In today’s digital landscape, cybersecurity threats are constantly evolving, and organizations must adopt advanced solutions to stay ahead of malicious actors. VMware’s vDefend Network Detection and Response (NDR) emerges as a robust solution designed to safeguard enterprises against sophisticated cyber threats. This blog explores the features, benefits, and real-world applications of VMware vDefend NDR.
What is VMware vDefend NDR?
VMware vDefend NDR is an integrated cybersecurity platform that provides advanced threat detection and response capabilities for network environments. It leverages machine learning, behavioral analysis, and real-time threat intelligence to identify, block, and remediate cyber threats across the data center landscape
Designed to enhance an organization’s network security posture, vDefend NDR seamlessly integrates with VMware’s existing virtualization.
Key Features of VMware vDefend NDR
Real-Time Network Threat Detection:
vDefend NDR utilizes advanced machine learning algorithms and behavioral analytics to detect anomalies and malicious activities across network traffic in real time.
Threat intelligence feeds from global sources enhance its ability to identify emerging network threats.
Automated Incident Response:
Integration with VMware’s NSX platform allows for precise micro-segmentation and enhanced network security.
Benefits of VMware vDefend NDR
Enhanced Network Visibility:
Gain unparalleled visibility into network traffic and behavior.
Centralized dashboards provide actionable insights and facilitate proactive threat management.
Reduced Response Time:
Automation and orchestration reduce mean time to detect (MTTD) and mean time to respond (MTTR) to network incidents.
Conclusion
In an era where cyber threats are more sophisticated than ever, VMware vDefend NDR provides a powerful, integrated approach to securing modern networks. By combining advanced detection, automated response, and multi-layered protection, it empowers organizations to defend against evolving threats and maintain resilience in the face of cyber challenges.
Invest in VMware vDefend NDR to protect your network assets, ensure regulatory compliance, and secure your path to digital transformation.
Domain Generation Algorithms (DGAs) are methods used by malware to generate numerous domain names for communication with command-and-control (C&C) servers. This approach allows attackers to bypass detection mechanisms that block specific domain names or IP addresses.
The DGA process includes:
Algorithm Implementation: The malware incorporates a DGA algorithm.
Seed Value: The algorithm uses a seed value, such as the current date, to start domain generation. Domain Generation: It applies mathematical operations to the seed value, producing a random domain name.
Domain Resolution: The infected device tries to resolve the generated domain name. C&C Communication: If resolved to a legitimate C&C server, communication is established.
Key Characteristics include:
Large Domain Space: DGAs can generate numerous domain names, complicating blocking efforts.
Dynamic Generation: New domains emerge periodically, challenging existing security measures.
Evading Detection: By frequently changing domain names, DGAs evade traditional detection.
Resilience: Blocking some domains does not hinder communication through others.
Volume of Domains: The large number of generated domains makes complete blocking impractical. Legitimate-Looking Domains: Some domains closely resemble legitimate names, complicating detection.
vDefned Mitigation Strategies involve:
Dynamic DNS Blocking: Quickly blocking newly registered malicious domains.
NTA Behavioral Analysis: Detecting malicious activity based on behavior, regardless of domain.
Threat Intelligence Sharing: Sharing knowledge of known DGA families to enhance detection.
Sandboxing and Virtualization: Analyzing suspicious files in a controlled environment.
Machine Learning: Identifying patterns in DGA-generated domains and anomalies.
A comprehensive understanding of DGA principles and a multi-layered defense strategy enable organizations to mitigate threats from these advanced malware techniques.
When diving into the intricacies of the MITRE ATT&CK Framework alongside the powerful vDefend NTA (Network Traffic Analysis), detecting a multi-stage attack can be both a thrilling challenge and a vital mission. Here’s how you can embark on this critical journey:
Embrace the MITRE ATT&CK Framework: Immerse yourself in the world of tactics, techniques, and procedures (TTPs) wielded by attackers. This knowledge is your weapon, empowering you to pinpoint potential indicators of compromise (IOCs) that are crucial in recognizing the complexities of multi-stage attacks.
Create Your Baseline: Harness the capabilities of vDefend NTA to scrutinize your network traffic and establish a detailed baseline of normal activity. This foundational understanding will serve as a key to unlock the detection of anomalies that could signal malicious undertakings.
