VMware publishes its virtualization security guidelines

Network World - As it kicks off the second day of its VMworld conference, VMware is sharing newly published security and compliance recommendations for virtual environments. The vendor's guidelines focus primarily on optimizing use of management and security tools available from VMware parent company EMC and EMC's RSA security division.

VMworld product blitz: Hot technology for the virtual world

VMware's paper, "Security Compliance in a Virtual World," calls attention to the fact that any corporate computing infrastructure that has been virtualized in part or in whole must meet the demands of auditors to satisfy regulatory mandates such as the Payment Card Industry data security standards (PCI DSS), federal Health Insurance Portability and Accountability Act healthcare security requirements, or the European Union's data-privacy rules, among other regulations worldwide.

Just as they would for a non-virtualized computing environment, compliance auditors will demand evidence of controls that prevent unauthorized access, provide separation of administrative duties, isolate systems for processing protected information, and monitor access.

In the paper, VMware acknowledges that virtualization is still "relatively new" and that it "represents a paradigm shift in computing," so organizations "need to invest time and effort in learning how to get it right."

But virtualized and non-virtualized computing environments are profoundly different in nature. In virtualized environments, "there is no longer a one-on-one relationship between the physical host and server," VMware points out in the paper. "Now a virtual machine can run on one of many physical hosts, while a host can run a wide variety of virtual machines. This association changes dynamically, making it difficult to keep up with changes."

VMware adds: "The result is that configuration and change management practices become even more critical in virtualized environments."

Among the paper's recommendations, VMware says managers should take advantage of tools they already may use in their physical environments to lessen the burden of managing conformance in virtual infrastructures.

In terms of tools to use to meet compliance goals, the paper emphasizes VMware's vCenter and Orchestrator; VMware Update Manager; RSA's enVision security information management product; and EMC Ionix Server Configuration Manager.

The paper also notes that the Center for Internet Security and the Defense Information Systems Agency have each issued guidelines on configuration and platform hardening in virtualization.

Platform hardening relates to using "appropriate settings and removing unused code," says Bret Hartman, CTO at RSA. Hartman authored the paper with Stephen Herrod, CTO and senior vice president of research and development at VMware, and three others.

The reason for publishing "Security Compliance in a Virtual World" now, Hartman says, is that chief security officers are trying to anticipate security needs around virtualization and want more practical advice.