by

The Very Real Dangers of Virtualization

Virtualization servers have been around for well over a decade — nearly two, if you virtual-lovers out there can believe it — but to countless users in the industry, the technology still seems alien and new. However, with the growing reliance on the cloud and utilization of servers by businesses and personal uses alike, virtualization is becoming an unavoidable issue in IT departments around the world. As with any new tech, the most pressing conversation regarding virtual environments is undoubtedly one of security.

Most IT professionals agree that virtual servers aren’t necessarily less secure than traditional servers; in fact, many of them are more secure, considering their isolation and dependence on a single host. But, misunderstandings and laziness can easily put any server — virtual or physical — at risk of a dangerous breach. New adopters may have several misconceptions about what it takes to maintain a virtual server to prevent disasters. Here are the real security threats any virtual server may face and what to do to about them before they become a problem.

Responsibility
Most people fully comprehend who is responsible for the care of physical servers: the data centers or IT managers who own them. However, responsibility for virtual servers, which live on physical servers but exist somewhere in between, is often unconsidered. More often than not, server administrators expect the businesses that create virtual servers to take control of security and management, while businesses expect those closest to the servers to safeguard them. For the safest results, businesses should take charge of their own virtual systems, which include layers of technology most server managers won’t touch.

Patches and Maintenance
Even without the confusion over security responsibility, many businesses have trouble keeping up with the maintenance demands of their virtual servers. Physical servers are usually watched by hawks, updated and patched on regular schedules, but virtual servers can be launched from server images that are weeks or months old, which means they are far from up-to-date on security measures. Worse, images of servers and machines can be kept in offline libraries for ages, growing older and fussier without their required patches. Thus, when someone attempts to launch one, it could end in disaster.
The best solution to remembering basic virtual server maintenance is to create a schedule similar to those used by physical server techs. Some virtual server software comes with a useful patch planning tool, but businesses can also set reminders on shared calendars.

VM Sprawl
Virtual machines, called VMs by those in the know, take minutes to create, and businesses often create hundreds (or even thousands) of VMs to isolate computing jobs. The result is servers become absolutely overrun with VMs, which is a substantial security risk to all the data stored on all those virtual devices. Companies who boast large numbers of VMs must be confident in their ability to manage and maintain security on all of them — or else suffer a large-scale leak.
Most experts’ best suggestion for tackling VM sprawl is being mindful of the creation and organization of VMs. Businesses should assemble a crack team of IT professionals who must approve requests for virtualized servers based on rigorous guidelines. A business should be as stringent regarding VM creation as physical server allocation.

Inappropriate Security
Businesses that begin tinkering with virtualization often fall in love with the feature, but before they can embrace the tech fully, they should evaluate the status of their current security tools. Most security suites are not built to combat threats in the virtual realm, and most developers continue to focus on physical server security measures, as that is currently the most popular space for businesses. Some physical tools work fine in the virtual environment, but they cannot guarantee full protection. Companies can press their vendors for progress in virtual security management, or they can switch to a company well-versed in virtualization security for servers.

Rights and Access
Threats to a business’s data don’t always come from some nameless, faceless hacker; oftentimes, company information is stolen by employees themselves. For this reason, businesses should be vigilant about who can be admitted to their library of VMs. Admin-level access to VM provides access to all data that VM stores, which could mean a whole lot of sensitive information.

The safest companies limit their VM access to only a handful of top-tier individuals; even backup staffers and application developers get only minimal rights. This strictly controlled system also tends to help mitigate VM sprawl, which makes it a win-win. Thus, a company has a firmer grip on its VM safety both inside and outside its offices.

by