Vigilantly Monitor Traffic Behavior: Keep a watchful eye on your network for any unusual patterns. Seek out the unexpected connections to foreign IP addresses, strange protocols in play, or sudden spikes in data transfer. With vDefend NTA, you can visualize these telltale signs, turning data into actionable insights.
Correlate Events with Precision: Leverage threat intelligence to interconnect the events observed by vDefend NTA with the well-documented TTPs of the MITRE ATT&CK Framework. Delve into the stages of the attack—be it initial access, execution, or persistence—by analyzing the activities as they unfold.
Detect and Respond with Urgency: Implement robust detection rules that are finely tuned to the identified tactics and techniques. For instance, should a credential dumping technique rear its head, launch an immediate investigation into potential lateral movements or privilege escalations.
Commit to Continuous Improvement: Following an incident, engage in a rigorous post-mortem analysis to unravel the events leading to the attack. Use these insights to refine and enhance your detection capabilities, ensuring you remain at the forefront against evolving TTPs. By weaving together the MITRE ATT&CK Framework with vDefend NTA, you can dramatically elevate your prowess in detecting and responding to the formidable nature of multi-stage attacks—an endeavor essential for safeguarding your digital landscape.
Example of Traffic Behavior Lateral Movement with Remote Services:
I keep asking myself, is fatigue of hearing about ransomware setting in?
It is understandable if fatigue is setting in, but it can not be stressed enough how important this topic is.
Why is it important? Is it the 4000+ attacks a day? That there is a successful attack rate every 11 seconds or the $20B+ damage in 2021?
Nope, the why is “Your data has value, and your data can cause harm to your business, employees, and customers.” I tell customers, “A Ransomeware attack is as devesting or more devesting than a disaster.”
That brings us to my 1st lesson learned; I can recall a customer over ten years ago that lost its infrastructure to what would now be considered a simple malware attack that formated C:\. This month, I worked with a customer hit with a more sophisticated attack that corrupted all VMFS volumes and destroyed Active Directory infrastructure. The common thread was the sheer panic of how do I recover? Have we not advanced in this space over the last decade?
Thre is an endless array of recovery technology that backups and recovers applications from VMware Cloud Disaster Recover to Veeam. The technology is there, but the process is not in many cases.
Have Immutable Backups Ready
Practice, Practice, Practice Recovery!
Not sure saying practice three times is enough; the ability to recover promptly is the number one thing you can do to protect your business from data loss and paying a hefty ransom.
Now Lets Talk about where Ransomware is toady.
Ransomware is no longer just a single attacker; it is full fledge business to make profits, including distributing the technology to anyone willing to pay them a percentage of the ransom.
Double exfiltration is now common in all attacks. Let’s put that in context, and the attacker will extract your data and then either encrypt or destroy your infrastructure and data. Attackers want to have the only copy of your data, enhancing your chances of paying for it.
Security Is A Team Sport
Let’s talk about protecting your data; this is a vast topic covering multiple technologies, governance, and compliance entities.
My last couple of blogs covers layered network defense and NIST compliance. I will sum it up by saying layer your network defense from the perimeter to the data source with micro-segmentation.
Identity Management is a critical protection for your data; 76% of attacks gain privileged access to carry out and avoid detection. Limiting privileged access is a massive step in the right direction.
Endpoint Protection with NGAV and EDR has become 1st thing people think of when it comes to ransomware protection. For a good reason, this is where attacks start. The ability to see unusual behavior between correlated endpoints is as powerful as seeing unusual behavior on IPS/IDS software on the network. To be clear, one is not better than the other they complement each other in a holistic approach.
As we advance in reading telemetry data from both EndPoint Detection Response (EDR) and Network Advanced Threat Protection (ATP) with different ML/AI techniques, we can detect and prevent a large number of attacks. The cynical side of me worries that now Ransomeware is a well-funded business because our attackers will also gain the advantage of ML/AI.
Will you allow your assets escape.
Let’s not forget the basics of IT hygiene. updates, patching, following security guidelines from each vendor. Remember to trust but verify; make sure you check to ensure these guidelines are followed and updated. Early we talked about privileged account access making up 76% of attacks, and doing IT Hygiene will help stop the other 24%.
In summary, assess your security gaps, layer in process, and technologies for Endpoint and Network Protection. Protect and recover your data! Practice, Practice, Practice recovery!
To close out, I want to share one last word of wisdom “Security is a team sport.” It takes every employee in a business to ward off today’s attackers.
