security Bulletin page: https://aws.amazon.com/security/security-bulletins/
* OpenSSL’s official advisory: https://www.openssl.org/news/secadv_20140407.txt
* The Heartbleed Bug: http://heartbleed.com/

Amazon Web Services VPN Gateway

I ran into an interesting conflict last week with AWS VPN (Virtual Private Network) Gateway.  I know there is a limitation with your AWS account that you are not allowed to have multiple customer gateways within a region having the same IP address. This would be an extremely nice feature because we would be able to connect multiple VPCs (Virtual Private Cloud) inside the same region to a single VPN device outside of AWS.  There are a lot of use cases for being able to have multiple VPCs within a region have a VPN connect to a single customer gateway device:

• Logical separation of Development and Production environments
• Logical separation of data at different classification levels for industry compliance and regulatory restrictions.
• Customer segregation

Based on this information, I thought I would be clever to create two customer gateways within the same region, but have them separated by two AWS accounts. I was able to successfully create the customer gateway and perform the VPN connection in the first AWS account.  I then went into the second AWS account and was able to create the customer gateway successfully; however, when I went to create the VPN connection I received a conflict error with the customer gateway.  Come to find out, regardless of AWS account separation you cannot successfully create VPN connections with AWS VPN gateway if the customer gateway address is being used somewhere else within a single AWS Region. 

The way to work around this issue is to separate VPCs and customer gateways across different AWS regions regardless if you have one or multiple AWS accounts.

James Hirmas is the CEO for JHC Technology.  He can be reached at jhirmas(at)jhctechnology.com,@JHC_JamesHirmas, or connect with him on LinkedIn.

Why use the Configuration Logging feature in XenApp 6.5?

The Configuration Logging feature allows you to keep track of administrative changes made to your server farm environment. By generating the reports that this feature makes available, you can determine what changes were made to your server farm, when they were made, and which administrators made them. This is especially useful when multiple administrators are modifying the configuration of your server farm. It also facilitates the identification and, if necessary, reversion of administrative changes that may be causing problems for the server farm.

Below I have provided step by step instructions on how to configure this feature in XenApp 6.5.

Step 1: Left click on "Start (push button)" in "Start"

Step 2: Left click on "Citrix AppCenter (menu item)" in "Start menu" Step 3: Left click on "SOC Farm (outline item)" in "Citrix AppCenter"  Step 4: Right click on "SOC Farm (outline item)" in "Citrix AppCenter"

Step 5: Left click on "Farm properties (menu item)"

Step 6: Left click on "Configuration Logging (outline item)" in "SOC Farm - Farm Properties"

Step 7: Left click on "Configure Database... (push button)" in "SOC Farm - Farm Properties"

Step 8: Left click on "Server name: (This will be the name of your SQL server)" in "Configuration Logging Database"

Step 9: The username specified must have db_owner permissions over the database in SQL.

Citrix recommended to use Windows authentication as it’s more secure than SQL authentication.

Step 10: Left click on "password (editable text)" in "Configuration Logging Database"

Step 11: Left click on "password (editable text)" in "Configuration Logging Database"

Step 12: Enter the password for the Windows account.

 Step 13: Left click on "Next > (push button)" in "Configuration Logging Database"

Step 14: Left click on "specify the database (editable text)" in "Configuration Logging Database"

Step 15: Specify the database created in SQL

Step 16: Left click on "Next > (push button)" in "Configuration Logging Database"

Step 17: Left click on "Open (push button)" in "Configuration Logging Database"

Step 18: left click on "No (list item)"

 Step 19: left click on "Next > (push button)" in "Configuration Logging Database"

Step 20: left click on "Test Database Connection (push button)" in "Configuration Logging Database"

Step 21: left click on "OK (push button)" in "AppCenter"

Step 22: left click on "Finish (push button)" in "Configuration Logging Database (4/4)" 

Step 23: left click on "Apply (push button)" in "SOC Farm - Farm Properties"

Step 24: left click on "OK (push button)" in "SOC Farm - Farm Properties"

Step 25: left click on "History (outline item)" in "Citrix AppCenter"

Step 26: User left click on "History (outline item)" in "Citrix AppCenter"

Step 27: User left click on "Yes (push button)" in "No Filters Specified"

Step 28: Once History is selected, choose “Get Log” under the Action column on the right hand side of the window.

Step 29: As you can see, now that Configuration Logging has been enabled changes made within the AppCenter, such as the publishing of Apps or changes to the permissions of applications or policies will be logged under the History option located within your Farm under XenApp.

David Cuevas is a Jr. Citrix Engineer for JHC Technology.  He can be reached at dcuevas (at) jhctechnology.com.

JHC Integrates AWS CloudTrail

JHC Technology has integrated Amazon Web Services' CloudTrail as a best practice for all our AWS solutions.  AWS CloudTrail is a fully managed web service that provides increased visibility into a customer's cloud solution and user activity by recording the API calls on that customer's account.  JHC utilizes CloudTrail to perform the following services in order to provide enhanced security for our AWS customers:

·        CloudTrail is the first service activated on new AWS accounts to ensure every API call is captured from the onset of the account.

·        JHC configures CloudTrail to capture both regional and Global API calls while preventing duplicate global events in the logs.

·        JHC deploys custom Identity and Access Management (IAM) permission policies on CloudTrail to prevent unauthorized access to logs.

·        JHC Enables versioning and logging on CloudTrail S3 buckets for added protection.

·        JHC deploys and configures Splunk Enterprise Instance inside customer's Virtual Private Cloud (VPC) and integrates Splunk with CloudTrail in order to gain additional insight into security related activities.

·        JHC creates custom notifications on CloudTrail S3 bucket to immediately notify customers when objects stored are lost.

 

James Hirmas is the CEO for JHC Technology.  He can be reached at jhirmas (at)jhctechnology.com, @JHC_JamesHirmas, or connect with him on LinkedIn.

JHC to be Panelist at NIST Industry Day - Dec. 16, 2013

Craig Atkinson, JHC's Chief Technical Officer has been selected to be one of the panelists that will be presenting during this year's NIST Industry Day. The event expects to attract 600 registrants from around the DC Metro area seeking to learn more about the challenges of Cloud computing in the Federal Government.

The industry day will focus on the challenges that the Federal Government is experiencing when it comes to the disruptive technology, specifically around procuring Cloud services and infrastructure. As the landscape for procuring computing power is being transformed by Cloud computing, the industry day will attempt to address the changes in the market that can assist the Government in transforming the way it procures Cloud computing moving forward. The industry day also promises to touch base on the capabilities available in the commercial market space in regards to Cloud web hosting and content management.

JHC Technology will also have a booth set up where you can stop by, meet our team and learn more about what we have cooking in the Cloud today.

The Industry Day will be held at the NIST location at 100 Bureau Drive, Building 101, Gaithersburg, MD 20899 on Monday, December 16th. To register, visit https://www-s.nist.gov/CRS/conf_disclosure.cfm?conf_id=6571