Home > Ask the Security Experts > Application Security Questions & Answers > Will using virtualization software put an enterprise at risk?
Ask The Security Expert: Questions & Answers
EMAIL THIS

Will using virtualization software put an enterprise at risk?

Michael Cobb, featured expert EXPERT RESPONSE FROM: Michael Cobb, featured expert

Pose a Question
Other Security Categories
Meet all Security Experts
Become an Expert for this site


Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   


>
QUESTION POSED ON: 11 January 2007
What are the security-related pitfalls of moving toward a virtualization environment and creating multiple-application systems on a single server?

>
Although virtualization isn't a new concept, there is certainly a renewed interest in its use. A virtualized IT infrastructure can increase system availability and flexibility, and its more efficient use of resources can cut ownership costs. Dell Inc., for example, uses a server farm that runs virtualization software to provide more than 1,000 test and development environments on fewer than 100 physical servers. This greatly reduces the time spent setting up test environments.

One often cited benefit of virtualization is the technology's ability to simplify operations and consolidate the number of servers and machines in an organization. Your administrators, however, will need to learn how to configure and maintain a virtual IT environment. Not only is there a vast amount of terminology to understand, but most virtualization products also require additional hardware or software. This requires an understanding of the many choices of available hypervisors and hardware, and how each should be properly configured.

Once a virtual environment has been created, compliance and auditing must also evolve to handle the physical and virtual systems. This means finding a way to measure resource usage and cost allocations among applications across a shared infrastructure, because serial numbers and physical locations are meaningless in the virtual world. Remember, if you can't measure what's on a virtual system, you can't obtain maximum benefit from it. Also, unless meticulous image cataloging is enforced, "image sprawl" and orphaned images can cause delays and overwhelm an IT staff. All this, not to mention the threat of possible rootkit hypervisors, adds to the burden of keeping virtualized systems secure.

Virtualization software can cause unpredictable errors, and the host is a potential single point of failure for all the instances that it hosts. Also, many software applications offer limited virtualization support. In the future, administrators will need to create an environment that preserves existing investments in such software licenses. The other challenge over the long term will be to realize the benefits of licensing models that favor virtualization. To maximize savings, you will need a full understanding of contracts and vendor license options.

Despite all of these pitfalls, the benefits of virtualization make the technology well worth considering. With virtualization, IT administrators can consolidate their physical infrastructures, preserve their investments in existing operating systems and applications, and get more from their hardware investments. As virtual environments grow, there will also be additional benefits to business continuity and capacity management strategies.

More information:

  • See how well virtualization products defend against malware.
  • Find out what happens when an attacker compromises a virtual machine.


  • BROWSE BY TAG
    Application Security,   Application and Platform Security,   Virtualization Security Issues and Threats,   VIEW ALL TAGS

    Digg This!    StumbleUpon Toolbar StumbleUpon    Bookmark with Delicious Del.icio.us   



    RELATED CONTENT
    Application Security
    Do Facebook URL security concerns justify blocking social networks?
    Is there a way to block iPhone widgets that bypass Web filters?
    Should enterprises be concerned with Twitter in the workplace?
    Are there still Google Desktop security problems?
    Can an IP spoofing tool be used to spam SPF servers?
    Will an application usage policy best control network bandwidth?
    How can URL-shortening services be manipulated?
    Is my security program ready for Web application firewall deployment?
    How to ensure the security of a shopping cart application
    When to use the service features of the Metasploit hacking tool

    Virtualization Security Issues and Threats
    Cloud computing data security starts with internal strategy, experts say
    PCI virtualization SIG closer to proposing changes to standard
    Security challenges with cloud computing services
    Secure virtual desktop software enables remote client security
    Security threats to virtual environments less theoretical, more practical
    At VMworld 2009, companies focus on virtual desktops for security
    Security fundamentals remain focus of virtualization deployments
    How to implement virtual firewalls in a complex network infrastructure
    How to find virtual machines for greater virtualization compliance
    Quiz: Virtualization and compliance

    RELATED RESOURCES
    2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems
    Search Bitpipe.com for the latest white papers and business webcasts
    Whatis.com, the online computer dictionary



    Search and Browse the Expert Answer Center
    Search and browse more than 25,000 question and answer pairs from more than 250 TechTarget industry experts.
    Browse our Expert Advice



    Find Security Solutions for Your Business
    TechTarget Security Media
    Information Security View this month\\'s issue and subscribe today.
    Information Security Decisions Apply online for free conference admission.
    SearchSecurity.com
    HomeNewsMagazineMultimediaWhite PapersLearningAdviceTopicsEventsAbout Us

    About Us  |  Contact Us  |  For Advertisers  |  For Business Partners  |  Site Index  |  RSS
    TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of technology-specific websites, events and online magazines.

    TechTarget Corporate Web Site  |  Media Kits  |  Site Map




    All Rights Reserved, Copyright 2003 - 2009, TechTarget | Read our Privacy Policy
      TechTarget - The IT Media ROI Experts