The Virtualization Practice

Author Archive for Edward Haletky

Edward Haletky

I and others look at Virtualization Security constructs with an eye towards Cloud Security, but they are not necessarily the same. Granted for some clouds, virtualization security can lead to cloud security but this really depends on how the cloud’s architecture. Even so, what we know from Virtualization Security WILL apply to Cloud Security and will be the basis for best practices. But you say, my cloud does not use Virtualizaiton? Ah ha, I say, but it is still a cloud? And that implies there are similar security concerns. This was the discussion on the 1/26 Virtualization Security Podcast.

When you read many blogs and articles on cloud security, writers such as myself often mention jurisdictional issues as a big problem. Nor is the ability to Audit clouds the only problem. Yet both of these are huge issues for clouds today, but fundamentally, is the cloud flawed from a security point of view or are there plenty of security mechanisms available?

One of the questions I get from time to time is, can I store my data in the cloud? At the NEVMUG, this came up once more. There is currently a lot of uncertainty about cloud storage, specifically when it comes to critical and highly regulated data. Where should I store my data, dovetails nicely with discussions of going to the cloud as well as data protection is a key component of such a migration.

I was discussing yesterday how to use virtualization and cloud performance management tools as an early warning system for security issues. I have touched on use of New Relic, VMware vFabric APM, Quest vFoglight, and other tools that can make up such a early warning system before, but without the proper process in place, the tools will not be good enough.

At the end of last year and the beginning of this year the Virtualization Security Podcast featured two very different guest panelists to discuss cloud security, policy, and compliance: Phil Cox, Director of Security and Compliance at RightScale, joined us for the last podcast in 2011 and the George Gerchow of VMware’s Policy and Compliance Group, joined us for the first podcast of 2012. We asked is the public cloud ready for mission critical applications. The answer was surprising. Have a listen and let us know your thoughts.

Data Protection techniques should be implemented and tested long before they are needed. This is a necessary component of any IT organization. However, the most recent communities podcast brought to light several implementation aspects of Data Protection, specifically about Disaster Recovery: organizations still do not test their DR plans and organizations are waiting for a hardware refresh to implement a DR plan.

Christmas is over and New Years is on its way. A time to make resolutions and see the year complete. A time to review what is old and plan for the future. This is a perfect time to review your defense in depth and look to see if there are security additions needed in 2012. So what cloud and virtualization security New Years resolutions should I make for 2012?

Data Protection is still an issue with many small businesses and smaller enterprises who virtualize; Specifically around the Data Protection Process and eventually where to store the data. When I speak to people they are struggling with whether or not to place the data on tape, blu-ray, into the cloud, or other disks. Medium and Large Enterprises already have such policies in place, but like everything else, when they virtualized the policies may have fallen by the road side and now need to be recovered, dusted off, and put into practice. The choice of where the data will ultimately reside when disaster strikes is an ongoing discussion in the virtualization community. Ultimately, Data Protection is just that, protecting the data from loss, destruction, and allowing for quick recovery.

There needs to be better Data Loss Prevention applied to Social Media than there exists today and how that will be applied globally is a huge issue. But it is a growing trend. I see on twitter from those I know many things that should not appear: from the discussion of internal only intellectual property to locations sent to 4 square. Add into this, the myriad forms of ‘U There’ requests. It is so easy to tell people anything on twitter, that it also becomes a problem with telling people too much even in 146 characters. Yet, I also see the same when using text messages, chat, and other technologies. So what is the solution?

Google Circle
Join my Circle on Google+

Plugin by Social Author Bio

WebsiteFacebookTwitterGoogle_PlusLinkedinSkypeeMail