Think you can secure your virtual machines with the security you have in place? Today’s guest post comes from David Strom, and he warns you to think again.
The protective technologies that are plentiful and commonplace in the physical world become few and far between when it comes to the cloud. And while few attacks have been observed in the wild that specifically target VMs, this doesn’t mean you shouldn’t protect them.
So why can’t you just use a regular firewall and intrusion prevention appliance to protect your cloud? Several reasons. First, traditional firewalls aren’t designed to inspect and filter the vast amount of traffic originating from a hypervisor running ten virtualized servers. Second, VMs are so easily portable that tracking down a particular instance isn’t always something that a traditional IDS can do. Third, because VMs can start, stop, and move from hypervisor to hypervisor at the click of a button, protective features have to be able to handle and recognize these movements and activities with ease. Finally, few hypervisors have the access controls that even the most basic file server has: Once someone can gain access to the hypervisor, they can start, stop, and modify all of the VMs that are housed there.
There are a growing number of vendors and products in this space. Over the past year, the pace of mergers and acquisitions has picked up as the major virtualization and security vendors try to augment their offerings and integrate products.
- VMware purchased Blue Lane Technologies and incorporated their software into its vShield product line.
- Juniper Networks purchased Altor Networks Virtual Firewall and is in the process of integrating it into its line of firewalls and management software.
- Third Brigade is now part of Trend Micro’s Deep Security line.
There are other vendors, as well, in this space:
- Beyond Trust Power Broker Servers for Virtualization
- CA’s Virtual Privilege Manager
- Catbird vSecurity
- Fortinet FortiWeb VM
- Hytrust Appliance
- Reflex Systems Virtualization Management Center
Sadly, no single product can cover the typical security features found in most corporate data centers: Firewalls, IDS, anti-virus/anti-spam, and access controls. Some products have different modules for each of these functions (like Reflex and Trend) while some specialize in particular areas (such as Hytrust for access controls and compliance). All of these products cover VMware servers, but none of them protect Microsoft’s HyperV installations. A few (such as Catbird and BeyondTrust) will also protect Xen hypervisors.
Finally, if you get involved in testing these products, be prepared to spend some time understanding how they insert themselves into your cloud-based infrastructure. Hytrust, for example, looks like a load balancing appliance in that it segregates your virtual network segments. Others, such as Reflex or Catbird, require agents to be installed directly on the ESX host itself.
David Strom has many interests: as a former IT manager, a publication editor, a Web site creator, a podcaster and video producer, and a professional speaker. He writes several blogs including strominator.com, webinformant.tv, and mediablather.com. He lives in St. Louis and can be found on twitter @dstrom.
Last week, I spoke to Salesforce.com’s head of platform research, Peter Coffee, about how the attitude toward cloud computing needs to change. But is this “shake off your fears” method exclusive only to big business? Ralph Plunkett, MIS Operations Manager at Electronics Research, Inc., a broadcast services and products provider, thinks so. Beyond that, he doesn’t think SMBs are being included in the talk about cloud adoption, nor are their issues being covered or addressed.
“Smaller shops don’t have the budget that bigger shops do,” Plunkett said. “One thing I’ve run into is that we don’t have redundant Internet connections. We can’t put all of our applications running on that. If you rely on technology at all, that’s kind of foolish.”
Our conversation was momentarily interrupted when Plunkett had to address a cooling problem in his server rooms. He’s a busy guy, but he does his best to anticipate hiccups down the road. “It’s just good planning,” he pointed out. His is not a resistance to new technologies, or even to sending his data out into the cloud. His hesitation is simply a resources and availability concern. With three outages in the three years he’s been with the company and only a bonded T line, Plunkett estimates they’d need at least 3 – 4 times their current bandwidth.
He does use some software-as-a-service offerings. “It makes sense for some things to be hosted out,” he said, such as ERI’s website, which shifted to the cloud about a month ago. Plunkett also named AppRiver, an SaaS spam filter, which has helped to cut down on the inflow of potentially dangerous emails, as recognized by his employees. But in a company that only recently invested in a big enough generator to protect against winter-induced outages, cloud security and availability are a major concern.
