Archive for category Security

Thoughts on the VMworld Day 2 Keynote

Posted by Chris in Cloud, Desktop Virtualization, ESX, Network Virtualization, Security, Server Virtualization, VMware, VMware CVP on September 3rd, 2009

I was very impressed by the information disseminated in the second VMworld keynote, led by CTO Steve Herrod. Here’s a summary of the thoughts I tweeted during the morning keynote (in chronological order).

Steve Herrod talked about a “people centric” approach. VMware’s technology needs to understand desktop user behavior. The existing offline VDI model (requiring a manual “check-out”) is not people centric.
VMware’s announcement to OEM RTO Software’s Virtual Profiles was a good move. Burton Group considers profile virtualization a required element of enterprise desktop virtualization architecture.
VMware’s Steve Herrod and Mike Coleman discussed VMware’s software-based PC-over-IP (PCoIP) protocol. Feedback from Burton Group clients who were early PCoIP beta testers indicates that the protocol’s development is progressing well.
Herrod showed a picture of “hosted virtualization” for employee owned PCs on a MacBook. Is that a hint of a forthcoming announcement?
I would like to know if VMware’s Type I CVP client hypervisor will have VMsafe-like support in the 1.0 release. VMware has made few public statements regarding CVP architecture.
VMware’s CVP demo looked good, but it didn’t reach the “wow factor” achieved by Citrix when Citrix demoed a type I client hypervisor on a Mac at their Synergy conference.
The Wyse PocketCloud demonstration was impressive. PocketCloud is VMware’s first answer to the Citrix Receiver for iPhone.
VMware demonstrated the execution of a Google Android application on a Windows Mobile-based smart phone. Many opportunities exist for VMware and Google to collaborate in the user service and application delivery space.
Burton Group client experience backs VMware’s claims that vSphere 4.0 is a suitable platform for tier 1 applications. We recommend that x86 virtualization be the default platform for all newly deployed x86 applications, unless an application owner can justify why physical hardware is required (e.g., for a proprietary interface that is unsupported by virtualization).
To support tier 1 application dynamic load balancing, storage and network I/O must be included in the DRS VM placement calculations. It’s good to see that VMware is heading in that direction. DRS will also need to evaluate non-performance metrics such as vShield Zone membership as part of the VM placement metric (no word on this yet).
I would like to hear more from folks who have tested AppSpeed. Burton Group clients I have spoken with to date have not been impressed.
The DMTF needs to start doing more to evangelize the role of OVF as it pertains to cloud computing and service manifests.
I like vSphere’s VMsafe security API, but I want to see tighter integration with external management (exposed via the SDK), and better integration with VMware’s DRS and DPM services.
VMware talked about Lab Manager as a tool to promote user self-service for server VMs and applications, but I haven’t heard mention of a similar interface for desktop applications (like Citrix Dazzle). A user application service catalog is a missing part of VMware’s current virtual desktop architecture, and will need to be addressed by either VMware or a third party.
The data center on the show floor running 37,248 VMs on 776 physical servers would be more impressive if VMware disclosed the applications running on the VMs, along with the application workloads. Otherwise, the demonstration is really just a density science project.
I liked VMware’s coverage of virtual data centers. They are also defined in Burton Group’s internal cloud hardware infrastructure as a service (HIaaS) reference architecture.
Herrod mentioned forthcoming network L3 improvements that will make it easier to separate location and identity. This is something to follow.
Both Cisco and F5 are enablers for VMware’s long distance VMotion and are vendors to follow as this technology further matures.
VMware’s cloud layered architecture is very similar to the architecture defined in the Drue Reeves’ report “Cloud Computing: Transforming IT.”
Herrod did a great job articulating the importance of SpringSource to the VMware software solution. VMware needs an application platform to have a chance at holding off Microsoft long term, and SpringSource gives them that.

