Home » Data Protection » Network Security

Q&A

Chris Hoff on Virtualization and Cloud Computing

Security expert Chris Hoff on how to approach virtualization security, why "the" cloud doesn't exist, and "the giant hamster wheel of pain". (Part of the What Happens Next security predictions series.)

By Bill Brenner, Senior Editor

Page 2

How are the IT vendors doing at offering guidance on this issue?
They're doing a very poor job. The first opportunity from a marketing and sales perspective is that it's about creating buzzwords and selling new technology. Until the security technology is more integrated as opposed to bolt-on, the vendors are just doing the best they can with what they have, to suggest they are relevant. From a leadership perspective, you see virtualization vendors at one end of the extreme or the other, you should trust this platform, it's the most secure, etc. In a way they have to be simplistic because it's complex and it's difficult to put holistic guidelines around it. The solution involves far more than bolt-on technology.

In your blog you recently told people to shut up about securing the cloud because there's no such thing as cloud security. Can you repeat the gist of it here?
This love affair with abusing the amorphous thing called "THE Cloud" is rapidly approaching meteoric levels of asininity. There is no singularity that can be described as "THE Cloud." There are many clouds, they're not federated, they don't natively interoperate at the application layer and they're all mostly proprietary in their platform and operation. They're also not all "public" and most don't exchange data in any form. The notion that we're all running out to put our content and apps in some common repository on someone else's infrastructure (or will) is bullshit. Can we stop selling this lemon already? The current fad of butchering the term "Cloud Computing" to bring sexy back to the *aaS (anything as a service) model is embarrassing. Infrastructure Gorillas are clouding the issue by suggesting their technology represents THE virtual datacenter OS. Microsoft, Citrix, VMware, Cisco. They all say the same thing using different words. Each of them claim ownership as the platform/OS upon which "THE cloud" will operate. Not one of them has a consistent model of securing their own vDCOS, so don't start on how we're going to secure "IT." Cloud computing is real. THE Cloud? Not so much.

Do you see any prospects for improvement in the coming year, one or more potential developments that can put us on the right path with virtualization security?
Oh, sure. In the security space, the who's who of security are retooling their applications to take advantage of VMware's vNetwork/VMsafe APIs. You name it -- Check Point, Symantec, McAfee, Trend Micro, they're all working on tighter, better integration. Operationally and technically there is a lot more integration and tightening going on. One recent example of that integration was VMware acquiring BlueLane Technologies, the maker of solutions that protect both physical and logical infrastructure, including ServerShield and VirtualShield. The company has of late focused wisely on the latter, which provides application-aware firewalling, inter-VM flow visibility and analytics, application policy control, and intrusion prevention capabilities. Coupled with the introspection capabilities provided by VMware's vNetwork/VMsafe API's natively, the integration of BlueLane's solution sets will add to the basal capabilities of the platform itself and will allow customers the flexibility to construct more secure virtualized operating environments. I think it's actually an excellent move as it continues on the path of not only helping to ensure that the underlying virtualization platform is more secure, but the elements that ride atop on it are equally security enabled also.