Virtualization: History repeats itself with a search for security
Connecting state and local government leaders
The benefits of virtualization go hand in hadn with a whole new set of security concerns.
SAN FRANCISCO'The information technology industry has a long history of developing and implementing technology first and thinking about security later. The latest example is the virtual machine, a host hardware platform running multiple guest operating systems.
'People are no longer talking about whether they should pursue virtualization,' said Alan Shimel, chief strategy officer at StillSecure. 'That train has left the station. There are too many benefits.'
But along with those benefits come a whole new set of security concerns, which traditional hardware-based tools do not adequately address. Virtual machines contain all the vulnerabilities of the operating systems and applications they are running, along with vulnerabilities created by the new relationships and flexibilities of guest operating systems running side by side on a single platform.
'Once again, security was an afterthought,' said Mark Boltz, senior solutions architect at Stonesoft.
'We see a lot of organizations rolling it out first, and only later dovetailing it into the security planning,' said Chris Farrow, director of product strategy at Fortisphere, a start-up company focused on virtual machine management. 'The problems of the past come back to bite us in new and different ways.'
But as the presence of these companies, and others, at this week's RSA Security conference indicates, the industry now is paying attention to virtual security.
'Every year at RSA there is a belle of the ball,' Shimel said. 'I think this year virtualization and security is that topic.'
'Nobody was talking about virtualization, and certainly not virtualization security, 18 months ago,' Boltz said. 'Now, virtualization and security are the topics of the year.'
The attention primarily is on server virtualization, and the drivers are real estate and rack space, hardware costs, energy costs and speed of provisioning. By using virtualization software such as that from VMware to allow multiple operating systems to use the same hardware, costs can be reduced, provisioning time cut and resources can be used more efficiently. Resources once consigned to an outside data center can be brought in-house.
But this also breaks the tightly coupled relationship of hardware and software, with one operating system and one application on a server, and reduces or eliminates the ability to physical segregate elements.
'It's all dynamic, it moves around,' Farrow said. 'I can't just walk up to a rack and yank a cord out any more.'
Administrators still have to worry about all of the old security issues, such as securing the perimeter and hardening, patching and configuring the operating system. But in addition to this, there are 'relationships that didn't exist before,' with one host and a number of guests sharing a common infrastructure and backplane, Farrow said. 'If I compromise the host, I own all of the guests.' And one compromised guest could compromise the host. A malicious virtual machine could even be hidden on a host.
The problems defending this environment are threefold:
- Technological: A lot of products such as firewalls, intrusion detection systems and various scanners and filters do not work effectively in this environment because they tend to protect the server-operating system-application as a single entity.
- Performance: Systems management tools do not work well in a virtual world, and monitoring tools that require copies on each virtual machine to keep an eye on activity can add overhead. In addition, there are licensing issues to consider as the number of copies needed increases.
- Politics: Administrators running the servers implement virtualization to solve their own problems. They often are not aware or concerned with the impact this has on the security shop.
- Education and training: IT, security and audit teams should be trained in the technology before it is rolled out.
- Reference and use the standards and guides for best practices that are beginning to appear. A set of practices from the Defense Information Systems Agency have been hanging fire for a year, he said, but many vendors are producing their own hardening guidelines.
- Look at how virtualization fits into your risk management strategy. If it does not fit well with your strategy, go to a vendor specializing in virtual security for expertise and tools.
NEXT STORY: Self-encrypting data center drives