News

Virtual Security a Big Concern at RSA

• By William Jackson
• 04/10/2008

"People are no longer talking about whether they should pursue virtualization," said Alan Shimel, chief strategy officer at StillSecure. "That train has left the station. There are too many benefits."

But along with those benefits come a whole new set of security concerns, which traditional hardware-based tools do not adequately address. Virtual machines contain all the vulnerabilities of the operating systems and applications they are running, along with vulnerabilities created by the new relationships and flexibilities of guest operating systems running side by side on a single platform.

"Once again, security was an afterthought," said Mark Boltz, senior solutions architect at Stonesoft.

"We see a lot of organizations rolling it out first, and only later dovetailing it into the security planning," said Chris Farrow, director of product strategy at Fortisphere, a start-up company focused on virtual machine management. "The problems of the past come back to bite us in new and different ways."

But as the presence of these companies, and others, at this week's RSA Security conference indicates, the industry is now paying attention to virtual security.

"Every year at RSA there is a belle of the ball," Shimel said. "I think this year virtualization and security is that topic."

"Nobody was talking about virtualization, and certainly not virtualization security, 18 months ago," Boltz said. "Now, virtualization and security are the topics of the year."

The attention primarily is on server virtualization, and the drivers are real estate and rack space, hardware costs, energy costs and speed of provisioning. By using virtualization software such as that from VMware to allow multiple operating systems to use the same hardware, costs can be reduced, provisioning time cut and resources can be used more efficiently. Resources once consigned to an outside datacenter can be brought in-house.

But this also breaks the tightly coupled relationship of hardware and software, with one operating system and one application on a server, and reduces or eliminates the ability to physically segregate elements.

"It's all dynamic, it moves around," Farrow said. "I can't just walk up to a rack and yank a cord out any more."

Administrators still have to worry about all of the old security issues, such as securing the perimeter and hardening, patching and configuring the operating system. But in addition to this, there are "relationships that didn't exist before," with one host and a number of guests sharing a common infrastructure and backplane, Farrow said. "If I compromise the host, I own all of the guests." And one compromised guest could compromise the host. A malicious virtual machine could even be hidden on a host.

The problems defending this environment are threefold:

• Technological: A lot of products such as firewalls, intrusion detection systems and various scanners and filters do not work effectively in this environment because they tend to protect the server-operating system-application as a single entity.
• Performance: Systems management tools do not work well in a virtual world, and monitoring tools that require copies on each virtual machine to keep an eye on activity can add overhead. In addition, there are licensing issues to consider as the number of copies needed increases.
• Politics: Administrators running the servers implement virtualization to solve their own problems. They often are not aware of or concerned with the impact this has on the security shop.

Despite the problems, virtualization is a fait accompli.

"The security industry's challenge is to make sure the environment is as secure as possible," Shimel said. "It doesn't have to be expensive. We can do some solid things to make it more secure."

VMware has made an Application Programming Interface available to security partners in its VMsafe program, to allow their products to interact with the hypervisor, or virtual machine monitor, the platform that allows multiple operating systems to run on a host and, within it, multiple applications to talk to each other.

"The overwhelming number of security products today are sold as appliances," Shimel said. Even with an API, this communications flow has to be sent out of the hypervisor for interpretation, and then returned. "That's an unnatural act. You are going to lose some of the benefits of the virtual ecosystem."

StillSecure is selling software tools rather than appliances. "One of the beauties of being pure software is that we can virtualize our software," and run within the hypervisor, he said.

Stonesoft also has concluded that software tools are the only way to secure a virtual environment, and is showing off its Stonegate for VMware firewall virtual private network on the show floor, the first of a line of products designed for the virtual world. The company plans a line of the tools, including IPS and SSL VPN.

The differentiator in the company's software is the ability to cluster and manage the software tools together with the physical appliances, using the same management consoles. "It's exactly like our physical appliances" as far as setup and management go, Boltz said.

What about the performance issue?

"Appliances, that's their claim, good performance," Shimel said. But for the work security software is being asked to do in the virtual environment, performance on the servers is adequate. "You don't have to have the 10Gbps backplane. With anti-virus, intrusion prevention, firewalls, spam filters, you don't need that kind of horsepower. At gigabit speeds you don't have a problem."

Boltz agrees. "Because of the Intel-based architecture of servers today, you are not going to see the same speed on the throughput as with the physical appliances." But the typical 700Mbps is adequate for most implementations.

And overhead is not a serious problem, he said. "The CPUs are very often completely underutilized," running only at 5 to 15 percent in the traditional environment. The top end for server usage probably is around 60 to 70 percent capacity to allow for peak demands, failover and balancing. Even with virtualized security tools, "you're not hitting your threshold for the high end of network performance."

Fortisphere's Farrow offered a few suggestions for ensuring security in a virtual environment:

• Education and training: IT, security and audit teams should be trained in the technology before it is rolled out.
• Reference and use the standards and guides for best practices that are beginning to appear. A set of practices from the Defense Information Systems Agency have been hanging fire for a year, he said, but many vendors are producing their own hardening guidelines.
• Look at how virtualization fits into your risk management strategy. If it does not fit well with your strategy, go to a vendor specializing in virtual security for expertise and tools.