Securing Virtualized Environments - Enjoy the Ride, But Don't Forget to Buckle Up

IT departments are under immense pressure to deliver more functionality and capacity at a time when budgets are shrinking and costs are increasing. Mounting expenses from powering and cooling servers, coupled with the headache of managing the ever-expanding data center, make this a serious challenge. A traditional capital-expenditure approach to scalability is cost-prohibitive and simply not sustainable, which is causing a return to strategies for more centralized, integrated and, ultimately, business-friendly IT.

Virtualization is at the heart of this transformation. Through its ability to consolidate workloads and reduce the amount of time and energy IT spends purchasing, installing and maintaining racks of servers, virtualization allows organizations to meet expansion goals with fewer physical resources and reduced operational costs. Early adopters of the technology are also attaining additional returns on their investment through radically simplified systems management, data center automation and optimized server utilization. In short, both the expectations and benefits of virtualization are very real.

However, the ultimate success of virtualization extends beyond efficiency, performance and ease of use. It must be able to provide these benefits without compromising the overall security, reliability and availability of the IT infrastructure. Organizations already struggle to understand how best to stay ahead of today's threats and address an endless array of compliance requirements. Whenever a new technology is introduced into the operating environment - especially one as profoundly game-changing as virtualization - this problem is exacerbated.  

Virtualization introduces additional technical and operational components, capabilities, and responsibilities with the potential to create new security challenges. Initial concerns tend to focus on physical-to-virtual migrations, protection of the virtualization management stack, and visibility of virtual networks. However, as virtual data centers become more complex and dynamic, additional worries regarding workload isolation, multi-tenancy, mobility, virtual machine sprawl and trust relationships begin to surface. The result is a situation where the cost and complexity of maintaining security in a virtualized environment, or even worse - a breach due to the lack of appropriate protection capabilities, can outweigh the benefits of this exciting technology.