June 09, 2008, 10:40 AM — Security issues often seem to smolder more than burn, but these six are certainly
capable of lighting a fire under IT professionals at a moment's notice. Handle
with care.
Is server virtualization worth the risk?
The benefits of moving away from traditional servers to virtual-machine
(VM) arrangements are the cost savings in hardware consolidation and remarkable
flexibility. But less-welcome consequences can be security gaps and virtual-server
sprawl, risks that draw fire from auditors.
VM security too often is being addressed after the fact, says Douglas Drew,
senior consultant with BT's emerging technologies office and an auditor for
the Payment Card Industry (PCI) standard. "How do you handle access control
or auditing? Suppose I migrate an instance of a virtual machine from rack A
to rack B: Is one a locking rack that needs a physical badge to get to the console
and the other not? Does the VM hypervisor allow for separation of administrators
A and B so A can only logically touch systems A and administrator B only touches
B? How are you re-upping the risk assessment based on the architecture change?"
Like more traditional networks, the VM environment, whether based on VMware,
XenSource or Microsoft, calls for applying best practices defined under the
ISO 27002 standard for secure systems, Drew says. "We've seen some cases
where people are slow to adopt VM because they haven't gotten their arms around
this."
And VM software
out of the box won't suffice for security, many say.
"The virtual machines are mobile, they're designed to be mobile,"
says David Lynch, vice president of marketing at Embotics, a start-up that makes
VM life-cycle management software. "You take a physical server and make
a clone of it. You lose the identity of the physical server, but your existing
management tools are based on the idea you have a physical server."
As designed today, VMware's VirtualCenter management won't prevent VM prawl
because VM ID numbers can be changedand re-set, Lynch contends. He adds it's
not possible to ensure a unique VM ID system for an enterprise using more than
one VirtualCenter.
The Embotics software, which works with VirtualCenter, tries to compensate
by using a cryptographic hash, combined with VM meta-data, to brand a VM ID
as legitimate and authentic. Other start-ups, including Fortisphere
and ManageIQ,
also are tackling the VM sprawl issue.
Some security vendors are convinced that the main VM software developers are
in such a rush to get their products out to grab market share that as Andrew
Hay, product program manager at Q1 Labs, puts it, "security is an afterthought."
Hay notes there's no Netflow-enabled virtual switch to help with activity monitoring.
"You're creating a separate network that happens to reside on a box,"
Hay says. "But no one pushes for flow analysis in the virtualized world."
Should all this stop IT managers from going virtual? The bottom line, according
to Hay: "It would be best to research your options before going fill tilt."
Does stopping data leaks lure lawyers?
Data-loss
prevention (DLP) -- or call it data-leak protection -- lets you monitor
content for unauthorized transmission. But organizations gaining experience
with it are finding DLP sheds so much light into the darker corners of the corporate
network that IT and business managers may find themselves in regulatory and
legal peril.
"You move from ignorance to compliance jeopardy," says Tony Spinelli,
senior vice president of information security at credit information services
firm Equifax, describing the early days of deploying the Symantec
DLP in his organization. DLP became a spotlight in the dark, exposing data-storage
practices that needed to be improved.
That puts both business and IT management on the spot to make changes. And
more security managers are finding that picky auditors -- once they know the
DLP tools are in place -- are demanding security changes that corporations would
be at their legal peril to ignore.