That’s it for my thoughts on day 2. As always, I’d love to hear your feedback. VMworld 2009 was a great conference. I enjoyed my time meeting with Burton Group clients as well as the several conversations that I had with many attendees. See you next year!

Cloud, VMware, vmworld

10 Comments

Webinar: Practical VM Security Techniques for Internal and External Virtualized Infrastructures

Posted by Chris in Security, Server Virtualization, Speaking Events on May 19th, 2009

I’ll be participating in a webinar on virtualization security on May 28th. I have included a description below and if you’re interested, you can register here.

Date: Thursday May 28, 2009
Time: 2:00 PM ET / 11:00 AM PT
Duration: 60 Minutes

Practical VM Security Techniques for Internal and External Virtualized Infrastructures
Jumping onto the virtualization bandwagon makes great economic sense but can be risky if done without proper security measures. In this webinar, Burton Group senior analyst Chris Wolf and executives from Trend Micro discuss current trends in virtual infrastructure security while offering practical techniques for securely managing today’s virtual infrastructures. Learn new approaches for virtualization security, security features that should be included in all production-use hypervisors, as well as key questions that IT decision makers should be asking to prospective hypervisor and security vendors.

Attend this webinar to learn:
• New ways that virtualization can put your business at risk
• Common security and compliance pitfalls
• Isolation and zoning best practices
• Key security differentiators that exist with today’s modern hypervisors
• Methods for efficiently and effectively leveraging host-based security within the virtual infrastructure

Featured Speakers:
Chris Wolf, Senior Analyst, Burton Group
Bill McGee, Senior Director of Product Development, Trend Micro
Harish Agastya, Director of Product Marketing, Trend Micro

Who should attend:
- IT Security
- Virtualization Architects
- Security Architects
- Datacenter Operations

No Comments

Upcoming Webinar – Practical VM Security Techniques for Internal and External Virtualized Infrastructures

Posted by Chris in Security, Server Virtualization, Webcast on May 19th, 2009

I’ll be participating in a webinar on virtualization security on May 28th. I have included a description below and if you’re interested, you can register here.

Date: Thursday May 28, 2009
Time: 2:00 PM ET / 11:00 AM PT
Duration: 60 Minutes

Featured Speakers:
Chris Wolf, Senior Analyst, Burton Group
Bill McGee, Senior Director of Product Development, Trend Micro
Harish Agastya, Director of Product Marketing, Trend Micro

Who should attend:
- IT Security
- Virtualization Architects
- Security Architects
- Datacenter Operations

No Comments

VMware Launches Site for Security and Compliance Auditors

Posted by Chris in Security, Server Virtualization, VMware, Virtualization Management on November 12th, 2008

For the past two years I have been listening to security and compliance auditors who routinely complain that they need help with effectively auditing for compliance (e.g., regulatory, security policy) in virtualized environments. During that span, I’d often hear auditors tell me the following:

I don’t know where to start.

What within the virtual infrastructure constitutes a trusted security boundary?

Are the vendors in the virtualization space and the standards bodies (e.g. PCI) doing anything to help?

That being said, I have taken auditor feedback (both general and specific) to the major virtualization vendors and asked them if they could push the ball forward and throw the auditors a life line. Unfortunately, a senior executive at one prominent vendor told me:

Auditing is an internal issue that is unique to all organizations, and we have no place in this area.

When the executive made that statement, I told him why I disagreed and tried to clarify my position, again stating that the virtualization vendors needed to take the ball to the engage the standards bodies and also to provide the clarity that the auditors required. He still disagreed.

Hope is not lost for the auditing community, as VMware today announced that it is joining the PCI standards council as a participating organization, and the launch of the VMware Compliance Center Web site. The Compliance Center includes a very nice list of white papers that I think auditors will find helpful. VMware – great job. With this announcement, I think Christmas just came early for many in the auditing community. Now for VMware’s competitors, I’m once again going to repeat my request to you – please get serious about providing guidelines and clarity for security auditors. They want your help. Without it, some will inevitably revert to enforcing full physical isolation within their organization’s virtual infrastructure, something which reduces consolidation density and undermines your TCO arguments. What do you say? If you’re serious about being a production-class virtualization platform, you need to publicly demonstrate how you are serious about security and compliance. The ball’s in your court.

