Options are scarce for protecting applications when they are deployed on virtual servers within the same physical machine, according to a recent Gartner report.
Network firewalls located external to physical servers that support multiple virtual servers cannot filter traffic between virtual servers, according to the report "Limited Choices Are Available for Network Firewalls in Virtualised Servers." This means applications on the virtual servers can communicate undetected with other virtual servers, perhaps in violation of security policies.
This is because virtual machines can talk to each other directly within the same hardware platform, giving external firewalls and intrusion-prevention systems (IPS) no chance to inspect or even monitor the traffic.
It is possible for communications among virtual servers to be routed out of the physical box to an external firewall, but that is inefficient, Gartner said. Firewalls that can separate these virtual servers are clearly needed, "however, few vendors offer full-featured solutions," the report said.
Some firewalls from vendors including Astaro, Blue Lane, Catbird, Enterasys and Reflex Security address some of these problems, while others including Stonesoft and StillSecure have plans to address them, Gartner said.
Two of the major firewall vendors, Cisco and Juniper, have shifted their products to hardware-based firewalls and therefore lack the software firewalls that might fit into virtual environments, a Gartner analyst who helped write the report, Greg Young, said.
With physical servers, businesses had set up Web applications in isolated network segments -- demilitarised zones -- separated by firewalls from databases. In a virtual environment, that separation can become blurred, Young said.
It is possible to place firewalls on each virtual machine, but that saps processing power that virtual machines are designed to conserve, the report said.
The solution is setting up firewalls on virtual machines within physical servers so these firewalls can monitor and filter traffic among the other virtual machines, Young said. Vendors need to certify that these software-based firewalls work in virtual environments so customers can install them with some confidence that they will be reliable, he said.
"Customers have high-availability requirements, and don't want to worry about problems if they don't install properly or a patch doesn't work," Young said.
Customers will want similar virtual offerings from next-generation firewall vendors as well, he said. These new security products include a traditional firewall plus IPS, according to Gartner's definition. Customers will want to limit which virtual machines are allowed to communicate with each other and to detect when malware may be at work between virtual environments, Young said. Reflex Security is working on the IPS aspect of protecting virtual servers, he said.
Management tools for virtual security software, such as configuration control, will be important so network administrators can see that it is performing its functions properly. Failures in virtual environments might not be as apparent as in the hardware-server world.