So what concerns are you harboring about the cloud that are direct results of the size of your business? How do you balance those concerns with the push to go to the cloud? Share your stories in the comments section or send me an email at Melanie@ITKnowledgeExchange.com.
There’s quite the reaction across the blogging community today to a particular article by ComputerWorldUK: Cloud computing is just outsourcing, says Information Security Forum. The article quotes Adrian Davis, principal research analyst at ISF, from his speech at (ISC)2 SecureLondon Conference, including this bit about the insecurity involved in trusting cloud security to providers:
“If you don’t know the classification or sensitivity of information, how do you judge what goes in the cloud and what doesn’t? How does the cloud service provider back up and destroy the information? Is there proof that everything they do happens?” Davis said.
While the issue at hand seems to be that most people disagree with the assumption that cloud services are another form of outsourcing – like David Lacey, who also attended (ISC)2, disagrees in his own IT Security blog – there is another aspect of assumptions and fear-mongering happening here. While I would agree with the caution that Davis is strongly suggesting the enterprise exercise, it seems more users would benefit from being educated on the ways to avoid his seven deadly sins rather than having a finger wagged at them. Mike Vizard blogged about one motivation for raising security concerns related to the cloud:
In face, most of what gets ascribed to security in the cloud are really data management and compliance issues, or simply deliberate attempts to create concern over security as part of an effort to protect jobs that might be threatened by cloud computing.
Is that a fair assessment? Is there simply a lack of understanding surrounding the technology that has spun off into a misunderstanding of security surrounding that technology? How do you respond when you hear negativity toward cloud security: Do you run away or desire to learn more about how to avoid common pitfalls?
Let us know in the comments section or send me an email at Melanie@ITKnowledgeExchange.com.
I had the opportunity to sit down with MokaFive CTO and founder John Whaley while I was at RSA, and we caught up on the adoption of desktop virtualization, where the hypervisor belongs, and more. He was even so kind as to allow me to shoot some video, though the cafe where we were meeting makes the audio a little scratchy.
One thing John brought up was the mobile vs. desktop virtualization debate. His stance was that, far from detracting from desktop virtualization, mobile devices and tablets actually helped start the conversation in getting companies to seriously look into a broader desktop virtualization strategy.
“A lot of times people want to use their iPhone and hook it up with their corporate e-mail, or use an iPad at work,” he said. “That starts the conversation about what are we going to do about people wanting to bring their devices in, and how are we going to manage them.”
Whaley also said that that desktop would still dominate for the foreseeable future, even in more tablet-friendly businesses. “It’s not ‘We’re going to give iPads only,'” he said “It’s, in every case, an iPad is in addition to a laptop. It’s good for consuming but it’s not as good for creating content.”
[kml_flashembed movie="http://www.youtube.com/v/ScUKZoDwJzw" width="425" height="350" wmode="transparent" /]
Sure, everyone loves a good robot story, but what are we really interested in when it comes to Watson, The Jeopardy Wild Card? David Ferrucci and his team’s brainchild has some impressive specs, in addition to its record-breaking performance:
- 10 racks of 90 Power750 servers
- 2,880 cores in Watson’s system
- 15 terabytes of RAM
- Equivalent of about 6,000 high-end home PCs
In addition to the enviable hardware setup, Watson’s software included the ability to understand language, making it possible for it to compete in the game show. Ferrucci’s team of two dozen wrote a mixture of algorithms in an attempt to emulate the human brain. To aid the supercomputer in recognizing letters of the alphabet, IBM input millions of images to allow Watson to determine recurring qualities in order to recognize the form of a letter it hadn’t yet seen.
Because Watson couldn’t be connected to the Internet during the game, Ferrucci’s team input information from The World Book Encyclopedia, Wikipedia.org, the Internet Movies Database, a large portion of the New York Times archives, and the Bible. The software is also capable of synthesizing data, or machine learning: With each question Watson gets correct, it is able to gather the commonalities amongst correct responses and improve its game.
