VMware vDefend 4.2 announcement - VMware EXPLORE 2024

This blog post is from a VMware/Broadcom NDA briefing before VMware EXPLORE 2024 Las Vegas. The NDA has finished the 27^th of August 2024.

VMware vDefend now is a security solution that is formerly known as VMware NSX Security Solutions.

Enterprises do need a comprehensive solution that requires visibility that requires micro segmentation, application, level segmentation, zone, level segmentation. It requires thread, defense, variety of threat defenses.

VMware vDefend 4.2

Distributed firewall, Gateway firewall.

vDefend 4.2

scaling improved. 3x to 10x improvements in scale.

Distributed firewall: Secure VCF

You can apply security on VLAN, Distributed Port Groups in addition to NSX backed segments.

New firewall operations dashboards in vDefend 4.2

You can get top rules, top computes, top groups. The dashboard is fully customizable.

You can use centralized policy management for VMs and containers.

Advanced Thread Prevention

14 network traffic detectors which you can use to look at anomalies

Oversubscription Bypass

This is user configurable bypass behavior for all oversubscription conditions (CPU, Memory, Network). You can do it globally or per-rule override.

There are additional alarms to monitor for resource contention.

Malware Detection and prevention capability

Windows and Linux support
Detection and prevention of known and unknown malicious files
Hash lookup, local analysis and cloud-based dynamic analysis
Guest-introspection based file extraction and blocking for DFW

Simplified Malware SVM Lifecycle management

Previously one had to install web server from where were deployed Service VMs via API calls. This is no longer needed.

OneNote files now supported in 4.2.

How does network detection & response work?

NDR continuously ingests and correlates large volumes of network traffic and security events across multiple assets and hops. Collecting data from the network perimeter (to cover north-south traffic) and from sensors within the network (to cover east-west traffic), NDR solutions leverage AI and machine learning to develop a baseline understanding of normal network traffic flows — and therefore also an ability to detect malicious activity which does not follow normal patterns.

AI-powered NDR tools continuously learn and adapt to provide automatic detection of sophisticated, ever-evolving threats.

If an attack is detected, NDR solutions can deliver an end-to-end forensic analysis of the attack timeline, from initial infiltration to lateral movements within the network, and can automatically trigger prevention and mitigation workflows.

With 4.2 it’s possible to have On-premises deployment