The Virtualization Practice

Virtualization Security

Virtualization Security focuses upon end-to-end security, integrity, auditability, and regulatory compliance for virtualization and clouds. Virtualization Security starts where the cloud and virtual environments begin: the end user computing device. ...
We follow the user through the virtual and cloud stacks until they reach the application the user wishes to use to retrieve the data that is important to them. Virtualization and cloud security is implemented where there is an intersection between user, data, and application while maintain strict control of management interfaces. As such virtualization security looks into all aspects of security devices, tools, controls, and guides that impact or can be used to secure virtual and cloud environments.

I was recently on an island and it got me thinking of how would I move my company to the island. The company services people around the world, but would also service local to the island. Does virtualization really help me here? Why do I ask this, because an island is often prone to the vagaries of mother nature: Lava, Flooding, Typhoon, Hurricane, Earthquakes, humidity, desert, power fluctuations, etc. The list is pretty endless. So how would you move a business to or from an Island? Is this where the Cloud becomes a mature component? If so how much cloud do you need?

With the advent of VMware Go, vCloud Express, and the vCloud API, VMware’s marketing message is that all SMBs should use the cloud to either deploy their free hypervisor (VMware Go), or use the Cloud to run their servers (vCloud Express). VMware claimed at VMworld that we are no longer looking for ROI with Virtualization from a pure power and equipment costs, no we are now looking at virtualizing to save funds within the operational space of your company. Where best to do this than for SMBs to instead of owning their own equipment move their servers into the waiting vCloud Express providers such as Savvis, Terremark, Hosting.com, etc.

The known virtualization security vendors Reflex Systems, Catbird Security, Altor Networks, HyTrust, Symantec, Trend Microsystems, Tripwire, and VMware all showed their wares at VMworld. Even Checkpoint was showing off their firewall integration within the virtualized environment. Are these really competing products or products that have unique uses within the virtual environment with just a bit of overlap?

VMware vs. Microsoft – Management Stack Strategies

VMware has made it very clear that it views virtualization as the catalyst technology which enables driving complexity and cost out of the data center, and injecting freedom, agility, and choice into the data center. VMware has also made it clear that these benefits from virtualization will only occur if virtualization itself (the hypervisor and the low level hypervisor management tools) are complemented by a layer of management tools that allow applications that are hosted on internal and external clouds to be managing very differently than they have been in the past.

As of this writing just a few of the regulatory compliance groups are working to encompass Virtualization. However, they are not close to anything publishable yet. What does this mean for companies that must enforce regulatory compliance? What does this mean to an auditor? The big question many are asking, is if the Compliance documents to which they must adhere do not mention virtualization, are they compliant when they virtualize? Currently whether you get down checked or not during an audit depends entirely on the auditor’s interpretation of the current non-specific guidelines. In most case its negative as there is no guidance from the compliance groups with regards to virtualization. There are also virtualization security products out there that try to enforce and report upon current compliance guides with respect to virtualization.

While at VMworld I was suddenly hit with a blast of heat generated by the 40,000 VMs running within the VMworld Datacenter of 150 Cisco UCS blades or so. This got me thinking about how would VMsafe fit into this environment and therefore about real virtualization security within the massive virtual machine possible within a multi-tenant cloud environment. If you use VMsafe within this environment there would be at least 40,000 VMsafe firewalls. If it was expanded to the full load of virtual NICs possible per VM there could be upwards of 400,000 virtual firewalls possible! At this point my head started to spin! I asked this same question on the Virtualization Security Podcast, which I host, and the panel was equally impressed with the numbers. So what is the solution?

VMsafe – Vendor Implementations at VMworld

With the advent of existing VMsafe products from Altor Networks, Reflex Systems, and ones on the horizon from Trend Micro and others in the security space, all administrators should have a clear understanding of how they work under the covers. Where does VMsafe appear within the stack? Is VMsafe on the incoming physical NICs, within the vSwitch, portgroups, or before or after the vNIC? Can we expect the other aspects of VMsafe to be the same? While I was discussing VMsafe with the vendors, VMware was also going around and talking to all the VMsafe vendors for VMware TV shots.