Options are scarce for protecting applications when they are deployed on virtual servers within the same physical machine, according to a recent Gartner report.
Network firewalls located external to physical servers that support multiple virtual servers cannot filter traffic between virtual servers, according to the report “Limited Choices Are Available for Network Firewalls in Virtualized Servers.” This means applications on the virtual servers can communicate undetected with other virtual servers, perhaps in violation of security policies.
This is because virtual machines can talk to each other directly within the same hardware platform, giving external firewalls and intrusion-prevention systems (IPS) no chance to inspect or even monitor the traffic.
It is possible for communications among virtual servers to be routed out of the physical box to an external firewall, but that is inefficient, Gartner says. Firewalls that can separate these virtual servers are clearly needed, "however, few vendors offer full-featured solutions," the resport says.
Some firewalls from vendors including Astaro, Blue Lane, Catbird, Enterasys and Reflex Security address some of these problems, while others including Stonesoft and StillSecure have plans to address them, Gartner says.
Two of the major firewall vendors, Cisco and Juniper, have shifted their products to hardware-based firewalls and therefore lack the software firewalls that might fit into virtual environments, says Greg Young, a Gartner analyst who helped write the report.
With physical servers, businesses had set up Web applications in isolated network segments -- demilitarized zones -- separated by firewalls from databases. In a virtual environment, that separation can become blurred, Young says.
It is possible to place firewalls on each virtual machine, but that saps processing power that virtual machines are designed to conserve, the report says.
The solution is setting up firewalls on virtual machines within physical servers so these firewalls can monitor and filter traffic among the other virtual machines, Young says. Vendors need to certify that these software-based firewalls work in virtual environments so customers can install them with some confidence that they will be reliable, he says.
“Customers have high-availability requirements, and don’t want to worry about problems if they don’t install properly or a patch doesn’t work,” Young says.
Customers will want similar virtual offerings from next-generation firewall vendors as well, he says. These new security products include a traditional firewall plus IPS, according to Gartner’s definition. Customers will want to limit which virtual machines are allowed to communicate with each other and to detect when malware may be at work between virtual environments, Young says. Reflex Security is working on the IPS aspect of protecting virtual servers, he says. tools for virtual security software, such as configuration control, will be important so network administrators can see that it is performing its functions properly. Failures in virtual environments might not be as apparent as in the hardware-server world.
“You can drop a firewall partition out [of a virtual firewall] and you have communication continuing,” he says. “If a firewall disappears in the physical world, somebody’s going to notice.”
Virtual firewalls will also require rethinking on the part of network and server teams within organizations. With physical servers, firewall management can fall to the network security group, but with firewalls within servers, server groups need to be involved, Young says. “It must be network-operations led and server-operations influenced,” he says.
Learn more about this topicVirtual security virtually missing
04/18/07VMware questions rivals' virtualization strategiesSecurity concerns cloud virtualization deployments