VMware AppDefense

VMware AppDefense is the solution for security of end devices in DPC which protects applications by embedding of management tools, detection of threats and control of a response in the environment of VMware vSphere where applications and data are had.

2018: As a part of VMware vSphere Platinum

On August 31, 2018 it became known that the VMware company announced the vSphere Platinum edition. As noted in VMware, vSphere Platinum is a combination from two products: VMware vSphere Enterprise Plus platforms and solutions VMware AppDefense. It also a special plug-in to vCenter for vSphere Client which implements their interface (it is called vCenter Server plugin for vSphere Platinum). It gives access to administrators to functionality of AppDefense through standard management tools the vSphere platform. Read more here.

2017: Announcement

At the end of August, 2017 the VMware company provided the AppDefense technology intended for the organizations which need the increased protection level for applications.

For protection of network interaction against the attacks there are already technicians based on microsegmentation offered by the solution VMware NSX, AppDefense implements this approach at the level of applications (at a full integration with vSphere and NSX).

The AppDefense technology works at the level of a hypervisor of ESXi studies normal behavior of the operating system and applications at usual conditions, and in case of identification of deviations from this status, notifies on it the administrator and automatically takes some steps for protection of an environment. An opportunity to change structure and the sequence of these steps is provided.

In general concerning the compromised application the following measures can be taken:

• Block network communication of specific process;
• Make the snapshot of the virtual machine for the subsequent analysis;
• Send the virtual machine with the application to Suspend or switch off it.

In fact, AppDefense offers approach of whitelisting (adding of the entrusted components in the list) instead of blacklisting (blocking of harmful components).

As of August 30, 2017, the AppDefense technology is available to users of the USA based on an annual subscription which cost is $500 for one processor ESXi host server.^[1]

Notes