Secure Virtualization: Achieve and Maintain IT Security in Virtual Environments

WHITEpaper
Secure Virtualization:
Achieve and Maintain IT Security in Virtual Environments
page 2 Executive Summary
page 3 Why Virtualization?
page 4 Virtualization Introduces Risk to the Enterprise
page 5 Controlling Virtual Environments: What to Watch For
page 5 Accelerate Control of the Virtual Environment
page 6 Configuration Assessment: Achieve a Known and Trusted State
page 8 Change Audit: Maintain a Known and Trusted State
page 9 A Complete Solution Across Virtual and Non-Virtual Systems
page 10 Summary
©2008 Tripwire, Inc. Tripwire is a registered trademark of Tripwire, Inc. All other product and company names are property of their respective owners. All rights reserved.WHITE?PAPERSecure Virtualization: Achieve and Maintain IT Security in Virtual Environments
Executive SummaryIn the computing world, a dramatic shift is taking place, enabling a new way in which IT departments manage services. The promise of a leaner, more efficient data center that provides businesses with more computing power for less money has all types of organizations clamoring to virtualize their data center-from small businesses to government agencies to large corporations. In fact, a Ziff-Davis publication reported that 70 percent of companies polled had already virtualized at the time of the study, or had plans to virtualize some time in 2008.1
In the rush to virtualize, many companies have forgotten the painful and expensive Who is Deploying Virtualization?lessons learned from introducing risk into "Approximately what percentage of your x86 servers are virtualized today?"the physical environment. Virtualization "Approximately what percentage of your x86 servers do you believe will be software makes it easier than ever for IT virtualized two years from today?"personnel to deploy and manage new Today (n = 203)servers and other infrastructure compo- Two years from now (n = 211)nents. However, these same beneficial 31%capabilities of virtualization also permit 0% to 9% 10%risk to be rapidly introduced into the 22%enterprise. To minimize exposure to risk, 10% to 19% 9%virtual machines must be afforded the 15%same protection from internal and exter- 20% to 29% 13%nal attacks as physical machines. They must also be protected from inadvertent 7%30% to 39% 9%error, an issue exasperated by the easy deployment of machines characteristic 4%40% to 49% 2%of virtual environments. As new virtual systems are created, used and de-provi- 8%50% to 59%sioned-all within a very short period of 20%time-controlling and accounting for these 2%60% to 69%rapidly deployed environments becomes 3%an enormously challenging, yet critical 3%task. Also, organizations are struggling 70% to 79% 11%with their ability to report on compliance 4%of virtual infrastructure. 80% to 89% 9% 2%To ensure virtualization is a success, it is 90% to 100% 13%vital that IT organizations take a prag- Source: Enterprise and SMB Hardware Survey, North America and Europe, Q3 2007matic approach to its risks and implement detective controls to mitigate those risks. Andi Mann, Research Director at EMA, has stated that while virtualization brings real benefits, it can also cause some issues, especially for organizations that do not implement policy-based management tools to administer this new environment.2 The effective change and configuration management processes so vital to the physical environment have become even more critical with the virtual environment. A robust configura-tion audit and control solution such as Tripwire Enterprise provides the proactive configuration assessment and automated change detection throughout the virtual environment to ensure the same level of stability is maintained within a virtualized environment as it is on stand-alone systems.
Page 2WHITE?PAPERSecure Virtualization: Achieve and Maintain IT Security in Virtual Environments
Why Virtualization?Customers embrace virtualization for a variety of reasons, although most are attracted to the cost reductions, management flexibility and efficiency touted as immediate benefits of a virtualized environment. A smaller percentage of businesses turn to virtualization to increase business resiliency-for example, t... [download for more]