The Cisco-VMware-NetApp (CVN) was discussed on the Virtualization Security Podcast as it pertains to Secure Multi-Tenancy (SMT). This is a major concern that was also discussed at RSA Conference 2010 within the Cloud Security Alliance Summit. The question still remains how to achieve this goal however. CVN is a very good start, but as we discussed on the podcast is missing some key elements.
HyTrust has announced Series B Financing in the amount of $10.5 Million with participation from Cisco, Granite Ventures as well as existing investors Trident Capital and Epic Ventures. This is very good news for HyTrust. While the Series B Funding was not much of a surprise given that HyTrust fits into the Virtualizaiton Security within its own niche. What is surprising is that Cisco is one of the backers of this innovative product.
• • 0 Comments
When I first interviewed Reflex System’s CEO he had a desire for the vTrustTM VMsafe-Net driver be the defacto standard for all such VMsafe-Net drivers. While others may not agree with this desire and will create their own VMsafe-Net drivers, TippingPoint is the first to integrate into Reflex’s VMC product to leverage the vTrust VMsafe-Net Driver and puts Reflex System’s on the second step of the path for vTrustTM to be the defacto standard. At the same time TippingPoint adds an Intrusion Protection System to the Reflex System VMC family of products with Tipping Point vController.
Brad Hedlund of Cisco asked the question, should the physical network security policy be different than the virtual network security policy? The answer is obviously no, but why are they treated separately? I and other have pushed the concept that to gain performance, redundancy, and security that you should use multiple network links to your virtualization host to separate traffic. However, does this really give you security?
Cloud Computing ...
• • 3 Comments
There are two key features missing from Virtualization and Cloud Computing. Those are auditing and forensics. The A6 project aims to fix this problem for auditing, but there is only some research into forensics. The issue is about discovering who did what when, where, how, and hopefully why. Auditing plays into this for Compliancy but also for forensics. Forensics has two major components in its arsenal: Audit Trails, and Disk Images.
I was posed with a question today, “I’m looking for some info on account & password management for consultants that visit a lot of customers where they have to do admin stuff.” with a secondary question of “how to manage the account if a constultant leaves?” This was specific to the VMware vSphere but would apply to any hypervisor.
On January 25th 2010 VMware reported earnings for the fourth quarter of 2009 and for the full year of 2009. While we are not a financial analysis site focused upon earnings and stock prices, there is important information contained in these earnings numbers about the success of VMware.
The future of Virtualization and Cloud Security is being worked on today and there are several projects worth watching. Early guidance from these projects will aid your current virtualization and cloud security policies, procedures, plans, and architectures. (A6, DMTF, CSA, PCI, FDIC, etc.)
• • 1 Comment
I was privileged to speak at the 3rd Annual South Florida ISACA WoW! Event with Robert Stroud, Alan Shimel, and other great speakers. What I discovered from this conference is something I have feared for quite a number of years. Compliance actions are not continuous but often only enacted when the auditor shows up at the door. Secondly, very few auditors raised their hand when I asked if they are working with Virtualization or have customers that virtualize, this was quite a surprise.