Last week, I attended CAMP IT, an event designed to help businesses and IT benefit from virtualization strategies through successful management, security, and recovery practices. I also had the opportunity to give a presentation tilted, “Unique Threats: How to Handle Unique Security Risks Posed by Virtualization.” During my presentation I shared best practices information with attendees regarding security threats posed by virtualization. Here are some examples of what I discussed:
- The Virtualization Movement: Jump on the bandwagon! Simple to deploy, inexpensive to manage, desktop development, quick deployments and more.
- Pros of Virtualization: Cost savings, disaster recovery, server consolidation, energy saving and many more.
- Cons of Virtualization: Patching management, application boundaries, high availability planning, liability issues and a few others to be aware of.
- Hidden costs: New and improved host servers, performance impact and personnel considerations.
- Unique Threats: Same threats to those as the physical environment, additional layers (13 patches since January 2009), theoretical rootkits, physical security and human error.
- Secure a virtual infrastructure: Use the principals of Information Security!
A key takeaway that I shared with the audience and that I’ll share with you is what’s the biggest security risk? It’s misconfiguration. Overall, the audience seemed to appreciate the “things to think about before jumping in” points that I presented, so I am glad that was helpful. Many people came up to me after the presentation and said they appreciated my candor. They said that too many virtualization vendors were telling them how much money they had to invest in their infrastructure to realize long-term savings. After all, what are they supposed to do with their existing investment in all their hardware? It has to be depreciated over a five year term. They can’t just throw it all away.
Look forward to future CAMP IT events and hope to see you there!