Application Virtualization
Business Agility
Data Center Virtualization
Desktop Virtualization
Performance Management
Personalization Virtualization
Presentation Virtualization
SMB Virtualization
Storage Networking
Virtualization Backup
Virtualization Management
Virtualization and Cloud Security Projects to Watch
Posted By Texiwill on January 26, 2010
The future of Virtualization and Cloud Security is being worked on today and there are several projects worth watching. Early guidance from these projects will aid your current virtualization and cloud security policies, procedures, plans, and architectures.
Existing Projects
The cloud security projects to watch are:
- Cloud Security Alliance also on LinkedIn which is looking into all aspects of cloud security and security of virtualization within a multi-tenant environment.
- A6 (Audit, Assertion, Assessment, and Assurance API) Working Group which is working towards the goal of providing an API for allowing proper audit controls of cloud infrastructures.
The virtualization security projects to watch are:
- Security Guidance for vSphere which has yet to be completed, but will be announced within the following:
- VMware Communities Security and vShields Zone Forum
- VirtSec group on LinkedIn
- Virtualization Security Round Table Podcast
The guidance under development is from VMware, CISsecurity, and DISA.
- PCI and FDIC working groups as they work through inclusion of Virtualization into their guidance. Granted this guidance will be fairly generic as it must cover all forms of virtualization products.
Hybrid virtualization and cloud projects to watch are:
- The Distributed Management Task Force (DMTF) has teamed up with the Cloud Security Alliance as they work towards a common virtual machine file format that includes the necessary security meta data.
Future Projects
Even with these existing projects I think there is a need for at least one more project related to cloud and virtualization security and compliance, specifically compliance. Since Security is not Compliance and Compliance is not Security.
- General Compliance guidance with respect to virtualizaiton and cloud that auditors can use with respect to determining if the proper compensating controls are in use.
This General Compliance guidance would not be specific to any one industry and help auditors and security professionals determine if the proper compensating controls are in place for each of the hypervisors in use.
Conclusion
As virtualization becomes more complex, we will need to rely heavily on documentation from security and compliance projects to determine what should and should not be part of the security policy. Knowing how to harden and audit is just as important as knowing what to compensating controls to have in place.
Related posts:
- Security and Compliance only when Auditor is at the door
- PCI discussed on the Virtualization Security Podcast
- Regulatory Compliance, Slowly Catching up with Virtualization
- NIST Cloud Computing Definitions Final
- Private Cloud Security Nice to Have!?
Categories: 
Cloud Computing, 
Virtualization Security
About the author
Edward L. Haletky is the author of VMware vSphere(TM) and Virtual Infrastructure Security: Securing the Virtual Environment as well as VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers. Edward owns AstroArch Consulting, Inc., providing virtualization, security, network consulting and development and The Virtualization Practice where he is also an Analyst. Edward is the Moderator and Host of the Virtualization Security Podcast as well as a guru and moderator for the VMware Communities Forums, providing answers to security and configuration questions. Edward is working on new books on Virtualization.
Comments
Leave a Reply
Please note: Comment moderation is currently enabled so there will be a delay between when you post your comment and when it shows up. Patience is a virtue; there is no need to re-submit your comment.