For many years we used the build castle analogy to secure your environments. Is it time for a change?
In today’s world, where we have malicious actors attacking your datacenters every minute of the day with various attacks from Malware to Ransomware, to name a few, we need to protect and detect these acts before they cause harm.
NSX-T 3.2 needs to be a vital part of protecting and responding to attacks from malicious actors.
Let’s start with the outer haul of your cargo ship, your perimeter security. The haul has physical security, of course, and communication, a.k.a network security that uses a next-generation firewall (NGFW) that secures data transmission.
Special Note: Drawings are simplified
There are many techniques used to build this haul that we can cover later. Let’s stay with the analogy, keep it super simple (KISS) and add some floors to this ship. My thought process is to use hardware-based NGFW to control communication/traffic flows between the floors. Wait, I thought this was a blog on protection with NSX-T 3.2; rest assured, we are getting there. KISS right? You will not change or rebuild floors of your ship very often, if ever, so let’s create zones( AKA floors) where security enforcement at hardware-based NGFW.
Special Note: When it comes to mixing HW and SW with various protect techniques, you want to KISS and gain the advantage of looking at traffic in multiple ways and giving flexibility in protecting your most valuable assets.
Now let’s introduce NSX-T 3.2, which brings the control points closer to the applications (AKA Cargo) where you can configure or reconfigure cargo holds. Let’s think about that for a minute, the ability through automation and manual software changes can change behavior and control points. I am now thinking about Network as a Service (NaaS) or Security as a service (SecaaS). We can create a new cargo configuration in test and development before applying it to production.
With the distributed model expanding beyond Distributed Fire Walls (DFW) or Internal Segmentation Firewalls (ISFW) are now Distributed Next-Generation Firewalls (DNGFW). With the integrations from the Lastline acquisition, NSX-T 3.2 can provide distributed Advanced Threat Prevention (ATP) with malware prevention for known and zero-day malware. Distributed behavioral IDS looking for pattern matches and other anomalous traffic.
Ok, let that sync in for min; let’s talk about more distributed goodness! Network Traffic Analysis to see lateral movement anomalies. Network Detection and Response (NDR) to help provide relief from alert overload with MITRE ATT&CK visualize campaign view.
You end up with a cargo ship with disturbed security to protect and detect malicious attackers. Look at all those reconfigurable doors and control points I have negative now as a malicious attacker.
DNGF protection is closest to the source.
We have covered one way to protect with NSX-T; we touched on detect. We will dive deeper into detecting using telemetry and management tools soon. We will also cover using Carbon Black to respond and different recovery strategies. Stay tuned to hear more about VMware Security or reach out and ask how VMware can help secure your business.
With recent cyberattacks across the world, it is essential to have a solid design for security. VMware has recently bought multiple security solutions to help create an intrinsic security portfolio. I will always contend that security solutions should have numerous vendors, so let’s use Cisco to do the switching and routing with ACI in network-aware mode and Palo Alto firewalls with Panorama.
In today’s modern data centers, the number of physical devices is shrinking to under 3% of total servers. We still need to account for them in our design from both network and security perspectives; of course, the virtual environment will need hosts and storage to run on. Let’s start with Cisco fast switching transport underlay.
Using typical spine and leaf architecture for the switching underlay, let’s set up ACI zones with VRFs following the Purdue model.
Internet-facing DMZ – Zone 5+
User Networks – Zone 5
DataCenter – Zone 4
IDMZ – Sub Zone of 4 some will call it 3.5
OT – Zone 3 and below is not part of this design.
All traffic within a single zone will East/West traffic and have further segment and security controls via NSX. All traffic between zones with travel North/South and will pass through the Palo Alto Firewall. These zones are overlay constructs that will provide the underlay for NSX.
ACI Zone will host all physical devices, including server hardware for ESXI, NFS Storage, EUC devices, and other legacy items like LPARS. ACI is switching fabric, and the only way to secure devices is through ACLs. A good thing change rate for physical devices is tiny and is an exception to the rule that requires either manual configuration or custom-built automation. If the change rate is low, 2-3 changes a year, I recommend a well documented manual process.
Now let’s add in NSX; we will start with edge cluster and T0s for management, data center, and the IDMZ. The T0s will route traffic to the corresponding ACI Zone. The edge device can provide stateful firewall services to help further segment the workloads. If attackers were to gain access to the ACI zone, they would not have access to corresponding NSX networks.
