Ads by TechWords

See your link here
Receive the latest technology news and information.
Computerworld Daily News (First Look and Wrap-Up)
Computerworld Blogs Newsletter
The Weekly Top 10
Cloud Computing
View all newsletters




Privacy Policy
 

Virtualization users get vendor-neutral security guide

CIS posts benchmark document to help companies lock down virtual machines

September 5, 2007 12:00 PM ET

Computerworld - Virtualized IT environments, which have become indispensable to many companies as they consolidate servers, can now be checked against a vendor-neutral security configuration benchmark developed by the Center for Internet Security.

The CIS, a nonprofit organization with a mailing address in Hershey, Pa., creates guidelines for securing widely used technologies, such as the Windows, Unix and Linux operating systems and major applications. On Tuesday, it posted a 30-page document that can be used to configure any virtual machine installation. Later this month, the group plans to add a similar benchmark that is specific to virtualization market leader VMware Inc.'s ESX Server software.

CIS officials contend that independent configuration guidelines, developed on a consensus basis with input from parties that aren't affiliated with the vendors of the technologies being addressed, are critical to securing IT systems.

"If everybody had listened to Microsoft-and-only-Microsoft guidance for all these years for securing systems, we would be in a world of hurt," said Dave Shackleford, a vice president at the CIS. The same point applies to any other software vendor, he added.

Shackleford said the CIS received input on the virtual machine benchmark from the U.S. Department of Homeland Security, the National Institute of Standards and Technology and the private sector.

Among those involved in the development of the guidelines was Configuresoft Inc., a Colorado Springs-based vendor of configuration management software and tools that let users check whether their systems comply with various benchmarks. Andrew Bird, Configuresoft's vice president of marketing, said the company helped launch the virtualization benchmarking effort in February 2006 during a birds-of-a-feather session at the RSA Conference in San Jose.

The new benchmark provides information on a broad range of topics, such as sharing files between a host and guest server, the problems associated with synchronizing time between various virtual systems, and disabling features in order to improve security.

The upcoming guidelines for ESX Server will include specific details related to the VMware software, according to the CIS. For instance, specific parameters will be provided for tuning the ESX kernel for systems running Red Hat Linux.

Shackleford said the CIS has yet to decide whether it will develop similar benchmarks for other virtualization products, such as Microsoft Corp.'s Virtual Server and XenSource Inc.'s software based on the Xen open-source technology.

"We're probably helping the community in the largest way possible by focusing on the biggest target possible," he said, referring to VMware.



Related Articles and Opinion



Jump to comments

virtualization

Additional Resources

Xerox
By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!
Microsoft
Save time and mitigate security risk. Deploy it now.
Sybase
In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

What People Are Saying

White Papers & Webcasts

Uncover the Benefits of Virtualization
Download this Whitepaper Now!  

Effectively Implementing Datacenter Automation
Effectively select and deploy the best datacenter automation solution today!

Global Distributed Service in the Cloud with F5 and VMware
Learn how F5 and VMware help you orchestrate and deliver access to services in the cloud by providing a robust Application Delivery Networking...  

Efficient Root-cause Analysis in the face of Datacenter Complexity
Isolating Virtualization and n-Tier Application Issues, Measuring Success, Assessing Business Impact, and Enabling Technologies

Optimize VMware View VDI Deployments with F5
F5 BIG-IP Local Traffi c Manager optimizes VMware View deployments between offi ces to create a user experience on par with local desktops.  

XenApp Extends Virtualized Application Delivery
Download this webcast to learn how to accelerate delivery of virtualized applications and streamline management.

Connecting to the Cloud with F5 and VMware VMotion
F5 and VMware partner to enable live application and storage migrations between datacenters and clouds, over short or long distances.  

ROI of Application Delivery in Virtualized Environments
Learn how load balancing Application Delivery Controllers (ADC) can substantially reduce expenses in traditional and virtualized architectures with a fast ROI.  

Horror stories: Managing IT Across Multiple Locations
How one extra sharp IT manager eliminates daily agony, hassle and repetition.

 

Virtualization Everywhere
Virtualize your servers in less than ten minutes! Citrix XenServer is powerful server virtualization software that makes data centers more agile through improved server utilization, workload mobility, and enhanced disaster recovery. All the features you need - radically lower TCO.

Download this white paper 
XenServer FREE Trial
Citrix XenServer™ is the simplest and most effective way to virtualize and provision servers. XenServer combines comprehensive server virtualization capabilities with unparalleled scalability, performance, economics, and ease-of-use. Based on the open source Xen hypervisor, XenServer delivers fast performance, easy management, and advanced features such as live migration.

Download this free trial 
Business Value of Virtualized IT: Ensuring That Your Virtualized Servers and Storage Work in Harmony
The growing number of virtualized servers is affecting storage network environments, policies for provisioning capacity, and storage management and data protection practices. Storage assets allocated to virtualized servers can help deliver significant business value, but when deployed incorrectly can lead to "unintended consequences" that minimize the original business value of server virtualization. In this paper, IDC examines how implementing a virtualized networked storage environment ensures that organizations can maximize the benefits of server virtualization.

Download this white paper