The Virtualization Practice

I recently spoke at the InfoSec World 2010 Summit on Virtualization and Cloud Security and also attended the main conference sitting in on many Virtualization discussions. Perhaps it was the crowd, which was roughly 30-40% auditors. Perhaps it was the timing as SourceBoston was also going on, as well as CloudExpo in NY. But I was surprised to find that people are still ‘just starting’ to think about Virtualization Security. Since I think about this subject nearly every day, this was disappointing to me at best. I found ideas around virtualization security ranging from:

* Virtualization Security is not part of an architecture/design, what do I bolt on?
* My Physical Security will work
* Virtual Environments NEED More security than physical environments
* There are no new threats, so why have something more
* Security is a hindrance

the Cloud is increasingly being used to provide external security testing services (such as AVS, Application Vulnerability Scanning). The argument of the proponents of such services is that security threats come from the cloud, and thus it makes most sense to embed the AVS in the cloud. However after very detailed examination of the options we have come to the conclusion that the Cloud it isn’t necessarily the right answer for many enterprises, and that the AVS service may best be delivered inside the datacenter.

Does an evaluation for a virtualisation project need to be only an exercise in understanding if X hosts will on Y servers? Will you be able to to virtualize every service you deliver? Are new applications required? What are your existing service-levels and requirements across your application portfolio? In most enterprises today, IT is a cost centre not a profit centre. Business units often want detailed involvement in implementation plans, asset purchases and ownership: it is not unusual that requests for applications come in terms of functionality – not in terms of service levels. With their release of Workspace iQ, Centrix Software appear to be unique in endeavouring to aggregate information that can be used to deliver data that can help provide IT with improved costing information without relying on specific vendors solutions to be in place.

During the last Virtualization Security Podcast, our guest had to postpone so we discussed to several interesting topics all related to Digital Forensics and how encryption would best work within the virtual environment. Our very own Michael Berman, in a previous life was a forensic investigator and had some great insights into the problem of digital forensic within the virtual environment.

Both Infrastructure Performance Management and Applications Performance Management vendors who are targeting the virtualization and cloud markets have realized that new and unique data is needed in order to performance manage these new environments and the applications that run on them. This is dramatic departure from the old physical world where most vendors simply relied upon the data that were provided via standard OS API’s to infer systems and applications performance.

GestaltIT Tech Field Day: Virtualization Line Up

I participated in GestaltIT’s TechFieldDay which is a sort of inverse conference, where the bloggers and independent analysts go to the vendors and then discuss the information they have received. We visited the following virtualization vendors:

* vKernel where we were introduced to their Predictive Capacity Planning tools
* EMC where we discussed integration of storage into the virtualization management tools as well as other hypervisor integrations
* Cisco where CVN and CVE were discussed in detail.

Depth vs. Breadth in Virtualization Performance Management

Enterprises who are going to support business critical and performance critical applications on a virtual infrastructure should at the minimum address two needs. The first is to get a true and complete picture of Infrastructure Performance based upon Infrastructure Response Time. The second is to put in place the tools required to monitor these applications in production.

GestaltIT Tech Field Day: Storage Line Up

I participated in GestaltIT’s TechFieldDay which is a sort of inverse conference, where the bloggers and independent analysts go to the vendors and then discuss the information they have received. We visited the following storage vendors:

* Data Robotics where we were introduced to the new Drobo FS
* EMC where we discussed stretched storage and other interesting futures
* HP where we were introduced to the IBRIX products