Now we can do some exciting things; we can create multiple T1’s to create more separate and secure networks with stateful firewalls and transport zones to control who can talk to who. In this case, we will use HR, FIN, and Call center for the use case, but you could replace ACI zones or create DMZ’s all within NSX. We will generate transport zones so the HR can talk FIN but not Call Center, and Fin can talk to Call Center. We have now created smaller attack services, making it difficult for attackers to move around your network.
So I have an ACI zone that layers above my physical switch’s that can’t see the NSX network without passing through a stateful firewall. If the attacker gained access to inside T0, the T1’s would provide another control point, and beyond that, transport zones can restrict access further.
Let’s add the last layer, Microsegmentation, by using DFW. Firewall as close to source VM as possible at the hypervisor! A distributed firewall that travels with VM to secure the application. Let’s count the doors the attacker has to get through now:
Perimeter Firewalls
ACI Zone
NSX T0
NSX T1
DFW (Microsegmation)
That’s a lot of doors to open and a lot of firewall rules to manage. Let’s walk through how we can manage this potential operational nightmare.
Let’s simplify things to start doors, one through four rule sets should not change often. These doors rule sets only change when making changes at physical or infrastructure levels. Changes to door three and four (T0/T1) can be day two actions in vRealize Automation (vRA).
DFW is applied through security tags that can be used both on VM creation in vRA or as an onboard process. Tags are added in the cloud template and have portable ymal code for new VMs. A workflow will need to be created to add security tags to an onboarded VM.
Ok, so I can manage the addition and change though policy and tags for my VMs, how do I get a handle on all the rules I need to make? Two ways you can use vRNI to generate a report on ports and protocols for each of your applications or use NSX Intelligence that will make rule suggestions inside of NSX that you can apply. Yes, that is right, rules are given to you apply within NSX!
Ok, this sounds great, but how do I make sure network and security policies are in a known good state? How can I visual see my entire network? I need to be able to do this across virtual, physical, and even my SD-WAN.
No problem! Let me introduce you to vRNI with SD-WAN and visibility/assurance. With these two add ons, you will get a visual of the entire network! Virtual, Physical, and even SD-WAN is giving you a complete view of your network. Assurance will allow you to see changes in the whole network on 30 min intervals. An attacker or Jr network admin change an ACL in ACI? Get an alert so you can react or trigger an automation to change your configuration back to a gold standard.
vRNI has grown-up other ways it can be useful is for vRNI to tell vROPs about application groups or use HCX fling to create application move groups for migration with HCX.
You can see deep security posture and the ability to monitor and assure you are in a known good state. Now let’s talk about Advance security with IPS/IDS and Carbon Black.
To honestly say we covered 6 of 12 MITRE attacks tactics, we have to add AVI and WAF for credential access to our applications. We were now adding NSX IPS/IDS for real-time deep packet inspection, automatic signature updates, and giving you the latest defense to alert on and drop or reject traffic.
Wow! 5 doors to unlock and security to catch attackers in the act; I feel safer now. But what if someone does get through to an endpoint?
Carbon Black can help with Next Generation anti-virus with anomaly traffic detection that can stop malware, ransomware, and next-gen attacks in their tracks. EDR can provide seamless detection through threat hunting and containment. Carbon Black cloud will inspect devices and track and report on a drift. Say an attacker broke through all the security above, you have a way to see what was touched to respond appropriately.
Well, there you have intrinsic, intent-based security from VMware. The best news is this just the start with recent acquisitions, LastLine and Salt Stack. The Intrinsic and intent-based security story from VMware is only getting started.
NIST 800.82 R2 builds an overly to NIST 800.53 R4 standard. A fundamental approach is to enable communication between an Industrial Control System (ICS), and a corporate network is through intermediate DMZ. The ICS and corporate networks should never communicate directly with each other. A typical architecture for this is the Purdue model using network zones.
General security best practice is that a single product, technology, or solution can not adequately protect ICS. Using a multi-layer strategy utilizing a minimum of two security tools is advised. With tools, we still need to have adequate security policies, incident response, and physical security. The greatest threat is still hacking the human element; security training is critical if not more critical, than any toolset.
As the technology landscape changes, so do prevalent standards to protect ICS. This year, NIST 800-207 was finalized, paving the way for Zero Trust Architecture (ZTA) to protect ICS.
