Virtualize Securely - VM Introspection and Automated Security in Action

Johnnie Konstantas

Subscribe to Johnnie Konstantas: eMailAlertsEmail Alerts
Get Johnnie Konstantas: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn


Blog Feed Post

Not Securing Your Virtualized Data Center is Madness in March and Any Other Time

This is the core message of a recent Gartner report which outlines the security risks associated with virtualizing critical workloads and what can be done to mitigate exposure. This research is an update to a report that was first introduced in 2007 and now has expanded to include thousands of client discussions that Gartner has conducted since then. While the full research report may not be available to everyone (Gartner does offer some free research with registration) a summary of the six key security risks can be obtained from a number of sources including this SearchSecurity.com article.

The key findings and recommendations of the report are particularly apt and timely, as virtualization nears as the de facto platform for green data centers and private clouds, and will be implemented at a rapid clip by many enterprises looking to save operating costs and increase data center performance and scale. The report’s key findings and recommendations have been paraphrased below although we encourage you to obtain the full report.

Key Findings

  • Virtualization in and of itself is not insecure. However, virtualized workloads don’t have the benefit of the kinds of security that physical servers have, in part because it is new technology and the personnel that manage it are unfamiliar with the specific risks.
  • The enterprise data centers of the near future are very likely to be based on virtualization.
  • Virtualized networks are complex and highly dynamic. New virtual machines can be easily created and are mobile, meaning workloads can move across physical locations with ease. This creates new security risks.

Recommendations

  • Security and management of your virtualization platform should be elevated to a primary business objective.
  • Think about the security policies that group your virtual machines and workloads into levels of trust and protection. This will allow for the best leverage of means to enforce.
  • Look for frameworks that marry physical and virtual network security for the purposed of management, policy definition, monitoring and reporting.
  • Don’t forget the cloud. To the extent that virtualization may be the underlying platform of your cloud services provider, the same recommendations listed should apply to the provider who must furnish some proof of security.

So as you move forward with your virtualization and private cloud project ask yourself which security risks apply to your environment. Are you virtualizing critical workloads? Are you impacted by regulatory compliance mandates and audits? Are segregation of duties and segmentation of resources key for secure operation in your environment ? When calculating the savings and ROI from virtualizing have you taken into account the impact that security has on the bottom line and what your options are?

And if you don’t know how to get started toward the answers we can help.

Read the original blog entry...

More Stories By Johnnie Konstantas

Johnnie Konstantas heads Gigamon’s security solutions marketing and business development. With 20+ years in telecommunications, as well as data and cybersecurity, she has done a little bit of everything spanning engineering, product management and marketing for large firms and fledglings.

Most recently, she was the VP of Marketing at Dato, a company pioneering large-scale machine learning. She was also VP Marketing at Altor Networks (acquired by Juniper), an early leader in virtualization security and at Varonis Systems. Past roles have included product management and marketing for Check Point, Neoteris, NetScreen and RedSeal Systems.

Johnnie started her career at Motorola, designing and implementing large-scale cellular infrastructure. She holds a BS in Electrical Engineering from the University of Maryland.