VMware publishes its virtualization security guidelines
As it kicks off the second day of its VMworld conference, VMware is sharing newly published security and compliance recommendations for virtual environments. The vendor's guidelines focus primarily on optimizing use of management and security tools available from VMware parent company EMC and EMC's RSA security division.
VMworld product blitz: Hot technology for the virtual world
VMware's paper, "Security Compliance in a Virtual World," calls attention to the fact that any corporate computing infrastructure that has been virtualized in part or in whole must meet the demands of auditors to satisfy regulatory mandates such as the Payment Card Industry data security standards (PCI DSS), federal Health Insurance Portability and Accountability Act healthcare security requirements, or the European Union's data-privacy rules, among other regulations worldwide.
Just as they would for a non-virtualized computing environment, compliance auditors will demand evidence of controls that prevent unauthorized access, provide separation of administrative duties, isolate systems for processing protected information, and monitor access.
In the paper, VMware acknowledges that virtualization is still "relatively new" and that it "represents a paradigm shift in computing," so organizations "need to invest time and effort in learning how to get it right."
But virtualized and non-virtualized computing environments are profoundly different in nature. In virtualized environments, "there is no longer a one-on-one relationship between the physical host and server," VMware points out in the paper. "Now a virtual machine can run on one of many physical hosts, while a host can run a wide variety of virtual machines. This association changes dynamically, making it difficult to keep up with changes."
VMware adds: "The result is that configuration and change management practices become even more critical in virtualized environments."
Among the paper's recommendations, VMware says managers should take advantage of tools they already may use in their physical environments to lessen the burden of managing conformance in virtual infrastructures.
In terms of tools to use to meet compliance goals, the paper emphasizes VMware's vCenter and Orchestrator; VMware Update Manager; RSA's enVision security information management product; and EMC Ionix Server Configuration Manager.
The paper also notes that the Center for Internet Security and the Defense Information Systems Agency have each issued guidelines on configuration and platform hardening in virtualization.
Platform hardening relates to using "appropriate settings and removing unused code," says Bret Hartman, CTO at RSA. Hartman authored the paper with Stephen Herrod, CTO and senior vice president of research and development at VMware, and three others.
The reason for publishing "Security Compliance in a Virtual World" now, Hartman says, is that chief security officers are trying to anticipate security needs around virtualization and want more practical advice.
"The risks are here," Hartman says. "What makes virtualization different is there's a new kind of root access in the system."
Therefore, there should be "very strong administrative controls," says Hartman, recommending use of "multi-factor authentication," not just simple passwords, plus the establishment of a clear separation of duties.
In the paper, VMware acknowledges it wants to shift the security discussion away from what it sees as too much focus on hypervisor security alone, to the broader concerns of overall security compliance, auditing, logging and event collection.
A mix of virtualized and non-virtualized computing environments -- a commonplace situation in organizations today -- represents "a hybrid environment" that has to be administered and logged appropriately across both for regulatory reasons, Hartman points out, adding it's all taking place in an "evolutionary" way.
Date publication:
Author: Keylogger.Org Team
VMworld product blitz: Hot technology for the virtual world
VMware's paper, "Security Compliance in a Virtual World," calls attention to the fact that any corporate computing infrastructure that has been virtualized in part or in whole must meet the demands of auditors to satisfy regulatory mandates such as the Payment Card Industry data security standards (PCI DSS), federal Health Insurance Portability and Accountability Act healthcare security requirements, or the European Union's data-privacy rules, among other regulations worldwide.
Just as they would for a non-virtualized computing environment, compliance auditors will demand evidence of controls that prevent unauthorized access, provide separation of administrative duties, isolate systems for processing protected information, and monitor access.
In the paper, VMware acknowledges that virtualization is still "relatively new" and that it "represents a paradigm shift in computing," so organizations "need to invest time and effort in learning how to get it right."
But virtualized and non-virtualized computing environments are profoundly different in nature. In virtualized environments, "there is no longer a one-on-one relationship between the physical host and server," VMware points out in the paper. "Now a virtual machine can run on one of many physical hosts, while a host can run a wide variety of virtual machines. This association changes dynamically, making it difficult to keep up with changes."
VMware adds: "The result is that configuration and change management practices become even more critical in virtualized environments."
Among the paper's recommendations, VMware says managers should take advantage of tools they already may use in their physical environments to lessen the burden of managing conformance in virtual infrastructures.
In terms of tools to use to meet compliance goals, the paper emphasizes VMware's vCenter and Orchestrator; VMware Update Manager; RSA's enVision security information management product; and EMC Ionix Server Configuration Manager.
The paper also notes that the Center for Internet Security and the Defense Information Systems Agency have each issued guidelines on configuration and platform hardening in virtualization.
Platform hardening relates to using "appropriate settings and removing unused code," says Bret Hartman, CTO at RSA. Hartman authored the paper with Stephen Herrod, CTO and senior vice president of research and development at VMware, and three others.
The reason for publishing "Security Compliance in a Virtual World" now, Hartman says, is that chief security officers are trying to anticipate security needs around virtualization and want more practical advice.
"The risks are here," Hartman says. "What makes virtualization different is there's a new kind of root access in the system."
Therefore, there should be "very strong administrative controls," says Hartman, recommending use of "multi-factor authentication," not just simple passwords, plus the establishment of a clear separation of duties.
In the paper, VMware acknowledges it wants to shift the security discussion away from what it sees as too much focus on hypervisor security alone, to the broader concerns of overall security compliance, auditing, logging and event collection.
A mix of virtualized and non-virtualized computing environments -- a commonplace situation in organizations today -- represents "a hybrid environment" that has to be administered and logged appropriately across both for regulatory reasons, Hartman points out, adding it's all taking place in an "evolutionary" way.
