Word on the Street

Analyst Firm Gartner Cautions 'Tighten Up Virtual Server Security'

David Marshall — Tue, 16 Mar 2010 20:38:00 GMT

On Monday, Gartner announced a new and interesting report discussing security within virtual infrastructures. It stated that through 2012, nearly two thirds of virtualized servers will be less secure than the physical servers they replace. Wow, that's pretty staggering! Virtualization doesn't remove the need for security, but it does seem to often make folks a little more lax when it comes to processes and procedures for some reason.

The good news? Gartner predicts that by 2015, that number will decrease by half - where only 30 percent of virtualized servers will be less secure than the physical machines being replaced. Still, even that number seems pretty disturbing.

So why is that?

"Virtualization is not inherently insecure, but most virtualized workloads are being deployed insecurely as a result of the immaturity of tools and processes and the limited training of staff, resellers and consultants," said Neil MacDonald, vice-president and Gartner fellow.

Agreed. And virtualization management software needs to be easier to use, remove the complexity of the technology, provide better visibility, and have more collaboration between teams to help remove that old department silo mentality.

Gartner also states that at the end of 2009, only 18 percent of enterprise data center workloads that could be virtualized had been virtualized. However, they see that number increasing to more than 50% by the close of 2012.

The research and analyst firm identified six of what Gartner calls the most common virtualization security risks:

Information Security Isn't Initially Involved in the Virtualization Projects - Survey data indicates that 40% of virtualization deployment projects were undertaken without involving the information security team in the architecture and planning stages.
A Compromise of the Virtualization Layer Could Result in the Compromise of All Hosted Workloads - Gartner notes that hackers have already begun targeting this layer to potentially compromise all the workloads hosted above it.
The Lack of Visibility and Controls on Internal Virtual Networks Created for VM-to-VM Communications Blinds Existing Security Policy Enforcement Mechanisms - Most virtualization platforms include the ability to create software-based virtual networks and switches inside of the physical host to enable VMs to communicate directly. This traffic will not be visible to network-based security protection devices, such as network-based intrusion prevention systems.
Workloads of Different Trust Levels Are Consolidated Onto a Single Physical Server Without Sufficient Separation - At a minimum, enterprises should require the same type of separation required in physical networks today for workloads of different trust levels within the enterprise data center.
Adequate Controls on Administrative Access to the Hypervisor/VMM Layer and to Administrative Tools Are Lacking - Gartner recommends restricting access to the virtualization layer as with any sensitive OS and favoring virtualization platforms that support role-based access control of administrative responsibilities to further refine who can do what within the virtual environment.
There Is a Potential Loss of Separation of Duties for Network and Security Controls - Gartner recommends that the same team responsible for the configuration of network topology (including virtual LANs) in the physical environment should be responsible for this in virtual environments.

Why is Virtualization Management Adapting Slowly?

Dave.McCrory — Fri, 05 Mar 2010 20:50:00 GMT

When looking at the majority of management solutions for Virtualization presently available, the first thing that may strike you is that these solutions and products don't seem all that different from what was available 5 or ever 10 years ago. There...(read more)

Can Virtualization help IT become more Business Aligned?

Dave.McCrory — Wed, 24 Feb 2010 19:38:39 GMT

This is a question that is often asked by CIOs and LOB Managers, but the answer seems to be different from company to company. All companies want (or at least should want) IT to be aligned with the business, to support business groups and the goals of...(read more)

Columbus, OH VMUG Meets Mother Nature

David Marshall — Wed, 17 Feb 2010 19:41:00 GMT

"Neither rain, nor sleet, nor snow..." might be the motto of the United States Postal Service, but the VMware users in Columbus, OH and our Hyper9 team members are just as brave and share a similar belief. Even though we're from Austin, TX, we weren't going to let a little bit (or a lot) of snow stop us. Some of that can be attributed to bravery, and some of that could be the fact that we in Austin have no idea what snow is!

