Network Computingwww.networkcomputing.com

Gartner: Virtualization Can Weaken Security

Posted by Amy Larsen DeCarlo on April 5, 2007

Let's catalog Gartner's observations first: 1. Virtualization software--such as hypervisors--represents a new layer of privileged software that will be attacked and must be protected. 2. The loss of separation of duties for administrative tasks, which can lead to a breakdown of defense in-depth. 3. Patching, signature updates, and protection from tampering for offline VM and VM "appliance" images. 4. Patching and secure confirmation management of VM appliances where the underlying OS and configuration are not accessible. 5. Limited visibility into the host OS and virtual network to find vulnerabilities and assess correct configuration. 6. Restricted view into inter-VM traffic for inspection by intrusion prevention systems (IPSs). 7. Mobile VMs will require security policy and settings to migrate with them. 8. Immature and incomplete security and management tools. Their observations to fall into three categories: 1) Not new to virtualization (3,4--same as regular hardware appliances and other hotspare devices) 2) Useful, but obvious (1,7,8) 3) Only true if the admins aren't paying attention, or the architecture is poorly designed (2, 5, 6) Incidentally, BlueLane--with their "virtual IPS"--has got to be ecstatic with No.6 since they're the only vendors marketed squarely at that space right now. Jordan Wiens NWC Contributing Technology Editor

Gartner will present research later this month that suggests that companies that hurry to implement virtualization technology without first implementing best practices for security may be in for trouble.

The analyst firm said the combination of immature security tools for virtualized environments and the failure of companies to set and carry out appropriate policies to protect virtual machines (VMs) means that these virtual servers will be less secure than physical machines through 2009.

As is the case with any new technology that becomes an obvious target for security threats, Gartner said companies need to proceed with caution as they deploy VMs. The research firm suggested that too many businesses try to take the same approach to securing their virtual servers that they use to protect physical servers. This leaves VMs exposed to threats.

Gartner said effective security for virtualized environments ideally should begin before an organization even picks vendors or products.

Neil MacDonald, vice president and Gartner Fellow, will present Gartner's findings at the Gartner Symposium/ITxpo 2007: Emerging Trends, being held in San Francisco from April 22nd to April 26th.