IT Jobs
IT pros fight over virtualisation security
Survey shows contrasting attitudes.
By Ellen Messmer, Network World (US)
Published: 10:14 GMT, 19 December 08
IT managers are at odds with security pros as to whether virtualisation increases security risks according to a new survey.
The 2009 Security Mega Trends Survey from research firm Ponemon Institute - which also looked at attitudes on other topics, such as outsourcing and Web 2.0 technologies - shows roughly two-thirds of IT operations staff who responded said they felt virtualisation of computer resources did not increase information-security risks. But about two-thirds of information security professionals surveyed felt the opposite way.
A full three-quarters of the survey's 1,402 respondents, all active in US-based private sector firms or government agencies, said their organizations had already implemented virtualisation of their computer resources, with about 90 percent in both the IT and security camps saying they were "familiar" or "very familiar" with virtualisation.
The survey reflects the often upbeat attitudes about virtualisation expressed by experienced IT pros about how the technology, most commonly that of VMware, Microsoft or Citrix Xen, is bringing them the benefit of server consolidation.
"We started virtualisation in a development and test environment, and now the main applications we have using VMware in production instances are file and print servers," says Rich Wagner, director of IT infrastructure at Ohio-based Hexion Specialty Chemicals. Wagner said virtualisation hasn't raised red flags as far as security requirements. The main concern, he said, was "from a performance standpoint - the CPU and memory and disk I/O - in sharing a large box," with database servers seen as a resource-intensive application that might not be well-suited for virtualisation.
There's a far more sceptical view of virtualisation security often expressed by seasoned IT security pros, who harbour doubts that vendors on the virtualisation front have really sorted out or addressed the risks associated with the underlying hypervisor transformation.
"The security for the virtualisation itself is way, way behind," says Nelson Martinez, systems support manager for the City of Miami Beach, who is responsible for IT security in systems used by the city's 2,000 employees. Martinez said the city did make use of VMware for some web servers, but "I would never host any kind of database or my email server in that environment." There are performance and maintenance issues in running traditional security applications for each VM host application on each physical machine, while the industry still seems to be sorting out the security role the hypervisor can play, Martinez notes.
Jim Waggoner, director of product management at Symantec, says the three primary virtual-machine software providers, VMware, Citrix Xen and Microsoft, are each still working on new approaches to security in a virtual-machine environment that aren't yet out and available.
"We're in partnerships with all three of them," says Waggoner, noting the goal is to find ways for security applications running on virtual machines to use less CPU since users are already grappling with performance issues. "There's the expectation that security won't have an additional effect on the application," he says.
While he hasn't seen huge scepticism about security in virtualisation, Waggoner says he has encountered IT staff at companies who believe that once servers or desktops are virtualised, they "don't need any malware protection at all," a stance he would argue against.
In the Ponemon survey, the 825 individuals in IT operations and 577 information security professionals who answered questions about virtualisation were in general agreement that the most significant security risk associated with virtualisation was the inability to properly identify and authenticate users to multiple systems.
.gif)
Add your commentComments