Securing Virtualized Infrastructure: From Static Security to Virtual Shields

IS SUE PAPER
Securing Virtualized Infrastructure: From Static Security to Virtual Shields By Andreas Antonopoulos, SVP & Founding Partner, Nemertes Research Executive Summary Data centers have undergone tremendous transformation in the past five years. Virtualization has
changed the architecture for servers, storage and networks. IT organizations are using management
and provisioning automation to reduce operational cost, and increase responsiveness to business
demands. But security is becoming more and more challenging. While virtualization has impacted
every part of IT, security lags. As a result, most security products today do not easily support a
virtualized infrastructure. Next generation security products are emerging however. Implemented
as virtual software appliances or as virtual shields, they can provide security in a pool of virtual
servers, regardless of operating system or application. Data center architects and security architects
need to carefully choose security products that support -- and not subvert -- their data center
virtualization strategies.

The Issue: A New World to Secure Data centers today are truly "new" from every perspective: facilities, storage, management, computing, and networking. Although data centers have existed as long as enterprise computing itself has, a confluence of economic, enterprise, and technological changes is driving a major metamorphosis in data center design and implementation. This, in turn, is determining how data center and security professionals approach the problem of securing the data center and the enterprise network from threats, internal and external.
Server Virtualization Server virtualization is one of the most discussed technologies of 2005 and 2006. Despite all the hype, we find many organizations are not only taking a serious look at server virtualization, but they also are
- 1 - ©Nemertes Research 2007
generating substantial savings through increased utilization, purchasing postponement, standardization and management automation. Virtualization software vendors offer some interesting management tools that augment the hypervisor software. One class of such tools is the "live-migration" tool, first implemented by VMWare in the VMotion technology. Other vendors, including XenSource, Virtual Iron, SWSoft and Microsoft, are reportedly working on similar tools allowing the live migration of virtual machines. Live migration is a technology that can move a virtual machine to a different physical host, without any impact to end users. Effectively, the virtual machine stores its state onto shared storage, just prior to migration. On demand, the virtual machine is re-instantiated with its virtual-network connections and memory state intact, and can continue to serve users with no noticeable interruption. This type of solution is especially useful given the extreme availability demands we have documented in Nemertes' research with data center managers. When end-users demand 100% availability, one of the most common complaints we hear from IT managers is the loss of the "maintenance window" (ie, the ability to have planned downtime for services in order to perform maintenance on hardware or software). With live migration, administrators can move virtual machines moved off a server, without disruption, power down the server or reboot it for maintenance, and migrate the virtual machines back once they finish maintenance (See Figure 1: "Virtualization For Continuity," on page 2).
Figure 1: Virtualization For Continuity Another use of live-migration technology is load balancing. If demand for a particular service starts increasing rapidly, IT operations engineers can migrate high-demand virtual servers to another physical server with more CPU resources (with either fewer or no other virtual machines competing for the resources). So, in addition to server consolidation, server virtualization is adopted for many other reasons. With features like live-migration it is possible to create a tremendously flexible, responsive, recoverable and cost-effective infrastructure. By orchestrating servers,... [download for more]