|
Page 1 of 3 Virtualization and Security - New Rules for a New Game By Cindy LaChapelle and Tim Pacileo published: Wednesday, August 27 2008
The virtualization of IT services
promises a wide range of potential benefits, including reduced cost and
increased flexibility and agility. However, many organizations rushing to take
advantage of virtualization find themselves faced with a variety of new and
unforeseen challenges. The basic problem
is simple: virtualized environments are so fundamentally different from the traditional
IT model approach that existing practices and processes aren't effective. As a result, companies that implement virtualization
initiatives without reviewing and adjusting their approach to management find themselves
at risk.
Data and network security in
a virtualized setting should be of particular concern. Many long-standing security techniques that
have been successfully applied to managing physical machines may not be
well-suited to a virtual environment. Executives must be aware of the potential
security risks (and associated costs) prior to moving to virtualization, and
develop appropriate processes and policy guidelines as an integral part of the
transition.
Virtualization and Security Challenges
The ease of deploying new services
in a virtualized environment poses some inherent security challenges. In a
virtualized setting, a large, complex organization can automatically deploy or
remove ten new servers in an hour. While
this increases flexibility and agility for the business, it also creates the
potential for loss of control and oversight.
Many organizations today suffer from "virtual sprawl" - when neither IT nor
business unit managers have a clear idea of how many virtual machines are
running, what's on each machine, where they are stored, what services are being
delivered to the business, and, most importantly, what kind of security is
applied to the virtual service being provided. Security concerns within
such an environment are self-evident.
A related challenge is
ensuring that applications within a virtual environment have proper security and
availability configurations. An
organization that struggles to manage and monitor a rapidly changing virtual
services landscape will certainly have difficulty managing the associated applications
providing those services. Applications are driven from the business side of an
organization while the infrastructure that these applications run on is being
driven from the IT side of the organization.
In a fully virtualized environment, effective communication between these
two segments of the organization is imperative, because system security and hardware
availability need to match multiple applications and business needs. Moreover, the business requirements of individual
applications may inherently develop dependencies on other applications sharing
the same physical environment.
Organizations need to focus
on careful planning of virtualized environments with a strategic view of the business.
For example, multiple small database instances might be consolidated on to a
single virtualized server environment.
Key parameters such as I/O capacity and growth, clustering of the server
hardware and virtual environment, data clustering or replication requirements,
etc. need to be considered and implemented to match the highest growth, availability,
and performance requirements for the database instances installed as virtual
machines.
Traditional security
practices of large organizations must also be considered. In a non-virtualized world, security
protocols are straightforward: dedicated staff control and monitor resources as
they come on line. As such, the scope of their authority and responsibility is
clearly defined. This model can't be
applied in a virtual setting without negating the advantages of flexibility and
speed of deployment. Yet, without proper
user rights and privilege controls in place, virtualization tools allow
knowledge workers to deploy a new server instance or virtual machine without
the consent or control of IT security staff.
The challenge, therefore, is
to create a balance whereby management practices and policies promote security
and control by allowing the security team to keep up with changes and their
impact on the organization, while at the same time facilitating speed of
deployment, flexibility and agility.
Security Management in a Virtualized World
Security in a virtualized
environment must be addressed first and foremost from a management perspective,
rather than as a technology issue. This
means that security must be considered as part of an overall resource
optimization strategy and addressed prior to implementing virtualization, and
not after the fact.
Virtualization requires that
businesses establish new processes and organizational structures to impose
discipline and control over the creation of virtualized services. This includes defining and enforcing policies
that require justification, parameters, and documentation around each virtual service
as it comes on line. Elements of this
approach include limiting access and the ability to create virtual servers, and
implementation of data center audit tools to manage virtual machines.
Administrative privileges to
a virtual environment may need to span multiple business groups and meet
various requirements for availability, changing workload, and user access. This means that the availability management,
hardware and software refresh and patching, asset management and change
management policies have to be enforceable and common to all the applications
or services co-hosted in single virtualized environment. This is not to say that virtualized services
within a single virtualized environment can't be configured to limit available
resources to satisfy additional levels of security (such as creating a virtual
service with limited or no external networks) but applications or services should
be partnered with similar availability requirements if possible.
|
