Baltimore hospital needs virtual NAC capabilities now

Last time this newsletter addressed NAC for virtual machines and said the problem was pretty much theoretical. Turns out it's not for a Baltimore hospital.

Mercy Medical Center has virtualized its servers and says it needs NAC at the server level. (Compare NAC products)

The goal is to keep servers isolated so when vendors come in to maintain applications, they have access only to the applications they are there to work on. So far, the hospital doesn’t have a good answer.

It uses NAC-enabled switches to check the health of devices entering the network and then continue to track what they are up to as a way to protect the network from malicious behavior they might exhibit afterwards. But that doesn’t take care of the virtual server-to-virtual server traffic within physical machines.

Key to solving the issue is that in addition to restricting initial access, the hospital wants ongoing monitoring of server traffic to make sure the virtual servers don’t exhibit behavior that indicates an attack. It would also like to ensure that sensitive data isn’t leaking out.

One challenge is speed. Servers in data centers running at multigigabit speeds generate a lot of traffic that so far intrusion prevention (Compare IPS products) and data-leakage-prevention (Compare Data Leak Protection products) gear can’t match, especially in virtual machines.

The director of the medical center’s IT department says what is needed is security that runs on the virtual machine monitors within each physical machine. So far products that meet his security and performance needs don’t exist.

But VMware, which writes virtual machine software, is working on it via a program involving trusted security partners. This is a sensible way to go to address the problem quickly given that VMware’s expertise is not security.