Note: Originally posted to Burton Group’s Data Center Strategies blog.

1 Comment

Have You Gotten Your Copy Yet?

Posted by Chris in Backup & Recovery, Performance, Scripts, Security, Server Virtualization, Storage, Troubleshooting, VMware, Virtualization Management on August 6th, 2008

Last week while speaking at TechTarget’s Advanced Enterprise Virtualization semina r, I was asked a question I get quite often – “What book do you recommend if we want to learn more?” The answer to that was easy. The audience consisted pretty much of senior level administrators who were either running or planned to deploy VMware-based virtual environments, so I asked if everyone had purchased a copy of the VMware Infrastructure 3 Advanced Technical Design & Advanced Operations Guide. The attendees were surprised that I didn’t mention my own book, but why should I? My virtualization book was published in 2005, so it’s a dinosaur in terms of virtualization books. Even back then, I wrote a good virtualization book that covered many platforms, but at the time the best book for ESX environments was the VMware ESX Server: Advanced Technical Design Guide. I’m out of the book writing business, so I’ll point people to articles I’ve written and my free virtualization overview published by Burton Group in 2007, Let’s Get Virtual: A Look at Today’s Server Virtualization Architectures. When it comes to books, I’d rather have people spend their money wisely on what I feel are the best ones out there.

I had pre-ordered the VMware Infrastructure 3 Advanced Technical Design and Operations Guide and received my copy from Amazon a few days before my seminar last week. If you’re thinking about deploying VMware or are already running VMware Virtual Infrastructure, I consider this book to be a requirement. The authors, Ron Oglesby, Scott Herold, and Mike Laverick are three of the foremost VMware experts in the world. Together, they delivered a highly comprehensive book that takes you from planning and architecture to operations and advanced management. Let’s face it, you can find a lot of information online today, so to me the value of a good book is in the information that goes beyond what is already there in a vendor’s how-to guide. This book certainly does not disappoint. Of course, some of the book’s content is online, like Mike Laverick’s excellent how-to on PXE installing ESX, but that’s no reason to forgo this treasure. There’s a lot to say about having all of your go-to information in one place, and this book is it.

The book weighs in at over 800 pages, and unlike other technical books, size does not equal fluff. The authors are very to-the-point and clear in their explanations, and I’m sure likely struggled with having to draw the line on content. The size is also due to the fact that it is two books (Advanced Technical Design Guide and Advanced Operations Guide) packaged as one. By packaging this way, you’re saving money. I wanted to name my favorite chapter, but found this impossible, because all of the chapters contain excellent information. That being said, here’s a list of my personal favorites:

Advanced Technical Design Guide

Chapter 4 – Virtual Center and Cluster Design
Chapter 5 – Storage
Chapter 6 – Networking Concepts and Strategies
Chapter 7 – VMs and VM Selection
Chapter 8 – Managing the Environment
Chapter 10 – Recovery and Business Continuity

Advanced Operations Guide

Chapter 2 – Networking
Chapter 3 – Storage
Chapter 10 – VMotion, DRS, and HA
Chapter 11 – Backup and VMware Consolidated Backup
Chapter 12 – ESX Command Line Configuration

Each chapter is loaded with tips, tricks, and gotchas founded on real experience. In fact, many of the gotchas that I’ve run into myself were right there in print, and the authors highlighted a few that I have yet to see. You’ll find that having this book is like having an extra VMware consultant on staff. It’s that good.

So if you haven’t bought the VMware Infrastructure 3 Advanced Technical Design & Advanced Operations Guide yet, it’s time. Even if your department doesn’t have the $37.77 that the book is currently selling for on Amazon.com, just ask your worst dressed IT guy to stand outside the building with a cup. I’m sure he’ll have the money in a couple of hours. Bottom line – this book is a must-have for any IT pro responsible for designing, deploying, or managing VMware environments.

