Virtualization for your DMZ?
Connecting state and local government leaders
Defense and intell agencies would like to use virtualization to give users access to system of different security levels from one machine, but some experts doubt whether the idea can work.
Could virtualization work for software-based multi-level security environments? Experts are divided.Virtualization offers the ability to partition different working environments in the same computer. Theoretically, anyway, it could provide a way for users to access networks of different security levels 'such as a private internal network and a public network ' from the same computer. This approach could save the cost of buying hardware ' one for each security level being accessed on the desk top.Many intelligence and defense agencies, for instance, want to offer their workers the ability to switch between the Secret IP Router Network (SIPRNet) to the Unclassified but Sensitive IP Router Network (NIPRNet) from a single box. And on a more general level, many agencies are looking at ways to consolidate internal and external servers, and set up virtual switches in between them, creating what is known as a DMZ.Nand Mulchandani, a VMware senior director of product management and marketing, said that VMware recommends its software for mixed environments. The company offers a with suggested three network topologies. 'There is no risk in doing this,' he said.Mulchandani did note that 'there is a psychological barrier ' people think that inherently it can't be done.' However, he said, 'There is nothing inherit in our products that should or will stop you from doing it.'This psychological barrier can be considerable. George Pradel, chief security strategist for virtualization support software vendor Vizioncore, said that virtually none of his company's government customers will use virtualization to consolidate internal and external-facing servers.'The government folks I spoke with have been always like, 'Nope'not even considering it,' ' he said.'Technically, you can do it. And it will be extremely secure,' he said ' but added that political considerations can overrule technical ones. An architect may not want to show an internal network on the same box as an external one ' it just doesn't look safe. And if there is a breech, the co-mingled environment will be immediately be suspect.And then there is the human factor as well. The architecture may be solid, but if an administrator misconfigures a network card on the server, then a path has been created between the internal and external network.Phil Cox, an engineer at System Experts., was downright skeptical about the idea of using virtualization as part of trusted zones."It is just not good security. It's software. There is no guarantee of isolation,' Cox said, during a class he taught on securing virtual environments at the recent Usenix conference in Boston. 'You're spanning trust zones, with no physical isolation. I don't care how great VMware or Xen coders are, right now there is no track record of those things being able to provide that level of separation."During the class, Cox did offer a number of scenarios of how to bridge an internal and external network in one box, for those that asked.For instance, with one server, running an ESX, he would install three network cards. Two go to the internal network, one would go to the Internet. The ESX management console would be accessible only via the internal LAN through the first internal network card. An internal virtual machine would be connected to the other intranet network card. An external virtual machine would be connected to the Internet network card, with a firewall in between the card and the virtual machine, as well as two virtual switches (one on either side of the firewall). The internal and external virtual machines would then be connected, with a firewall and two vSwitches in between as well.Such an approach was about as secure as you can get, but Cox still wouldn't trust it. 'Would I trust any of any of these hypervisors to span these two domains? Nope,' he said. 'At some point in time in the future, some smart guy or gal will figure out how to bust [them], and people are going to be hacked."
NEXT STORY: Editor's Desk | Darkness in the cloud