No reason to panic, though. IBM’s Ferrucci assures the public that Watson is not the first step toward a realization of iRobot. If it is, however, we still have Asimov’s three laws to protect us:
1. A robot may not injure a human being or, through inaction, allow a human being to come to harm.
2. A robot must obey any orders given to it by human beings, except where such orders would conflict with the First Law.
3. A robot must protect its own existence as long as such protection does not conflict with the First or Second Law.
- Saturno wishes he had more time to read and learn everyday, but he makes do with the time he has. When he’s looking for something security-related, he checks out Security Blanket, which covers “automated, consistent Linux & Solaris lock down.” When it comes to cloud security, Chris Hoff’s Rational Survivability, Bruce Shneier’s security blog, and Craig Balding’s CloudSecurity.org make the cut.
- RamseyB enjoys Tony Bradley’s IT Knowledge Exchange hosted blog The Security Detail and Wired.com’s privacy, crime and security online blog, Threat Level.
- Mortimer1 recommends Trend Micro’s Cloud Security blog and seconds Saturno’s vote for CloudSecurity.org.
- Spadasoe enjoys checking out the Microsoft Security Response Center.
Don’t have time to read these blogs? Why not listen to one! Check out this vimeo video based on Craig Balding’s blog post “Are You Trying to Pin the Tail on the Cloud Donkey?”
Are we missing any of your favorite cloud security or just plain security blogs? We’d love to have them on our list, so leave them in the comments or send me an email at Melanie@ITKnowledgeExchange.com! For more tech blogs, check out the community’s member and editorial blogs.
William J. Lynn, III, U.S. Deputy Secretary of Defense, helped kick off RSA 2011 with a keynote, as Security Bytes nicely covered. Listening to his talk, I was struck by how similar the fundamental issues the Department of Defense is grappling with are to the day-to-day problems the good folks in our IT community forums are tackling. In fact, the five pillars of Department of Defense’s Cyber Strategy 3.0 that Lynn laid out might make bullet points for your next pitch on why, yes, IT actually does matter to a company’s strategic success.
As Michael Mimoso reported earlier, cryptography and security pioneers Ron Rivest, Adi Shamir and Len Adleman were honored at the 2011 RSA conference with the Lifetime Achievement Award. While it might be a bit of an obvious choice – RSA is named after them and all – the tribute video beforehand was excellent as both a primer on the cryptography and history that underlies modern security practices. It’s not embeddable, but you can pop over to RSA’s conference page to watch the presentation, which runs about 10 minutes and is completely worth it.
It was a great, sentimental crypto-geek moment … until it was shattered by a weird pop montage touting the conference’s take on Alice, Bob and Eve with a weird mashup of Madonna and Journey (I think). When will people learn to leave well enough alone? In the meantime, go watch the video.
It’s a common belief these days: Everything is heading to the cloud. With words such as “migration” dictating much of the conversation surrounding cloud, it’s safe to infer that many people view the cloud as an approaching technology rather than one that’s already here.
Peter Coffee, head of platform research for Salesforce.com, disagrees with this feet-dragging mentality. “The cloud is certainly available to everyone,” said Coffee. First of all, he said “migrate” is an inhibiting word when approaching the cloud. Coffee suggests looking for applications you wish you had but haven’t been able to create. Do you have a business process that’s organized primarily in spreadsheets and email? Consider building an application that can automate that process and deploy it in the cloud.
Yesterday I wrote about how Lenovo, talking up its new Full-Drive Encryption (FDE) tools, bragged that the technology was used to secure Coca-Cola’s famously guarded secret recipe. Well, that security measure (if accurate) was recently trumped by a 125-year-old vulnerability and an unlikely Black Hat: Ira Glass and NPR’s This American Life, which stumbled upon a 1979 stock photo which, the program’s reporters believe, was actually a photo of the original handwritten recipe.
It’s not the first time the alleged recipe has been released (Wikipedia currently lists a host of candidates), but the release highlights a theme I heard again and again this morning from the wonkier side of RSA: Technology is an incredibly small part of any true security solution. Adi Shamir, the “S” in RSA, made a point of saying that even the bleeding edge in security, and particularly cryptography, can do very little to nothing to stop WikiLeaks-style attacks or even Stuxnet attacks.
The end result is this: Enterprises (and governments) must constantly evaluate the total security scenario and always consider their assets compromised, just like the the NSA does, while evaluating ways to minimize harm.