Goal:
To build security architecture with a multi-layer strategy based on NIST 800-82 R2 with an extra overlay of protection based on NIST 800-207 (ZTA)
Toolset:
One of VMware’s key building pillars is Intrestic security and a rich toolset consisting of NSX-T, NSX Advanced Security, AVI, and Carbon Black that are supported by VCF (SDDC Manager) and vRealize Suite (vRA, vLI, vIDM, vROPS). You might be asking your self where is vRealize Network Insight (vRNI). This tool is great but currently does not come with VCF or vRealize Suite; it is considered an add-on.
As complete of a vision VMware has with Intrestic security, it does not cover all use cases. Natural partners are Cisco and Palo Alto. Cisco’s rich toolset includes Cisco ACI, Cisco Stelathwatch, Cisco ISE, and Cisco DNA, with Palo Alto’s Panorama rounding out the typical solution set.
Layered Intrinsic Security:
This toolset has overlapping, and some might say competing technology. I see it more layered defense approach with best breed technology at both the physical and virtual layers.
The diagram below will capture the use case of using the toolset to achieve this blog’s stated goal.
Disclaimer: I did not depict the internet DMZ; this architecture is based on the Purdue model but is not certified by any regularity governance body.
Conclusion:
By preventing direct communication between IT and OT systems and having a broker service in the IDMZ relay the communications, an extra layer of separation and inspection adds to the overall architecture. Systems in the lower layers are not directly exposed to attacks or compromise. If something were to compromise a system at some point in the IDMZ, the IDMZ could be shut down, the compromise could be contained, and production could continue.
This blog focused on the toolset and some of the primary controls to finish the complete design, including operational playbooks I encourage you to read:
VMware vSphere 7 was released April 20th, 2020, and is approaching its 1st milestone of 6 months since GA. My experience tells me you can count on two things:
1) Update 1 proceeds the GA release of VMware vSphere by about 6 months.
2) Customers tend to wait for Update 1 before they install a new version of vSphere in production.
We are approaching the timeframe where more VMware customers will deploy vSphere 7 and might want to take advantage of using Kubernetes.
A requirement for VMware Cloud Foundation 4.x (VCF 4.x)
Customer Question:
This always prompts the question of why do we need VCF 4.x?
Answer:
K8 deployments require NSX-T VCF 4.x is 1st version of VCF that uses NSX-T in the management and workload domains; by making VCF 4.x a requirement, VMware has validation that a customer has NSX-T deploy in a configuration that will support Kubernetes.
Customer Question:
Ok, I have VCF 4.x deployed, I am excited to deploy Kubernetes for my development team, but I have to ask is there anything else we need to do before we start?
Answer:
Yes, one more thing you need to license your clusters to use Kubernetes Licensing for vSphere with Kubernetes the critical piece of information here is:
Assign a VMware vSphere 7 Enterprise Plus withAdd-on for Kubernetes license to all ESXi hosts that you want to use as part of a Supervisor Cluster.
Yes, you need to purchase the add on the license to run Kubernetes in production.
Customer Question:
I bought an Add-on license. Can we now deploy Kubernetes?
Answer:
We should have an Architical session before we deploy where we can make decisions on:
What Workload Domain (WLD) should we use for the supervisor cluster?
We can talk about how vCenter inventory has changed now that you enabled your first WLD.
I will cover these topics during my series of blogs on VCF; stay tuned!
In the 1st blog of this series on VCF, I talked about why VCF is important to VMware and VMware customers. I will cover three use cases:
Minimal install
VCF 3.10.x with manual guidance for vRealize Suite 2019
VCF 4.x
Minimal install:
Most common use cases:
Horizon, Emergency Capacity, Microsegmtation, and Deep Cisco ACI shops plan on using combination ACI Multisite, Cisco VMM, and other Cisco products.
What is a minimal install?
It is an install that provides the foundation for Management Cluster and the first workload domain (WLD). The required products are vSphere, vSAN, and NSX. Can I hear you thinking, “NSX? Thought ACI was one of the big use cases.” Correct, NSX, and ACI can be very complimentary, and we can deep dive use cases of NSX with ACI at another time.
Back to VCF, as talked about in my last blog post, the significant advantage of VCF is standardization and predictability, so yes, NSX is required to provide a predictable transport network for the management and workload clusters. The install of NSX and only the transport network are needed; you do not need setup Application Virtual networks (AVN).
