Myths about virtualisation security

Reality: This is a very common perception, and can be the root cause of many challenges that IT departments will face while trying to secure their virtual infrastructure. Most traditional endpoint security solutions are "virtual-aware" and can provide protection for virtual environments, but it will impact performance, especially in large deployments, and can create havoc within a network. However, even worse, traditional endpoint security software can create security gaps that result from slowing down the network.

Therefore, it is essential to utilise specialised security virtualisation solutions that protect virtual environments without impacting performance of the network.

Reality: It certainly does, and the performance issues noted above can actually create security gaps that didn't exist before. Traditional endpoint security uses what's known as an "agent-based" model. It means that each physical and virtual machine has a copy of the security software on it. This works fine for physical machines, but if you have 100 virtual machines, this means you have 100 instances of these security agents, as well as 100 instances of its malware signature database running on a single virtual host. This high level of duplication wastes storage capacity, and can create some of the security problems that were to be fixed in the first place.

In this model, if a dozen of virtual machines simultaneously start running a normal security scan, all the other applications on that hypervisor will be slowed down. This applies to other aspects of security as well. If malware is detected in a network, and the policy dictates all machines should scan for infection, the virtual network will grind to a halt and limit ability to find the malware.

Even the routine task of updating the 100 different anti-malware databases can create network traffic jams (known as Update Storms) if they're conducted all at once, meaning some virtual machines can be unprotected from the latest threats for hours during the "staggered" release of updates.

Furthermore, consider the 08h30 start of a workday, when dozens of virtual machines are activated simultaneously. These machines haven't received updates since they were "shut down" the night before, which means each machine is trying to pull-down the latest anti-malware updates simultaneously as well. And until these updates travel through the jammed virtual host, a process which can take a lot of time, these virtual machines are all vulnerable to yesterday's threats.

Reality: This just isn't true. Virtualisation is designed to allow software, including malware, to behave as it normally would. In the end, malware-writers will target any and all weak points in a business network to accomplish their criminal goals. And the more virtual networks become hosts for critical business operations, the bigger a target they'll become.

Just think of the types of data virtual network touches. If an attacker compromises one virtual machine and finds a way to jump to the hypervisor, and the attacker now has access to every virtual machine on that host. In addition to virtual desktops, the attacker could potentially gain access to any virtual data-backup or storage, effectively giving the attacker access to all of a business's data.

Reality: There are actually a handful of different approaches to virtualisation security, and your infrastructure will probably need a blend of available options. The above examples were about how "agent based" security relies on processing security on each individual endpoint, and hopefully IT managers and CIOs have decided that the "agent-based" model used by traditional endpoint security isn't optimal for their virtual infrastructure.

However, the right application, or combination of applications, depends entirely on what is about to be protected. A non-web-connected server is going to have different security needs than a virtual desktop of a server that manages sensitive information. So along with "agent based" two different types of virtualisation security, known as "agent-less" and "light agent", should be reviewed to make the right choice for a specific virtual infrastructure.

Kaspersky Security for Virtualisation is such a solution. To find out more about the virtualisation security options, please visit: http://www.kaspersky.com/business-security/virtualization.

There's far more to virtualization security that can be covered. This is a critical area for global business growth over the next few years, and Kaspersky Lab's team of global experts is leading the charge to secure this new frontier of business IT.

* The company was rated fourth in the IDC rating Worldwide Endpoint Security Revenue by Vendor, 2012. The rating was published in the IDC report "Worldwide Endpoint Security 2013-2017 Forecast and 2012 Vendor Shares (IDC #242618, August 2013). The report ranked software vendors according to earnings from sales of endpoint security solutions in 2012.