With its potential to reduce expenses, drive automation and provide flexibility, virtualization has earned its way onto the board agenda and is being implemented by enterprises worldwide. But with the many benefits of virtualization come considerable risks. Global IT association ISACA provides a balanced look at virtualization—and strategies to help enterprises maximize the value—in a new white paper available for free download from www.isaca.org/virtualization.
According to the “Virtualization: Benefits and Challenges” white paper, virtualization risks can be divided into three groups:
- Attacks on virtualization infrastructure—The two primary types are hyperjacking and virtual machine (VM) jumping. Hyperjacking is still a theoretical attack scenario, but has earned significant attention because of the major damage it can potentially cause.
- Attacks on virtualization features—The more common targets include VM migration and virtual networking functions.
- Compliance and management challenges—The number and types of VM can easily get out of hand; VM sprawl and dormant VMs make it a challenge to get accurate results from vulnerability assessments, patching/updates and auditing.
To combat these risks, ISACA recommends the following:
- Patch and harden the hypervisor and the guests it supports.
- Use physical, network and virtualization-based separation to segment VMs and systems.
- Use transport encryption to secure VM migration.
- Implement virtualization-aware management products and services.
“Virtualization has recently become a more common practice and enterprises are already realizing cost savings and efficiencies by moving to virtualized environments,” said Ramsés Gallego, CISM, CGEIT, CISSP, an author of the white paper and general manager at Entel IT Consulting. “However, to achieve this value, enterprises must consider the potential security risks and governance considerations. Having well-documented business processes and strong audit capabilities will help ensure the best possible value.”
Meanwhile, Reports are coming out of China that the government has made a total of 460 arrests of computer hackers so far this year. This figure is an effective admission by Chinese officials that the country has the same problem as here in the West – namely, large numbers of IT-literate people who are crossing over into dark hat hacker territory.
According to Claire Sellick, Event Director for Infosecurity Europe, as if this number was not an eye opener in itself, the Chinese government has revealed that arrests of hackers have soared by an amazing 80 per cent compared to last year. Infosecurity Europe will be held at Earls Court, London 19-21 April 2011 www.infosec.co.uk
"China's Ministry of Public Security has described the hacker situation in the country as very grim and, whilst it observes that a number of computers in companies have little or no effective security measures, it really does illustrate the scale of the problem," she said.
"China is rapidly entering the ascendant in the IT stakes, with the country now boasting the largest number of mobile phones of any country in the world. It’s also clear that the country's Internet infrastructure is also growing rapidly, along with the number of Internet users," she added.
The Infosecurity Europe Event Director went on to say that the media has been full of oblique references to Western computer systems being attacked by hacktivists who are sympathetic to the Chinese cause.
Some outlets have even reported that the government was behind the attacks on Google late last year, a topic that cropped up in the current raft of documents being released in the Wikileaks saga (http://bit.ly/hjoFu0), she noted.
The crucial thing to remember, says Sellick, is that the rise of the Internet means that the world has become a global village, meaning that it just as easy for hackers in a Chinese city to attack a company IT resource in the UK, as it is for a hacker elsewhere in the UK.
The Internet, she explained, has changed many aspects of the IT and business world, and whilst most of those changes have been for the better, some are not.
It's against this backdrop that the Infosecurity Europe show Event Director says that it has become imperative for organisations to deploy the very best security technology to defend their digital data assets.
"But keeping up to speed with these trends, as well as abreast of the latest security defence technologies and strategies, has almost become a full-time job," she said.
"This is why we're encouraging IT and business professionals to make space in their diaries for the next Infosecurity Europe event, which takes place at Earls Court 1, London, between the 19th and the 21st of April, 2011," she added.
help ensure the best possible value.”