9 Comments

Debating Virtualization — Forbes.com

Posted by Chris in Security, Server Virtualization, Virtualization Management on April 4th, 2008

Wendy Tanaka at Forbes.com published an article yesterday on future trends in virtualization. The article features perspectives from myself, Forrester Research Vice President Frank Gillett, IDC Vice President John Humphreys, and Gartner Vice President Thomas Bittman.

I found the article to be a very good read, and I’m always interested in hearing what some of my fellow analysts have to say about virtualization. Here’s the link to view the article online – Debating Virtualization.

1 Comment

Virtualization Security – Keeping Risk in Perspective

Posted by Chris in Security, Server Virtualization, Virtualization Management on January 11th, 2008

Pete Lindstrom of our Security and Risk Management Strategies team recently blogged on his “Five Immutable Laws of Virtualization Security.” Pete’s Five Laws are long overdue, as they give us a chance to take a step back and examine security practices in virtual environments.

Taking a hard look at virtualization security is important, but sometimes it also results in some pressing the panic button. At this stage, there’s no need to run out and place warning labels on your virtual machine host systems.

For example, this label may add a little color to your data centers…

Don’t get me wrong. I’m not saying that virtualization security isn’t serious, because it certainly is. In 2008, a lot of industry focus will be directed toward highlighting security issues in virtual environments. However, it’s not the time to hold back on virtualizing production resources, because there is too much to gain. If I took the position to not use email because an email server is a risk, you’d laugh at me. Email is something you can’t live without. If you asked most early virtualization adopters the same question, they would likely have the same response – virtualization is something they can’t live without. The infrastructure flexibility, higher availability, and ease of system recovery benefits, to most, far outweigh the perceived risks.

Now let’s get back to the Five Immutable Laws. I think they are needed because too many organizations are not taking virtualization security as seriously as they should. Pete has pointed out the risks, and it’s our job to manage them. On the outside, Pete’s Five Laws may seem a little frightening and thus warrant my label shown above. Law #2 is a good example:

A VM has higher risk than its counterpart physical system that is running the exact same OS and applications and is configured identically.

The statement is derived from the fact that the hypervisor is additive software, and that adding software adds risk. That is true, but once you go virtual, configurations are never really identical, and that’s a good thing. One example is with system stability. VMs use a very limited set of canned device drivers and VM hosts (predominantly VMware ESX) use only device drivers embedded in the ESX hypervisor that are certified by VMware and their IHV partners. With physical servers, it’s highly unlikely that most use a such a controlled set of device drivers. Another example is with high availability – VMs add high availability to applications that do not natively support clustering, as the VM is the point of failover. So once you roll out VMs in an enterprise-class virtual infrastructure, all things won’t be equal right out of the gate. While the additive hypervisor is more software, hence adding risk, the hypervisor also brings with it several rewards: improved system stability, higher availability, and significantly easier system recovery.

The technical and competitive advantages brought about by virtualization have made it a technology that is becoming as critical as email to many enterprises. So I don’t see Pete’s Five Immutable Laws as justification for not virtualizing (and I believe Pete and the Security and Risk Management Strategies team would say the same thing), but instead mark the starting point for serious dialogue around securing the virtual data center, which is an inevitable part of our future.

Vendors, virtualization administrators, security experts – what are your thoughts?

Note: Originally posted to the Burton Group Data Center Strategies blog.

No Comments

Querying MAC addresses to determine a VM’s parent hypervisor

Posted by Chris in Security, Server Virtualization on November 29th, 2007

I recently published an article on how you can query a VM’s MAC address and then use the MAC address’s OUI to determine the virtualization platform that is hosting the VM. Here’s the link:

Hey VM, What’s Your Hypervisor?

No Comments