Some VDI Unique Security Concerns

By Bernd Harzog
published: Friday, August 22 2008

Virtual Desktop Infrastructure or the notion of running users' operating systems and their applications in guests on servers instead of upon the users' desktops is an idea that is rapidly gaining traction. Gartner recently published a report that said that it expects 50,000,000 users, or 15% of corporate desktops to be deployed via VDI by 2013.

There are a variety of performance, scalability and manageability issues that need to get sorted out in the next year or two for VDI to gain this kind of traction, and the principal vendors involved (VMware, Citrix, Microsoft, and the Provision Networks division of Quest) are all aggressively engaged in the hunt to provide the best combinations of functionality and manageability.

However, when you take a users environment off of their desktop computer, and put it on a server inside of your data center, some significant new issues get created:

1. With distributed desktops on their own LAN's often in remote offices, users are often on their "own" network which is physically and logically separated from the networks in the data center. When you put a user's OS on a server in the data center much of natural physical separation of the user from the core of the network and the company resources is removed. Unless everything that the guest OS's could potentially access is properly locked down, who knows what an enterprising user might find by browsing the LAN.
2. While you have centralized that instance of that OS, that a user is often still a local admin for his own instance of his own operating system and may have the right to install his own software. If you are going to give users the flexibility to augment their own desktop functionality, with that comes the need to have a far greater set of control about what users do with that flexibility.
3. When a user is running their OS on their computer, you can be pretty sure that they are using that specific computer to run their OS and their applications. Once that user can access that OS from any device that knows the URL of the broker, that user could access that OS from anywhere. This dramatically increases the risk that the person doing the access is doing so from home when they should not be, or that the person who is doing the accessing is not even the correct person at all.
4. Moving to VDI replaces a very static environment (physical users and machines) with a potentially very dynamic one. Manual administration via VMotion or DRS could easily move users between different servers based upon their workload, while at the same time DRS is moving the server based applications that the users are accessing between machines as well. The kind of static management products and procedures that worked with physical desktops can easily break down in this new dynamic environment.

What to do? I think that their will be an emerging class of new tools from new vendors that will focus upon the problems of performance and access management for virtualized desktops. The first of these new vendors is VMSight (www.vmsight.com) whose offering is focused upon performance and access management for VDI. I am sure that others will join the fray.

VDI - Redo or Breakthrough?, Virtualization Management: The Battlefront