In spite of Mother Nature trying to ruin our fun, we had a great VMUG meeting in Columbus, OH on February 16th. I think the city received something like 8+ inches of snow that day, and a lot of businesses closed down because of it. It was touch and go for a while there; but luckily, there was a small enough window for our flight to sneak through and arrive in Columbus without being diverted somewhere else.

Thanks to everyone who made the journey and came out to the meeting. And thanks to VMUG leaders Randy and Eric for helping to coordinate everything.

We'd also like to give special thanks to Steve Gruetter, a director at Platform Lab. Platform Lab provides a great service, offering short-term physical or remote access to IT hardware, software and massive amounts of bandwidth for all types of companies for the explicit purpose of IT testing and projects. And they also just happen to be the host facility for Columbus, OH VMUG events. On this day, while the facility itself was closed from doing normal business due to bad weather, Steve was able to keep the facility open so that the VMUG event could still take place.

We had some 50+ brave individuals attend the meeting, and that included the good folks from Panera Bread who we hired to cater breakfast. Nothing better than hot coffee, bagels and pastries on a snowy morning, eh?

At the meeting, Hyper9 talked about the practical ins and outs of virtualization reporting and best practices that address the challenges related to storage (how to squeeze the most disk space out of your environment as possible), VM sprawl (how many VMs do you actually have and which VMs are you actually using?), and management reporting (who owns what and how much does it cost?).

We hope everyone had a good time at the event. And we certainly enjoyed speaking with and meeting everyone. Hopefully, we'll be invited back to Columbus in the future - Spring or Summer preferred. :)

What happened to the Goal of Business Agility?

Dave.McCrory — Wed, 17 Feb 2010 17:27:00 GMT

This was a mantra that many of the large software companies were speaking about several years ago ( Microsoft , IBM , SAP , ...), "what happened to Business Agility?" There was definite interest from businesses, as being able to react more quickly...(read more)

How Cloud Providers are Spreading Their Bets...

Dave.McCrory — Wed, 10 Feb 2010 16:13:00 GMT

As the Cloud Market continues to take shape, many of the Cloud Providers have chosen to provide combinations of PaaS, SaaS, and IaaS. The reasoning behind this is that the market continues to be uncertain and probably will remain uncertain into the foreseeable...(read more)

Nicira = Virtualization + Networking * Diane Greene

Dave.McCrory — Mon, 08 Feb 2010 19:48:00 GMT

After reading a news bit on virtualization.info covering a stealth company called Nicira and its connection to Diane Greene (former CEO and Co-Founder of VMware), I thought it would be interesting to dig deeper into what was being done by Nicira and why...(read more)

What is a Spring Container and what might VMware want to do with it?

Dave.McCrory — Wed, 03 Feb 2010 19:14:00 GMT

What is a Spring Container? If you are a virtualization administrator type and heard about VMware's acquisition of Spring Source and therefore control of the Spring Framework (including the Spring Container) you might be wondering why you should really...(read more)

Wikipedia and Cloud APIs (Universal Cloud APIs - Revisited)

Dave.McCrory — Mon, 01 Feb 2010 20:51:00 GMT

There aren't many independent sources covering "Cloud APIs" - whether referring to "Independent" groups, standards bodies, or specific providers. This lack of sources without an agenda of some type makes it incredibly difficult...(read more)

Why are some Apps better in the Cloud?

Dave.McCrory — Wed, 27 Jan 2010 15:56:00 GMT

Some applications are more easily adapted or are just plain better running in the Cloud than they are hosted or running locally. Some people don't necessarily subscribe to this notion, however after looking as some of the reasoning behind this, it...(read more)

Universal Cloud APIs Examined

Dave.McCrory — Mon, 25 Jan 2010 16:35:00 GMT

With the recent announcement of the vCloud API SDKs for both Java and Python, it seemed as though it might be relevant to investigate the available Cloud APIs, what they do, where they come from, and how they work. There are four Cloud APIs that are abstraction...(read more)

Is Cloud Computing Really New? (The History Behind the Cloud)

