Feeds

Virtual security: Even better than the real thing?

The jury's still out

Internet Security Threat Report 2014

VMworld VMware is taking some big steps in the security and network management arena with its vShield product set. I sat in on a deepish dive into the somewhat new security products being offered by VMware to deliver on the ‘secure’ part of their “Secure Hybrid Cloud” initiative.

The speakers went through each of the three offerings, along with outlining VMware’s security philosophy, at a very brisk pace. (VMware hasn’t yet provided the slide sets from the presentations, so I’m left with my cryptic and sometimes indecipherable notes.)

In terms of messages around VMware’s security offerings, I took away the following broad points:

1. Security is too complicated, and takes too many separate devices to configure/control.

2. Security now belongs in the hypervisor layer.

3. Workloads in VMs are more secure than workloads on physical systems.

4. Customers using vShield can cut security costs by 5x compared to today’s current state-of-the-art, while improving overall security.

Do I buy all of this? Let me put a firm stake in the sand by saying I’m sure that security is too complicated. It’s definitely too complicated for me. But all the rest of it? Color me undecided.

Putting security into the hypervisor layer makes conceptual sense from a simplification standpoint, and it would certainly cut down the number of things that need to be configured and managed. But does combining security with the hypervisor make things too simple? Is there enough configurability in the products to handle the unique needs of the enterprise?

I also have some questions about how this will impact overall VM and system performance. Under the vShield, separate hardware to handle security tasks is a thing of the past – security moves to the hypervisor layer and protects the guest VMs from intrusions, spam, and other nasty stuff. For example, as I understand it, you would have only one firewall per physical host that would protect all of the VMs running inside that host.

When asked, the VMware speakers did admit that this will add a significant processing load to the host systems, but said that the demands shouldn’t cause much impact on existing workloads since CPUs are still generally underutilized, even on highly virtualized systems.

They also made the point that eliminating security appliances would cut down on a lot of redundant processing due to the elimination of a myriad of individual appliances and potentially cut a lot of costs as well. Fair points all, but I’d like to see how it works in the real world and hear how it’s working with customers to see if the trade-offs are a net benefit.

The three new and/or improved vShield products that received the most attention at the show were vShield Edge, vShield App, and vShield Endpoint.

Beginner's guide to SSL certificates

More from The Register

next story
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Azure TITSUP caused by INFINITE LOOP
Fat fingered geo-block kept Aussies in the dark
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Cloud unicorns are extinct so DiData cloud mess was YOUR fault
Applications need to be built to handle TITSUP incidents
Stop the IoT revolution! We need to figure out packet sizes first
Researchers test 802.15.4 and find we know nuh-think! about large scale sensor network ops
Turnbull should spare us all airline-magazine-grade cloud hype
Box-hugger is not a dirty word, Minister. Box-huggers make the cloud WORK
SanDisk vows: We'll have a 16TB SSD WHOPPER by 2016
Flash WORM has a serious use for archived photos and videos
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
Microsoft adds video offering to Office 365. Oh NOES, you'll need Adobe Flash
Lovely presentations... but not on your Flash-hating mobe
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.