Is The Hypervisor Securitys Goldilocks Zone?

RSA presentation to put virtualization forward as a tool to fix securitys architectural problems

During the past several years, theres been much attention spent at security events on handwringing over the security risks of cloud and virtualization adoption in the enterprise. The upcoming sessions at RSA will be no exception, but one security researcher with VMware will be turning the theme on its head. Hes got a talk planned on how the fundamental technology around virtualization and cloud could actually hold the key to solving a lot of securitys architectural problems.
If you look at security spend, it outpaces IT spend already. And then the only thing that outpaces security spend is security losses, says Martin Casado, CTO of networking for VMware. We continue to fight a losing battle and its pretty clear that we cant spend our way out of this. So this suggests to me as a technologist that theres an architectural problem.
Known most for creating OpenFlow and for his work pushing the software-defined networking movement forward -- he was awarded the 2012 Grace Murray Hopper Award by the Association for Computing Machinery for that -- Casado actually has his technology roots in security. Prior to his post graduate work at Stanford, he spent nearly six years working for the Lawrence Livermore National Laboratory, with a good of his time spent on security. So its a return to a comfort zone now as hes dedicated the past half year thinking deeply about how virtualization fits into the security ecosystem.
On Monday hell be presenting with his colleague Tom Corn, vice president of security strategy at VMware, the concept of how virtualization and the hypervisor can actually be a security practitioners best friend, rather than something to be feared. His theories revolve around isolation, context and a thing he likes to call The Goldilocks Zone.
According to Casado, the architectural problem inherent with a lot of securitys ills today are due to the fact that the industry lacks an ubiquitous horizontal layer to implement security. Instead, todays security products end up in places that dont do the full job necessary. In many cases, its either lumped into the physical infrastructure or into the host layer, he says.
The problem with security built into physical infrastructure is one of context.
The great thing about putting security in the infrastructure is that youre isolated. So if the end host gets attacked or gets compromised, then that attack cannot turn off the security controls. Thats good, he says. What is bad is you have effectively no context at all. So I had a security policy that was something like, oh, Martin shouldnt be accessing data X at time Y, you cant really do this with firewalls or with ACLs because they have no idea about who Martin is and they have no idea about the data.
On the flip side, host security has got that context available to it but falls short with isolation.
Youve got all of the context you need. Youve got agents running in there. Youre instrumenting the application. You know everything. You know users. You know the data that theyre accessing. You know what files they have. You have the high level semantics, he says. But the problem is you have absolutely no isolation. Now youre effectively putting your security controls in an untrusted entity. So its like taking the on/off switch for an alarm system and putting it on the outside of a house.
Meantime, at the same time we fight this problem of a lack of a horizontal layer for security, cloud is creating one of the biggest business tech transformations of a generation, with virtualization as a core component of that. And even as consolidation has scared security practitioners at the risk, technologists have overlooked the potential that virtualization can have in reengineering security
Thats because the hypervisor has the potential to be the proverbial Goldilocks Zone for security products. Its got just the right amount of context and isolation to make things work.
Its a horizontal layer we can use to implement security services. The hypervisor is close enough to the application to get real context. But its far enough away to get real meaningful isolation, he says, explaining that the hypervisor can be leveraged to look into the guest, the operating system, and the application to pull out meaningful context. You can look at data, you can look at processes, you can look at threads. You can look at users on a machine and you can extract that information in a secure way. And then that information can be used and enforced within the hypervisor in a way that cant be turned off because its isolated.
According to Casado, what hes putting forward is not a proprietary development where VMware is looking to compete in the security market. Instead, the idea he promotes is for security vendors to start using the virtualization layer as a platform to enhance their offerings.
The idea is to provide a secure platform where third parties can pull out context and to have security controls enforced within the infrastructure, he says.
Not only are context and isolation a big factor, but so is the ubiquity of the hypervisor. And, Casado says, this isnt just applicable to the VMware platform, either.
This is a general statement about the hypervisor. I think this gives us an opportunity as an industry to formalize this concept and say, we already have this horizontal security layer. We have it. Lets use it. Lets take advantage of it and lets actually improve things in a significant way, he says.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security	▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps