I was privileged to speak at the 3rd Annual South Florida ISACA WoW! Event with Robert Stroud, Alan Shimel, and other great speakers. What I discovered from this conference is something I have feared for quite a number of years. Compliance actions are not continuous but often only enacted when the auditor shows up at the door. Secondly, very few auditors raised their hand when I asked if they are working with Virtualization or have customers that virtualize, this was quite a surprise.
Have you ever wondered how all the virtualization security tools fit together? Wait no longer as we have a new White Paper that will tell you this information. How do products from Altor Networks, Catbird Security, Reflex Systems, HyTrust, Tripwire, and others fit within your virtual environment?
When you think of backup security, many people think of ensuring tapes are offsite or even encryption on media, but what is really required for backup security? There is quite a bit going on when someone performs a backup within the virtual environment, so where does security begin and end for making a single or multiple backups?
In the article End-to-End Virtual Machine Backup I mentioned the new VMware Workstation 7.0 feature that creates an encrypted disk but in reality it is an encrypted virtual machine, which also implies encrypting the virtual disk. This one option to VMware Workstation is something that is needed within VMware vSphere as well as the other hypervisors. Encrypting virtual disk data can add to the overall security stance based on the encryption technology employed. So what do we need with virtual disk encryption?
Quite a bit has gone on in our industry in the last year. While this is not intended to be a comprehensive review of all that has occurred, we hope that we have captured the important events that have shaped virtualization and cloud computing.
• • 2 Comments
I recently participated in the InformationWeek Dark Security Virtual Event as a panel member with Hoff, Craig Balding, Chris Wolf, Glenn Brunette, and Jon Oberheide. A very far ranging group of individuals from research, security organizations, analysts, and authors. What is interesting is that most of these same people have joined me on the Virtualization Security Podcast, and the others I hope to have as guests next year. There was one question that set me to thinking even more, do we need a new way of thinking about virtualization security?
The last Virtualization Security Podcast covered PCI, Kurt Roemer and Jeff Elliot who were guests represented PCI. PCI as you hopefully know is working on compliance guidance for payment systems running within virtual machines and the cloud. This early discussion is a plea for people to get involved in reviewing the currently developing white-paper. While…
There has been quite a bit of discussion between myself, Tim Pierson, and other with respect to SSL man-in-the-middle attack possibilities within the virtual environment. But what are the chances that such an attack will happen, or that someone would know how to perform the attack? What does the attack depend upon?
Over the past year or so I have been thinking pretty heavily about the direction networking is taking within virtualization. In some ways, it appears security has been forgotten or relegated to ‘encrypt’ and forget. However, it takes quite a bit of knowledge and time to properly set up the backbone of an ‘encrypt’ and forget approach to network security, so it does not happen. Instead, we have a proliferation of technologies being used to cut down on cable clutter and thereby consolidate the network. These are all very important concepts. Security practitioners like myself realize that this type of consolidation WILL happen. So what tools are required to either ‘encrypt and forget’ or to protect these consolidated networks?