How to Avoid Virtualization Security Problems
However, the practice of virtualization has spurred serious concerns about computer security.
Here's a look at the major security concerns brought on by virtualization, along with ideas for protecting your firm against them.
Server Security Concerns The potential for human error is virtualization's biggest flaw.
Without an on-site server room to monitor or policies in place requiring virtual server checkups, IT staff may overlook vulnerabilities in virtual servers.
As a result, organizations that use these servers must be hyper-vigilant about checking their security status.
This is especially important for remote virtual servers, which are particularly known for slack security.
Common vulnerabilities to look for include: Sprawl.
Creating virtual servers is so easy that many companies go overboard, creating too many.
Just like physical servers, these virtual servers are vulnerable to hackers and need to be routinely updated with security patches.
However, the ability to create dozens of new servers within minutes means servers may be created and then forgotten, allowing hackers to use outdated security code to obtain access to sensitive information.
With so many servers being created so quickly -- sometimes even by non-IT employees -- it can be difficult to determine who is responsible for maintaining each one.
Within companies that utilize virtualization, it's crucial to create clear lines of computer security responsibility.
Another vulnerability of virtualization comes from the virtual world.
First, if the hypervisor is attacked, all of the servers on that platform are compromised.
For this reason, it's vital that hypervisor machines are kept patched and up-to-date.
Second, packets of data can be exchanged between servers without detection by the user.
Administrators should set up firewalls between serves to prevent those with sensitive data from communicating with non-secure servers.
Information Security Management Many virtualization security issues are caused by the way people perceive virtual machines.
People often treat virtual servers a bit like Monopoly funny money, throwing them around as if they had no value.
The solution, then, is to treat each server as if it were a tangible, physical server.
Companies who wish to avert computer security issues should put systems in place to ensure the following: Installation of security systems on each virtual server.
From a hacking perspective, each server is open to attack, so each must possess its own antivirus and spyware systems, and continued oversight must be given to each of these security systems.
Server creation protocol.
Virtual servers should not be created arbitrarily, or they can quickly grow out of hand for IT staff.
Companies should set up a specific protocol for creating servers so they can be tracked and maintained.
Companies that use virtualization should have an IT professional set up scans of the servers to track which information is being shared across the virtual machines.
Firms that utilize a "golden image" or standard code for formatting servers should take extra care to careful to review security patches whenever a new server is created.
Virtual servers have been a boon to business by cutting costs, increasing memory and flexibility, and improving resource utilization.
However, virtualization does require extra attention to server security.
~Colleen Welch, 2010