Virtualization - What's Missing? Part 2 - Archie Reed’s Secure Observations Blog -
Virtualization - What's Missing? Part 2

So, what's missing today? Many things, especially as we look towards the approaching clouds.

I have been editing this entry for a while now, but an article came up this week that made me reference it over some of my own thoughts, as it nicely aligns with my thinking. The article was in this months Linux Magazine titled "The Hypervisor of my Dreams: A Virtual Wish List" by Ken Hess. In it he details several aspects of virtualization that are compelling, but more importantly the aspects of virtualization that need resolution and alignment, essentially:

  • High Availability
  • Superior Disk I/O
  • VM Cross-Compatibility
  • True Automated Workload Motion
  • Agnostic Management
  • Expanded Hardware Compatibility

I agree. For example, being more explicit about agnostic managment, we need common, tested API's for management - or at least a common set and map of functions. We are a long way from that today as vendors try to maintain competitive advantage.

Things will be tough for a while, as there are a few "standards" or approaches that would help here. The issue is that unless customers push vendors for these things, we'll have it tougher later on as we try to fill the gaps.

I would consider the following to also be on my wishlist, some of which are higher level, some lower:

  • Common security models including AAA, key management, trusted root/boot support and more.
  • Better process (server priority) and data classification capabilities and related tools
  • Agnostic network support for better monitoring and security support

The potential for increased introspection available through VMWare's VMsafe API is valuable, especially if you use VMWare's management tools, or one of their partners tools. However, you have an issue in a heterogenous environment with Xen or Microsoft's HyperV. You either end up with multiple management tools from each vendor, or relying on management software vendors, like HP, too spackle the gaps as much as they can.

We've seen the OVF (Open Virtualization Format) and related Distributed Management Task Force (DMTF®) Virtual Management (VMAN) initiaitves. OVF provides help with offline patching and inspection (integrity checking) of VM images, but it is a small start and it took years to get to a 1.0 release just this March. DMTF are also developing an Interoperability Program for Virtualization Management so there is good stuff happening. However, in relation to the requirement for VM cross compatibility this is far from it. Being able to inspect OVF images does not allow us to move from one VM vendor to another because the meta-data can be vendor specific.

Compare that approach with the VMWare vSphere and Cisco Nexus 1000 tie up cloud computing. Consider the positive and negative implications of tying your infrastructure to that networkng combination. It limits your flexibility for migration. It locks in a security model that may not meet your needs. That may be fine if you really want the Cisco security model extended to the cloud, there is nothing specifically wrong with that choice given Cisco's position in the network environment. However, that's a high cost for a lock in especially as you move out into cloud providers that may not support that networking option, and you're still left with the management issues. Many people like Cisco's management tools for security, many do not.

What else are we missing? Customer involvement. You need to get involved to make your needs heard by the vendors, in the standards, and to ensure that the required openness occurs!


Posted 05-15-2009 12:27 AM by ArchieReed
Powered by Community Server (Non-Commercial Edition), by Telligent Systems