A central point for collection of information that relates to computer security. Including, but not limited to, security advisories from the major vendors, major data breaches, "phishing" alerts, commentary regarding staffing levels. etc. etc.
Virtual Security Paper
September 2, 2009 at 9:38 am #79491
News Story/Press release from Network World
RSA publishes virtualization security, compliance guidelines
Guidelines focus on use of management and security tools from EMC and EMC's RSA security division.
By Ellen Messmer , Network World , 09/01/2009
As VMware kicks off the second day of its VMworld conference, RSA is sharing newly published security and compliance recommendations for virtual environments. The guidelines focus primarily on optimizing use of management and security tools available from VMware parent company EMC and EMC's RSA security division.
RSA's paper, "Security Compliance in a Virtual World," calls attention to the fact that any corporate computing infrastructure that has been virtualized in part or in whole must meet the demands of auditors to satisfy regulatory mandates such as the Payment Card Industry data security standards (PCI DSS), federal Health Insurance Portability and Accountability Act healthcare security requirements, or the European Union's data-privacy rules, among other regulations worldwide.
Just as they would for a non-virtualized computing environment, compliance auditors will demand evidence of controls that prevent unauthorized access, provide separation of administrative duties, isolate systems for processing protected information, and monitor access.
In the paper, RSA acknowledges that virtualization is still "relatively new" and that it "represents a paradigm shift in computing," so organizations "need to invest time and effort in learning how to get it right."
But virtualized and non-virtualized computing environments are profoundly different in nature. In virtualized environments, "there is no longer a one-on-one relationship between the physical host and server," RSA points out in the paper. "Now a virtual machine can run on one of many physical hosts, while a host can run a wide variety of virtual machines. This association changes dynamically, making it difficult to keep up with changes."
RSA adds: "The result is that configuration and change management practices become even more critical in virtualized environments."
Among the paper's recommendations, RSA says managers should take advantage of tools they already may use in their physical environments to lessen the burden of managing conformance in virtual infrastructures.
In terms of tools to use to meet compliance goals, the paper emphasizes VMware's vCenter and Orchestrator; VMware Update Manager; RSA's enVision security information management product; and EMC Ionix Server Configuration Manager.
The paper also notes that the Center for Internet Security and the Defense Information Systems Agency have each issued guidelines on configuration and platform hardening in virtualization.
Platform hardening relates to using "appropriate settings and removing unused code," says Bret Hartman, CTO at RSA. Hartman authored the paper with Stephen Herrod, CTO and senior vice president of research and development at VMware, and three others.
The reason for publishing "Security Compliance in a Virtual World" now, Hartman says, is that chief security officers are trying to anticipate security needs around virtualization and want more practical advice.
"The risks are here," Hartman says. "What makes virtualization different is there's a new kind of root access in the system."
Therefore, there should be "very strong administrative controls," says Hartman, recommending use of "multi-factor authentication," not just simple passwords, plus the establishment of a clear separation of duties.
In the paper, RSA acknowledges it wants to shift the security discussion away from what it sees as too much focus on hypervisor security alone, to the broader concerns of overall security compliance, auditing, logging and event collection.
A mix of virtualized and non-virtualized computing environments -- a commonplace situation in organizations today -- represents "a hybrid environment" that has to be administered and logged appropriately across both for regulatory reasons, Hartman points out, adding it's all taking place in an "evolutionary" way.
All contents copyright 1995-2009 Network World, Inc. http://www.networkworld.com
You must be logged in to reply to this topic.