Virtual Security a Big Concern at RSA
The IT industry has a long history of developing and implementing technology
first and thinking about security later. The latest example is the virtual machine,
a host hardware platform running multiple guest operating systems.
"People are no longer talking about whether they should pursue virtualization,"
said Alan Shimel, chief strategy officer at StillSecure. "That train has
left the station. There are too many benefits."
But along with those benefits come a whole new set of security concerns, which
traditional hardware-based tools do not adequately address. Virtual machines
contain all the vulnerabilities of the operating systems and applications they
are running, along with vulnerabilities created by the new relationships and
flexibilities of guest operating systems running side by side on a single platform.
"Once again, security was an afterthought," said Mark Boltz, senior
solutions architect at Stonesoft.
"We see a lot of organizations rolling it out first, and only later dovetailing
it into the security planning," said Chris Farrow, director of product
strategy at Fortisphere, a start-up company focused on virtual machine management.
"The problems of the past come back to bite us in new and different ways."
But as the presence of these companies, and others, at this week's RSA
Security conference indicates, the industry is now paying attention to virtual
"Every year at RSA there is a belle of the ball," Shimel said.
"I think this year virtualization and security is that topic."
"Nobody was talking about virtualization, and certainly not virtualization
security, 18 months ago," Boltz said. "Now, virtualization and security
are the topics of the year."
The attention primarily is on server virtualization, and the drivers are real
estate and rack space, hardware costs, energy costs and speed of provisioning.
By using virtualization software such as that from VMware to allow multiple
operating systems to use the same hardware, costs can be reduced, provisioning
time cut and resources can be used more efficiently. Resources once consigned
to an outside datacenter can be brought in-house.
But this also breaks the tightly coupled relationship of hardware and software,
with one operating system and one application on a server, and reduces or eliminates
the ability to physically segregate elements.
"It's all dynamic, it moves around," Farrow said. "I
can't just walk up to a rack and yank a cord out any more."
Administrators still have to worry about all of the old security issues, such
as securing the perimeter and hardening, patching and configuring the operating
system. But in addition to this, there are "relationships that didn't
exist before," with one host and a number of guests sharing a common infrastructure
and backplane, Farrow said. "If I compromise the host, I own all of the
guests." And one compromised guest could compromise the host. A malicious
virtual machine could even be hidden on a host.
The problems defending this environment are threefold:
- Technological: A lot of products such as firewalls, intrusion detection
systems and various scanners and filters do not work effectively in this environment
because they tend to protect the server-operating system-application as a
- Performance: Systems management tools do not work well in a virtual
world, and monitoring tools that require copies on each virtual machine to
keep an eye on activity can add overhead. In addition, there are licensing
issues to consider as the number of copies needed increases.
- Politics: Administrators running the servers implement virtualization
to solve their own problems. They often are not aware of or concerned with the
impact this has on the security shop.
Despite the problems, virtualization is a fait accompli.
"The security industry's challenge is to make sure the environment
is as secure as possible," Shimel said. "It doesn't have to
be expensive. We can do some solid things to make it more secure."
VMware has made an Application Programming Interface available to security
partners in its VMsafe program, to allow their products to interact with the
hypervisor, or virtual machine monitor, the platform that allows multiple operating
systems to run on a host and, within it, multiple applications to talk to each
"The overwhelming number of security products today are sold as appliances,"
Shimel said. Even with an API, this communications flow has to be sent out of
the hypervisor for interpretation, and then returned. "That's an
unnatural act. You are going to lose some of the benefits of the virtual ecosystem."
StillSecure is selling software tools rather than appliances. "One of
the beauties of being pure software is that we can virtualize our software,"
and run within the hypervisor, he said.
Stonesoft also has concluded that software tools are the only way to secure
a virtual environment, and is showing off its Stonegate for VMware firewall
virtual private network on the show floor, the first of a line of products designed
for the virtual world. The company plans a line of the tools, including IPS
and SSL VPN.
The differentiator in the company's software is the ability to cluster and
manage the software tools together with the physical appliances, using the same
management consoles. "It's exactly like our physical appliances" as far as setup
and management go, Boltz said.
What about the performance issue?
"Appliances, that's their claim, good performance," Shimel said. But for the
work security software is being asked to do in the virtual environment, performance
on the servers is adequate. "You don't have to have the 10Gbps backplane. With
anti-virus, intrusion prevention, firewalls, spam filters, you don't need that
kind of horsepower. At gigabit speeds you don't have a problem."
Boltz agrees. "Because of the Intel-based architecture of servers today,
you are not going to see the same speed on the throughput as with the physical
appliances." But the typical 700Mbps is adequate for most implementations.
And overhead is not a serious problem, he said. "The CPUs are very often
completely underutilized," running only at 5 to 15 percent in the traditional
environment. The top end for server usage probably is around 60 to 70 percent
capacity to allow for peak demands, failover and balancing. Even with virtualized
security tools, "you're not hitting your threshold for the high
end of network performance."
Fortisphere's Farrow offered a few suggestions for ensuring security
in a virtual environment:
- Education and training: IT, security and audit teams should be trained
in the technology before it is rolled out.
- Reference and use the standards and guides for best practices that are
beginning to appear. A set of practices from the Defense Information Systems
Agency have been hanging fire for a year, he said, but many vendors are producing
their own hardening guidelines.
- Look at how virtualization fits into your risk management strategy. If
it does not fit well with your strategy, go to a vendor specializing in virtual
security for expertise and tools.
William Jackson is the senior writer for Government Computer News (GCN.com).