Dave.McCrory — Wed, 20 Jan 2010 20:45:00 GMT

Is Cloud Computing Really New? Where did it come from? These are questions that are often unanswered or not covered in all of the buzz that companies like Google , VMware , and Microsoft are putting out there around the Cloud. Let's step back and...(read more)

VMware GO - VMware Officially Enters the Hosted / Cloud Application Business

Dave.McCrory — Fri, 15 Jan 2010 19:50:00 GMT

With Yesterday's announcement of the launch of VMware GO, VMware has finally entered the Hosted (Cloud/Web) Application market. Providing services to small and medium businesses to more easily manage their ESXi implementations. On the management side...(read more)

Will Cloud Computing help 2012 become the end of IT as we know it?

David Marshall — Thu, 14 Jan 2010 20:38:00 GMT

The year 2012 is surrounded in a shroud of mystery, with many believing that some sort of cataclysmic or transformative event will take place December 21^st or 23^rd of that year. Predictions of impending doom stem from interpretations made about the Mayan and other ancient civilizations and the Long Count calendar which is said to "end" sometime around that same date in 2012.

IT folks aren't strangers from thinking about facing doom and gloom in the future. While we may not be following the Mayan calendar at work, our own calendar has certainly put misplaced fear in many of our hearts. Remember the "Year 2000" problem or Y2K? I for one was certainly glad the Millennium Bug didn't end my career like it was supposed to.

But Gartner recently announced a bit of prognostication that got me thinking. Yesterday, the analyst firm launched their 2010 and beyond predictions which spanned some 56 markets, topics and industry areas, with around 250 predictions in total.

The one that quickly caught my eye stated: "By 2012, 20 percent of businesses will own no IT assets."

What? No IT assets in one out of every five companies in as little as two years from now? Wow! That's a pretty powerful statement and quite a bold prediction.

Gartner says this will be the result of virtualization, cloud-enabled services, and employees bringing in their own desktops and notebooks to work.

Gartner writes, "The need for computing hardware, either in a data center or on an employee's desk, will not go away. However, if the ownership of hardware shifts to third parties, then there will be major shifts throughout every facet of the IT hardware industry. For example, enterprise IT budgets will either be shrunk or reallocated to more-strategic projects; enterprise IT staff will either be reduced or reskilled to meet new requirements, and/or hardware distribution will have to change radically to meet the requirements of the new IT hardware buying points."

This prediction is not entirely a surprise, however; as we have witnessed this change happen over the last seven years to hosted Websites and e-mail. Most companies are using outside providers for these types of services today rather than burdening their internal IT staff.

Virtualization has definitely done its part thus far in shrinking down the data center footprint of server equipment. But this latest prediction has one in five companies with a zero footprint - NO IT assets!!! That seems like an awfully heavy burden to place on the cloud community. It means that cloud technology will need to mature a lot faster than has virtualization in order to reach those goals.

If we plan on getting to a zero footprint of IT assets, cloud technology definitely seems to have the best chances to get us there; but that would also assume we are talking public cloud technology, and not private. In the interim, many may choose to attempt a hybrid cloud in order to help bridge the gap. But the clock is ticking, so people need to get moving if we are going to meet a 2012 time frame.

As we enter 2010, 2012 no longer seems to be that far off into the future. So if you live in the world of IT, make up your mind. Which will it be... the end of IT as we know it? Or will it be the end of the world itself? I saw the movie... so I'm voting that we change IT if we have to!

VIDEO: VMware vSphere 4 in a Box - Running VMware ESXi 4 inside Workstation

David Marshall — Tue, 21 Jul 2009 20:34:00 GMT

David Davis does it again with yet another extremely helpful video, this time, an 18 minute demo that shows how to run VMware vSphere 4 inside a VMware Workstation virtual machine. This is a great way to test and learn about VMware vSphere if you don't have any spare hardware.

And stay tuned, Train Signal is going to be releasing his VMware vSphere training course soon enough.