With VMware's ESX Server and the other major virtualization platforms, the data that passes between virtual machines is unencrypted. Aravamudan says encryption is being "actively considered" at VMware, but he declined to say when it might be added to the company's products.
Systems like VMware's vShield and other third-party tools can create virtual firewalls that segment VMware, XenServer, Hyper-V and other virtual machines into different security zones, but not all organizations have implemented them. For example, the creation of secure zones hasn't been a big focus at Rent-A-Center. But as the virtual infrastructure scales up, that's becoming a necessity, says Condit.
Some existing firewall tools have visibility into virtual server traffic, but in other cases IT needs to add another set of virtualization-specific tools, and that adds to management complexity.
It's better to have a tool set that spans both the physical and virtual environments, says Neil MacDonald, an analyst at Gartner Inc. Until the traditional security tool vendors catch up, however, IT may need to bring in tools from lesser-known vendors like Altor Networks, Catbird Networks and HyTrust that have been tailored specifically to virtual machines.
More important, the core network architectures need to change to accommodate virtualization, says RSA's Mulé. "Networks that work correctly with physical servers don't necessarily work well with virtual machines. Security would be improved if proper routing and subnets and virtual LANs were implemented," he says. Most business continuity failures in virtualized settings can be attributed to network design flaws, he contends.
Matthew Nowell, senior systems engineer at Six Flags, uses virtual LANs to segregate virtual servers. "Depending on how we set up routing rules, they may or may not be able to talk to each other," he says.
But MacDonald cautions that "VLANs and router-based access controls alone are not sufficient for security separation." The research firm's guidelines call for the deployment of some sort of virtualization-aware firewall.
The Virtual Enforcer
Third-party vendors such as Trend Micro Inc. are offering add-on software to beef up the security of the hypervisor layer. But some experts worry that as the layer gets more crowded and complex, it becomes a bigger target for security attacks. For more on this topic, see our story "Hypervisor as Virtualization's Enforcer?"
At the Phoenix city government, Jordan insists that systems administrators isolate each virtual server within its own security zone. "I had to fight with server admins who swear up and down that the hypervisor can do that. But I trust firewalls more than I trust hypervisors," she says.
Security From the Start
Securing a virtual infrastructure isn't about buying more tools, says RSA's Baize. "There's a lot available today in terms of controls for virtual infrastructure. What is lacking is the understanding of what the controls are for and when they should be applied," he says.
Sign up for Computerworld eNewsletters.