download issue 27 here - Help Net Security

If youʼre part of the quintessential IT personnel most firms have, youʼve already
had some exposure to virtualization technology. In all likelihood, portions
of - if not your entire testing and development environment - run on a
virtualization platform from VMware, Microsoft or Citrix.
The savings in capital and operating expenses
are so compelling that now youʼve been asked
to expand virtualizationʼs use to the rest of
your data center, demilitarized zone and disaster
recovery site - basically, any other part
of the physical network where migration of
physical servers to virtual machines (VMs) will
trim down the costs to power, cool, house and
administer them. In fact, the likelihood that
you have already embarked on such an effort
is pretty high.
In a Gartner webinar, analyst Thomas Bittman
said that “by 2013, the majority of workloads
running on x86 architecture servers in enterprises
will be running in virtual machines.”
This statistic implies that virtualization is
quickly subsuming critical workloads, with
valuable, sensitive and compliance relevant
data and applications making their way onto
VMs. The challenge presented stems from the
fact that virtualization combines workloads of
different trust levels (i.e. HR file server, CRM
database, email server, etc.,) onto one physical
server, and how can an organization remain
compliant with requirements for the segregation
of duties, zones of trust and least
privilege access?
Furthermore, as virtualization adoption within
organizations broadens to include dispersed
data centers, so too does the use of live migration
and automation - features which make
it easy for VMs to be created and optimally
operated but make it hard to continuously
monitor and secure them.
www.insecuremag.com 28