This article can also be found in the Premium Editorial Download "Information Security magazine: CISO survival guide: 18 of the best security tips."
Download it now to read this article plus other related content.
It may be more complex than that. Maintaining--or even knowing--the correct configuration requirements may be problematic.
"There could be conflict when I change configurations and patch, given the complexity of SAN, virtualization software and the OS," says Dennis Moreau, CTO of Configuresoft. "Best practices have focused on each layer in isolation, but what's best for storage may not be for an application."
This means thinking in terms of dynamic situations, in which one gold standard for a given OS or application doesn't necessarily apply.
"IT has to connect dots across the components," says Moreau. "How do virtual components impact each other?"
"Security is not a problem perceived by customers; they're focused on performance and achieving consolidation," says XenSource's Crosby. "The bad guys are not paying attention yet, but this will increase as the number of virtual machines increases."
Neil Roiter is Information Security senior technology editor.
This was first published in July 2007