The PCI Security Standards Council published its latest PCI guidance in the form of PCI DSS 2.0, but quickly followed up with the document Navigating the PCI DSS v2.0. The Navigating document is very important to those who have virtual systems as it contains the basic guidance about virtualization while PCI DSS 2.0 does not provide anything specifically geared towards virtualization. However, there is an adjunct document that does layout PCIs thoughts on virtualization. This is stated within the Navigating the PCI DSS (v2.0) document.
I was invited to CSI 2010 this year to speak on the Low Hanging Fruit of Virtualizaiton Security. This presentation brought to light some simple to implement features that would give you the most security for what I consider very little cost or effort. These 7 items if implemented will improve the overall security of your virtual environment.
The Freemium sales model is a business model innovation best suited to inexpensive products that are very easily understood (and therefore not very new or very different) and that solve an obvious problem in a manner that is more convenient for the customer to acquire and implement. There are not many new virtualization and cloud technology companies who set out to produce undifferentiated products which suggests that a general application of the Freemium model to startups in our ecosystem is ill advised. Enterprise customers should pay great attention to products that are being marketing in this manner to ensure that they do not end up growing the use of something that was purchased in a tactical manner into a strategic use case.
Last week, there were several major virtualization security announcements, that taken singularly may only apply to the specific products, but taken together show the growth of the virtualization security ecosystem.
The Virtualization Security Podcast on 10/21 was the third in a series of Virtual Desktop Security discussions we are having. The special guest panelist was Chris Mayers of one of the Chief Security Architects for Citrix, the makers of XenServer, XenClient, and the FlexCast solutions. FlexCast provides an all encompassing method to provide virtual desktop and applications that include the following mechanisms:
Let us look at each of these mechanisms in a bit of detail then discuss how they work to provide Security and how to secure them.
The Virtualization Security Podcast on 10/7 was the second in a series of Virtual Desktop Security discussions we will are having. The special guest panelist was Simon Graham of Virtual Computer, the makers of NxTop a client side hypervisor based on Xen. On this podcast, we went into the details of NxTop.
The engineers at Virtual Computer have thought about nearly everything when it comes to a Client Hypervisor. NxTop operates as a standalone or as a centrally managed client hypervisor. The difference is fairly stark. I feel that most people in the Enterprise unless this is a one off situation would want to use the managed client hypervisor.
• • 0 Comments
If we are going to start over, why not really start over and reinvent the entire infrastructure and management software industries in the process. That way we end up with an infrastructure that was actually designed for the dynamic, agile, and scalable use cases that we are trying to address with a green field approach, and an appropriate set of management tools as well. Is this going to happen? You can bet that there are already VC funded startups in stealth mode working on it.
When we talk about Cloud Security, the main concept is to separate, as an example, Coke from Pepsi. This implies that Tenant’s cannot impact the availability of each others data, the integrity of that data, and the confidentiality of that data. But what does this actually mean? Does this apply to all types of clouds in the same way?
There are three types of cloud families: Private, Hybrid, Public. There are at least 3 types of clouds: SaaS, PaaS, and IaaS. Do the same rules for one cloud family work for all cloud families? as well as for the types of clouds?
I believe the answer is yes.
Christofer Hoff (@Beaker) and I had a short discussion on twitter the other day about the VMware Cloud Director (vCD) security guidance. We both felt it was a bit lite and missed the point of Secure Multi Tenancy. However, I feel even more strongly that people will implement what is in the vCD Guidance, vBlock Security Guidance, and the vSphere Hardening Guidance, and in effect have a completely insecure cloud. These three guides look at the problem as if they were singular entities and not as a whole.