About the digram:
You can see from the picture below can you will have run NSX-V with ESG in the management cluster and either NSX-V ESG or NSX-T T0/T1 with vTEPs and transport layer. You do not need to configure routing.
VCF 3.10.x with manual guidance for vRealize Suite 2019:
Usecase: VCF 3.10.x with vRealize Suite 2019
Due to direct customer feedback, this use case where customers needed to start with vRealize Suite 2019 to harness all the new features of vRealize Automation 8 (vRA, 8.x) and vRealize Operations Manager 8 (vROps 8.x).
I can see you asking me, ” Wait, why can’t I install base VCF and then vRealize 2019?” You can! That the actual manual guidance for this deployment. Yes, I said manual guidance, let me walk you through why.
VCF is automated installation services that deploy VMware Validated Design (VVD); with set Bill of Materials (BOM). In 3.9x, the automation would deploy vRealize Log Insight (vRLI) and the vRealize 7 suite. VCF 3.10.x is an update to 3.9.x, not a BOM change. Still, customers demanded the support of vRealize Suite 2019, so VMware created the manual guidance to install vRealize Suite 2019 outside of VCF automation with the deployment of LCM that could support vRealize Suite 2019. In this case, you should have two LCM’s instance on to support vRLI and one to support vRealize Suite 2019.
About the digram:
In the first diagram, the focus was at the NSX level, for this digram I wanted, to show and focus two key items. The fact you need two LCM managers, and you will wish to setup log forwarding from Loginishgt 4.8 to 8.x. Remember,you will deploy vRealize suite 2019 from LCM 8.x that you manual deploy. The other item of note is vXRail manager for each WLD, remember that for future designs and blogs.
VCF 4.x
Usecase: Greenfield with no technical debt and is ready for CI/CD upgrades.
VCF 4.0 brought some significant changes, vSphere 7.0, automated install of vRealize Suite 2019, and NSX-T 3.0 in both the Management and workload domains. 4.0 release date April 2020 was before VCF 3.10.x in May of 2020. Please be mindful of these days as End of General Support for VCF products is one year after release.
VCF 4.0 is 1st release of VCF where almost all technical debt had to be removed, and every product was working on Photon OS. Now that VMware is ready to start the CI/CD journey with VCF!
You will see VMware coming out with releases much faster with goal launch new release every four months. That is faster than many customers are used to but still slower than a two-week release cycle for VMware SAS offerings.
It is critical to building a new greenfield data center with VCF from today in the future, that starts with VCF 4.x in mind.
About the digram:
4.x has few significant changes, one, of course, is the BOM that includes vSphere 7. The other is NSX-T in both the MGMT and WLDs! I also want my reads to note that included Spines in this diagram. I want every to start to think where you would peer NSX at ToRs? At that Spine? Somewhere else? In my next blog, we begin to explore this subject and build up to how NSX and ACI work together.
Daily I get asked what makes Vmware Cloud Foundation (VCF) imported? Customers love standardization as it gives them many advantages like stability, time to market, and Vmware Validated Design (VVD) VVD-guidelines. In a follow-up blog, I will discuss how VMware made course correction on VCF 4.0 to move past using vvd-guidelines to deploy a full VVD.
Ok, so that is it? That is the starting point; to see actual value to VMware customers, you need to look at how VMware embraces a continuous integration/continuous delivery CI/CD strategy!
To start to achieve CI/CD, one first thing VMware needed to do was to reduce technical debt and standardize product line! This move to Photon OS and creating applications with microservices was paramount. Ok, nothing new here; this strategy has been preached for a decade.
The second key component to CI/CD is the ability to work with predictable and standard infrastructure, as we see from cloud providers. VMware is already proving that with SAS offerings of VMware products, they have the ability to introduce new features at a much faster pace.
Ok, what does this have to VCF or the VVD for that manner? The next step is to extend the rapid release to the on-prem cloud. Cloud providers ran data centers that have The same hardware, the same software, and the same configurations. Ok, require everyone to use the same hardware is the answer?
VMware has celebrated the choice of working with the broad ecosystem of partners, so requiring the same hardware is not a choice.
Enter VCF!
Ensuring that the best practice of the management domain uses the same software, the same configuration allows VMware customers to have standardized and predictable landing spots for VMware products.
Now VMware can extend CI/CD strategy past the public cloud into private clouds of their customers. BOOM! Now VMware can provide customers with features at rapid past and simpler upgrades to smaller changes that are delivered more often.
vPSO 