Virtualization security: So far nothing
- 11 February, 2009 10:17
- Comments 1
In April 2004 I wrote my first article on the topic of virtualization security. I was trying to bring attention to the security aspects of this "new" technology that was getting quite a bit of hype at the time. The hope was that this time security would not be an afterthought, that we would reverse the equine-escape/egress-closure sequence. The naïvete of youth!
Four and a half years later, virtualization is almost a mainstream technology. Our virtualization benchmark in the second half of 2008 showed rapid adoption among all industries. Server virtualization was in use by 93 percent of participants. More than 20 percent have achieved full adoption, which means that virtualization is their default platform for all new servers and they are converting all existing systems. More importantly, 78 percent of participants have virtualized production servers facing customers or users.
Surely it seemed that security would be a top issue in architecture, design and technology choice. After all, as with any new technology there are new security issues to contend with. Entire network infrastructures now exist inside the virtualization layer, connecting servers. New management systems allow near-instant provisioning, migration and de-provisioning of entire fleets of servers.
Server images are floating around on disk and are whizzing around networks. Live migration means that virtual server memory pages are also whizzing around on the network. New architectures, processes and management systems, as well as organizational upheaval, are all creating infinite possibilities for mischief. So we naturally asked (and have been asking every year since 2004) what companies were doing differently for security. Any tools? Any new architectures? Anything?
Once again, the answer surprised us (though perhaps it shouldn't). Only 9.6 percent of participants are deploying any security tools specially designed to deal with virtualization. Another 21.2 percent expect to do so within the next three years. A whopping 69.3 percent, though, have no plans at all to do anything specifically aimed at securing their virtual environments.
Where the imperatives of security won out, organizations have mostly accepted significantly reduced benefits from virtualization. They partition resource pools to match network segments, and force traffic among pools to pass through the existing network security infrastructure. They mostly use virtual LANs to achieve this, and they get less complete resource utilization as a result, and less flexibility in matching workloads to resources.
These measures overlook many of the threats that are unique to virtualization by trying to shoehorn the existing security models and practices into a vastly different environment. This leaves threats in the virtualization management (control plane), threats related to dynamic resource management, threats to live migration and many others unaddressed.
There is a great risk that these threats will translate into attacks before companies re-examine their security policies, architectures and implementation. Worse is the missed opportunity: virtualization principles could revolutionize the way we do security, making our systems both more flexible and more secure. There are many very innovative security solutions for virtualization. There are even more opportunities to inject virtualization principles into existing products and architectures. What are we waiting for?
Nominations for the 2012 ARN IT Industry Awards open on Tuesday, June 12.
- Bookmark this page
- Share this article
- Got more on this story? Email ARN
- Follow ARN on twitter
- Aberdeen Group: Building Business Resilience Through Active Archive
- Market Potential-Strategy Guide to the Active Archive Market
- In Search of the Long-Term Archiving Solution —Tape Delivers Significant TCO Advantage over Disk
- Spectra Logic and Australian National University Success Story - March 2012
- Premier Media Group Fast Study
-
First look: Samsung Galaxy S III
-
Spotify tunes into Australia
-
Telstra and Navman Wireless extend GPS tracking partnership
-
World’s eyes on Aussie NBN: Conroy
-
iPhone 5 rumour rollup for the week ending May 27
Get exclusive access to ARN's news, research and invitation only events. 
Comments
Cooper
Secure Virtualisation
Andreas, interesting article however I disagree with many of the principles discussed.
Secure virtualisation technology is a booming industry at the moment, with many companies proclaiming they have or are building a solution. The technology is not yet mainstream knowledge, as the developments are occurring at the high-threat end of the industry (defence + intelligence).
As usual, features and convenience far outweigh risk and security in deployment of new software technology, which is why companies like VMWare are so successful. Don't get me wrong, it's a great product, but security certainly wasn't built into the design from the ground up.
I'm also intrigued by the arguments that opening source code will automatically make things secure. Most major open source projects seem to be patching security flaws at a great rate - and have done for years. Intrinsically if the design is not secure, then the system will live a life of permanent patching to try and keep the bogies out. Besides which, allowing random people to add code to software is also fraught with risk - as it is very simple to hide bugs in source code (see http://underhanded.xcott.com/).
I also don't know that many trained software security engineers who spend their hours on the weekend hunting down bugs in the trillions of lines of open source code. They're normally trained and paid to do it by commercial companies.
The key to security is good design by well trained engineers. A formal process which ensures that the code only does what it should (and doesn't do anything else). Proper verification and validation that the system performs as intended. In short, something like a decent Common Criteria (EAL5 or greater) certification provides.
As you stated earlier, planes don't fall out of the sky. The software employed is also not patched often (if at all) over the 30 year life. This is because it's built right from the start and tested appropriately.
Cheers, Cooper.
Post new comment