Security Concerns May Slow Virtualization
Using virtualized servers has many advantages: better utilization of hardware, reduced energy consumption, smaller data centers, etc. Security is a major concern and can slow adoption even more than other issues like virtual server sprawl and patch management.
One of the concerns is that a vulnerability in the hypervisor that controls the multiple virtual instances can be exploited to allow an attacker access to multiple virtual instances. While the concern is real, we haven't seen a viable exploit yet according to some quoted in a Network World article on virtualization:
“To my knowledge, there has never been a hack that has allowed a security problem to propagate from one virtual host to another by way of the hypervisor technology,” says Steve Ross, a consultant with Catapult Systems, which is helping logistics provider Transplace in Plano, Texas, deploy and maintain its VMware virtual environments.“It could happen, and the attacker or breach could hop from [virtual machine] to [virtual machine], but I have yet to see it as a functional exploit out there today,” adds Tim Antonowicz, systems engineer at Bowdoin College in Brunswick, Maine.
But others still point out the hypervisors present another attack surface:
“Virtualization is essentially a new operating system, which is something that hasn’t been done for a long time, and it enables an intimate interaction between underlying hardware and the environment,” says Rich Ptak, founder and principal analyst at Ptak, Noel and Associates. “The potential for messing things up is significant.”
We need to strike the right balance with virtualization. To get the benefits we need to segregate similar classes of applications and data to the same physical server or cluster. Less critical systems can be run in virtual environments while we get used to patching and securing virutalized servers. This way we get experience with the technology while reducing the risk should the hypervisor be exploited. Keeping virtualized servers separated on untrusted network segments can also help contain any potential breach.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
