InformationWeek Member Content
Article Preview
For Full Access Log In or Register

News

Virtualization Security: Where's The Innovation?

Kurt Marko
Contributing Editor
See more from Kurt
Connect directly with Kurt: Bio  |  Contact

Server virtualization creates new security threats while turning the hypervisor into a network black hole, hiding traffic from traditional hardware defenses--problems a new breed of virtualization-aware security software tackles head-on.

Kurt Marko | June 22, 2012 08:00 AM
Virtualization is standard operating procedure. It also breaks conventional defense mechanisms by hindering visibility and control, creating new attack avenues, increasing complexity, and blurring administrative roles between network and server teams. Our 2012 InformationWeek State of the Data Center Survey shows there's no going back, even if we wanted to: Half of 256 respondents will have at least 50% of their production servers virtualized by the end of next year; 26% will have 75% or more. So it's unfortunate that innovation in the virtualization security market is stalled. The holdup is twofold: First, the lack of a publicized breach targeting the hypervisor has made IT complacent. And second, there's an unwillingness among vendors to take on VMware; it owns most of the market and controls the APIs, a big deal given the scant enterprise adoption of rival server hypervisors.

That leaves us with a limited number of major products for hypervisor network security. Two of them, VMware's own vShield and Juniper's vGW (Virtual Gateway, acquired from Altor), use the APIs provided under VMware's VMsafe security program. Cisco, the other big player in this market, bases its technology around the proprietary Nexus 1000V virtual switch, which was developed in cooperation with VMware but isn't dependent on VMsafe. Cisco hasn't completely hitched itself to VMware's wagon; it has hinted that the technology will be usable with other hypervisors.

If you run a non-VMware hypervisor, you should be looking at Vyatta's Network OS product, which works with Citrix XenServer and Red Hat KVM, and, like VMware's vShield Edge, includes NAT and DHCP servers. Vyatta also adds a sophisticated routing engine with support for IPv4 and IPv6 dynamic routing protocols like BGP, OSPF, and RIP.

...

Subscribe to RSS

Resource Links