The Virtualization Practice

Virtualization Security

Virtualization Security focuses upon end-to-end security, integrity, auditability, and regulatory compliance for virtualization and clouds. Virtualization Security starts where the cloud and virtual environments begin: the end user computing device. ...
We follow the user through the virtual and cloud stacks until they reach the application the user wishes to use to retrieve the data that is important to them. Virtualization and cloud security is implemented where there is an intersection between user, data, and application while maintain strict control of management interfaces. As such virtualization security looks into all aspects of security devices, tools, controls, and guides that impact or can be used to secure virtual and cloud environments.

In the last Virtualization Security podcast on 12/2 we had with us members of the PCI DSS Virtualization Special Interest Group (SIG). Kurt Roemer of Citrix and Hemma Prafullchandra of HyTrust joined us to discuss the differences to the PCI DSS 2.0 with respect to virtualization. In essence, PCI DSS explicitly calls out the need to bring virtualization, people, and processes in scope.

As we discussed in a previous article, the PCI DSS 2.0 does not state exactly what needs to be assessed within the virtual environment, or even what part of the virtual environment is a concern of each aspect of the PCI DSS. What the PCI DSS 2.0 does do is change the language, however subtle, that technologies employing shared resources are now acceptable.

The PCI Security Standards Council published its latest PCI guidance in the form of PCI DSS 2.0, but quickly followed up with the document Navigating the PCI DSS v2.0. The Navigating document is very important to those who have virtual systems as it contains the basic guidance about virtualization while PCI DSS 2.0 does not provide anything specifically geared towards virtualization. However, there is an adjunct document that does layout PCIs thoughts on virtualization. This is stated within the Navigating the PCI DSS (v2.0) document.

The Freemium sales model is a business model innovation best suited to inexpensive products that are very easily understood (and therefore not very new or very different) and that solve an obvious problem in a manner that is more convenient for the customer to acquire and implement. There are not many new virtualization and cloud technology companies who set out to produce undifferentiated products which suggests that a general application of the Freemium model to startups in our ecosystem is ill advised. Enterprise customers should pay great attention to products that are being marketing in this manner to ensure that they do not end up growing the use of something that was purchased in a tactical manner into a strategic use case.

The Virtualization Security Podcast on 10/21 was the third in a series of Virtual Desktop Security discussions we are having. The special guest panelist was Chris Mayers of one of the Chief Security Architects for Citrix, the makers of XenServer, XenClient, and the FlexCast solutions. FlexCast provides an all encompassing method to provide virtual desktop and applications that include the following mechanisms:

Let us look at each of these mechanisms in a bit of detail then discuss how they work to provide Security and how to secure them.

The Virtualization Security Podcast on 10/7 was the second in a series of Virtual Desktop Security discussions we will are having. The special guest panelist was Simon Graham of Virtual Computer, the makers of NxTop a client side hypervisor based on Xen. On this podcast, we went into the details of NxTop.

The engineers at Virtual Computer have thought about nearly everything when it comes to a Client Hypervisor. NxTop operates as a standalone or as a centrally managed client hypervisor. The difference is fairly stark. I feel that most people in the Enterprise unless this is a one off situation would want to use the managed client hypervisor.

If we are going to start over, why not really start over and reinvent the entire infrastructure and management software industries in the process. That way we end up with an infrastructure that was actually designed for the dynamic, agile, and scalable use cases that we are trying to address with a green field approach, and an appropriate set of management tools as well. Is this going to happen? You can bet that there are already VC funded startups in stealth mode working on it.