Data centers have undergone tremendous transformation in the past five years. Virtualization has changed the architecture for servers, storage and networks. IT organizations are using management and provisioning automation to reduce operational cost, and increase responsiveness to business demands. But security is becoming more and more challenging. While virtualization has impacted every part of IT, security lags. As a result, most security products today do not easily support a virtualized infrastructure. Next generation security products are emerging however. Implemented as virtual software appliances or as virtual shields, they can provide security in a pool of virtual servers, regardless of operating system or application. Data center architects and security architects need to carefully choose security products that support -- and not subvert -- their data center virtualization strategies.
The Issue: A New World to Secure
Data centers today are truly "new" from every perspective: facilities, storage, management, computing, and networking. Although data centers have existed as long as enterprise computing itself has, a confluence of economic, enterprise, and technological changes is driving a major metamorphosis in data center design and implementation. This, in turn, is determining how data center and security professionals approach the problem of securing the data center and the enterprise network from threats, internal and external.
Server Virtualization
Server virtualization is one of the most discussed technologies of 2005 and 2006. Despite all the hype, we find many organizations are not only taking a serious look at server virtualization, but they also are generating substantial savings through increased utilization, purchasing postponement, standardization and management automation.
Virtualization software vendors offer some interesting management tools that augment the hypervisor software. One class of such tools is the "live-migration" tool, first implemented by VMWare in the VMotion technology. Other vendors, including XenSource, Virtual Iron, SWSoft and Microsoft, are reportedly working on similar tools allowing the live migration of virtual machines.
Live migration is a technology that can move a virtual machine to a different physical host, without any impact to end users. Effectively, the virtual machine stores its state onto shared storage, just prior to migration. On demand, the virtual machine is re-instantiated with its virtual-network connections and memory state intact, and can continue to serve users with no noticeable interruption. This type of solution is especially useful given the extreme availability demands we have documented in Nemertes' research with data center managers. When end-users demand 100% availability, one of the most common complaints we hear from IT managers is the loss of the "maintenance window" (ie, the ability to have planned downtime for services in order to perform maintenance on hardware or software). With live migration, administrators can move virtual machines moved off a server, without disruption, power down the server or reboot it for maintenance, and migrate the virtual machines back once they finish maintenance.
Another use of live-migration technology is load balancing. If demand for a particular service starts increasing rapidly, IT operations engineers can migrate high-demand virtual servers to another physical server with more CPU resources (with either fewer or no other virtual machines competing for the resources).
So, in addition to server consolidation, server virtualization is adopted for many other reasons. With features like live-migration it is possible to create a tremendously flexible, responsive, recoverable and cost-effective infrastructure. By orchestrating servers, storage and networking resources, virtualization tools and management platforms can deliver some of the benefits of on-demand computing today.
But, with all these benefits come increasing security challenges. Virtual machines are more difficult to secure, especially with today's static security devices. In order to achieve the most return on investment with server virtualization, an IT manager would have to pool servers into one large pool. This offers tremendous flexibility in workload allocation. But it also has the effect of flattening an infrastructure.
Previously, an enterprise might have had several DMZ-like zones of firewalls separating a Web server from an application server from a back-end database. Now, is that enterprise comfortable with all those devices floating in one pool of servers? Then again, the IT department could create several pools separated by physical firewalls or segment everything with VLANs, but it would lose the flexibility of server pooling.
