Virtualization - What's Missing? Part 1 - Archie Reed’s Secure Observations Blog -
Virtualization - What's Missing? Part 1

With all the hyper-growth in virtual computing you expect a level of competition between the vendors, but be aware of the trade-offs you make when choosing one vendor over another.

Is VMWare truly ahead of the crowd with their vSphere offering, or in reality does Xen offer the broadest level of integration and support through to the cloud already, given that Amazon's E3 runs on it, alongside all the derivatives (including Sun, Red Hat, Novell etc and of course Oracle's + Virtual Iron now). Could you test a VMWare VM and securely move it to a hosted provider, to take advantage of cloud efficiencies, whilst still managing it?

Not today...

Right now, we're at an interesting point in the evolution of virtual solutions, especially those relating to server platforms. The market is maturing and many enterprises are pushing from dev/test environments to production, and even further to the cloud or IaaS/PaaS vendors. The market is growing significantly, and we're still seeing an evolution in the attack patterns. To me, most vendors recognize this, but downplay the concerns in public. The vendor claims that small footprint hypervisors provide small to minimal attack footprints concern me as they show a naivety, and you should challenge any vendor who offers this as a security story. The increase in code increases risks, its a simple risk equation, and it is something enterprises need to factor into discussions versus the benefits that can be gained.

The issue that we all face as we try to utilize and optimize virtualization solutions is how do we better manage them, to avoid business failures and security breaches - i.e. risks. The answer lies between better management tools and API's, alongside standards. And what is missing today? Look for part 2...

 


Posted 05-13-2009 8:48 PM by ArchieReed

Comments

Conversations @ HP » Virtualization - What’s Missing? Part 1 wrote Conversations @ HP » Virtualization - What’s Missing? Part 1
on 05-15-2009 2:54 AM

Pingback from  Conversations @ HP » Virtualization - What’s Missing? Part 1

Powered by Community Server (Non-Commercial Edition), by Telligent Systems