Virtualization is a technology steamrolling through Corporate America but why aren't companies fessing up to it?!
I feel like I’m back in high school and the cool kids are trying to get me to do something against my better judgment! I recently finished VMWare’s Install and Configure ESX course. The 4-day course is targeted to vmAdmins, but for me I used it as a foundation to better understand virtualization with the ultimate goal of the security ramifications. Although virtualization has been used in mainframes for decades, only over the past two years has it gotten such a push that it’s spread like wildfire! The predominant attraction, cost savings, is so staggering that executives don’t think twice about steamrolling it out on their network and unfortunately, as usual, without weighing the security challenges. Most of the immediate security issues are pretty well documented in various blogs – my favorite being Chris Hoff’s https://www.rationalsurvivability.com/blog/ . Currently the industry must rely on NSA, DISA and VMWare’s security recommendations to secure an ESX environment. Although, a bit troubling that NIST hasn’t released their virtualization recommendations – although Karen Scarfone has hinted to me that it’ll be released any day now.
So many companies are turning to virtualization within their environment but comically hardly anybody is publicly ‘fessing up’ to using it within a production environment. I assume the lack of public disclosure is because the virtual technology hasn’t gotten a ‘huge blessing’ from the various obligatory industries – compliance regulatory committees, OS, application, and security. I’m sure Corporate America is afraid that if it was publicly discovered their environment was virtualized it would cause an unstable reaction either giving them a PR black-eye or causing client/customer pushback.
Everywhere I turn people are talking about it! So much so that I think it’s a pretty fair assumption it’s prevalent (bordering rampant) throughout companies’ infrastructure. The VMWare instructor made the statement, “100% of the Fortune 100 companies are utilizing virtualization.” Of course, he was smart enough not to specify T&E vs. production. I wonder how long companies with virtual environments will remain under the radar ‘hidden’ from public scrutiny?! So the big questions…is your company hanging out with the virtual cool kids? …has your contractor put your sensitive information on a virtual infrastructure? More importantly, if so, have they taken the proper precautions to protect it? Might be a worthwhile question to pose (maybe not if you’re afraid of the possible answer!)
FYI — I’m attending the SANS Virtualization and Cloud Computing Conference in DC so my next couple of blogs will revolve around virtualization.
