StillSecure, After All These Years

Does VMware want to own the virtual ecosystem?

VMware has obviously staked out the clear dominant position in the virtual machine market. However, owning the hypervisor alone may not be enough. VMware announced the acquisition of B-hive Networks, a California and Israeli based company that developed application performance management for virtual applications. According to this article in ComputerWorld, the news is comes as bad news for several start ups that were were trying to establish themselves. With VMware themselves including virtual application performance management, a 3rd party competitor is going to be at an extreme disadvantage to the built in VMware solution. It clearly signals a move by VMware that they want not only to provide the environment for virtual machines, but also the necessary software to make them useful and productive.

This is in contrast to VMware's VMsafe program where they have made available APIs to allow security companies have access to secure the virtual environments. That would seem to indicate that VMware is willing and looking for 3rd party security companies to secure the virtual environment. Is this only a temporary condition and will VMware eventually seek to security the virtual environment themselves? Clearly it appears that Citrix will look to 3rd parties to secure their virtual environments.

At the end of the day does VMware take a page out of the Microsoft playbook and use their dominance in the virtual environment space to eventually also control and monetize the entire virtual environment? If so does that present opportunity to Citrix and Microsoft to form a consortium to take VMware on? I guess we will have to wait and see how this shakes out.

Virtualization and security

No doubt about it, virtualization is quickly becoming the new darling of the security media. Of course I am judging strictly by the media requests we are receiving for interviews. I am still learning about all of the different issues here and will have to pick Hoff's brain a bit, but thinking out loud, here is what I am seeing in terms of categories:

1. Utilizing virtual machines for security versus securing virtual machines. In another words is virtualization an enabler of security. Many security companies by allowing their products to run in a virtual machine claim they have a story around virtual security. To me they are just using virtualization as an enabler to let their product be more efficient and less hardware intensive. However, I don't quite buy that this is virtual security.

2. Virtual to real security - This is security that plays at the intersection of virtual data flows into "real" networks. I don't think you need that much virtual special sauce to play at this intersection, but there are companies jumping the virtual bandwagon by doing just this.

3. Server vs desktop virtual security - A lot of focus has been on the data center/server/application virtualization aspect. I do think that this is where we are going to see a lot product innovation in the coming months. However, over the longer run we are going to see security issues around desktop virtualization. Whether it be desktop agents or better sandboxes that are more OS and HW independent (not just floating on top of the OS), I think there is opportunity here for innovation as well.

4. Virtual to virtual security - this is the part that has me most excited. I think controlling this virtual to virtual data flow is going to take a new class of security. More than the APIs in VMsafe, we are already starting to see a new products and companies filling this niche.

I will be watching RSA carefully to see if this virtual security theme is the "next big thing" for this years show. I think you should too!

NAC - virtually impossible?

Many people have written over the last months the significant problems that virtualization poses for NAC. While there has been a bit of the sky is falling over this, the fact is that today virtual environments are being seen more in server and data centers than on desktops and endpoints. However, make no mistake about it, virtualization is coming to a desktop near you! How is your NAC going to handle this? Tim Greene's column today is on exactly that topic.

Tim rightfully points out that virtualization for inline NAC vendors poses a significant hurdle. I would take it even one step further. NAC on virtualized endpoints on any NAC appliance is a problem. Tim has it right when he says:

"Routing traffic from a virtual machine, out of the physical server, through the NAC appliance then back into the physical server to another virtual host is inefficient. Efficiency is something virtualization is supposed to improve, not make worse."

The answer of course lies in software. If your NAC solution can be done in software you have a much better chance of tackling this problem. Other ways to handle it are to work with the virtual machine vendors, ala VMsafe. I think there is an even better way to do it that we are working on at StillSecure. Here is the bad part though. I can't tell you more about it just yet. Stay tuned for more details, but there is a solution to make this work.

Is VMsafe the answer for virtual security?

It is no secret that virtualization is revolutionizing the data center, the desktop and the very fabric of IT. My friend Hoff has been on the soapbox for a while now on this topic and he has many excellent posts on the subject. Just about every pundit and security person has weighed in with their feelings on virtualization as well. With VMware's announcement of VMsafe a few weeks ago and the impressive list of partners getting behind it, you would think that the leader in virtual machines has staked out the first movers high ground in terms of securing virtual enviroments. However, I am not quite so sure of that.

One obvious drawback is does this work on only on VMware environments. What about Citrix or Microsoft? Also does this set of API's really allow us to truly secure VM environments. Not just VM to non-VM, but VM to VM? What about allowing you to leverage VM inside of security applications to bring greater functionality to existing security solutions? I don't hold myself out as any kind of expert on this (yet), but I don't see VMsafe providing the answers and functionality that we need there. I think it is a great start and gives security vendors a place to start in terms working with the hypervisor to security tomorrows virtualized mission critical environments.

I am interested in your thoughts and comments on this. Please feel free to put your two cents in on this discussion. As I dig deeper, I would like to know what others are thinking on this.

VMware gets spanked!

Ouch!

Is security the fly in virtualization's ointment?

Saw an article today about security concerns delaying virtualization rollouts. I think that virtualization offers too many benefits to the IT department and it will roll over the security folks protests like Patton through Italy. At the end of the day security concerns have to be balanced against business profits. I don't have to tell you who usually loses those battles.

Rather than being viewed as trying to impede progress, we as an industry have to embrace virtualization and figure out how to do the best we can securing these environments. Otherwise we run the risk of being run over like the people who were against horseless carriages.

The game is changing for appliance users too - preaching to the Cobia choir

Eric Ogren has a good article up on his ComputerWorld blog about recent advances by Intel/AMD that make it "increasingly harder to justify large engineering investments in custom-built ASICs or hardware that is not built on a standard platform."  Amen brother!  This is exactly what we have been saying with Cobia from the beginning.  Todays multi-core processors with virtualization technologies offer exponentially greater computing power than have ever been available before from off the shelf products.  To the point that justifying custom silicon hardware in most cases does not make sense.  The good news is that following Moore's Law, this advantage is only going to continue to grow.  Yesterdays dual core lead to todays quad core, who knows what tomorrow.

A couple of points of fact bring home the reality of this for me.  First is the results I have seen with deep packet inspection on these new systems with optimized software.  Though up to this point (as a comment points on Erics article points out) we have only seen sub-Gbps speeds, I have good reason to beleive that this barrier will be passed like the sound barrier in airplanes long ago.  Supersonic deep packet inspection on off the shelf hardware will be a reality in the market within a few months!  The second point of fact is a conversation I had with a security director at a large media company in NY.  He told me that just 2 months he visited a data center his company has over in NJ. The place was cavernous and mostly empty.  He returned just two months later and the center was filled to the brim with Dell servers and they are looking to build another data center.  But they are also mandating to move any and every application possible onto virtual servers.

I am not the first blogger to say that virtualization will revolutionize the data center.  But between virtualization and these powerful new processors, there is a revolution going on.  Check out Cobia and see the performance that these trends are putting in your hands without expensive silicon.  We are just at the dawn of the brave new world, but it promises to continue the computer revolution to empower us to do more for less!

Clap on, clap off - Splashtop!

Rothman writes today about his experience in working in the consumer market with how hard it is to do things that should be simple. He writes how ease of use is a dream and complicated is the norm.  Mike talks about how making it look easy is a magic skill that the only the most successful people and products do.  Of course Mike than takes a swipe at NAC and DLP not being easy enough, but I am not going to take the bait on that one.  What I do want to tell you about is a new company called Splashtop.

Splashtop solves one of the most basic ease of use issues we all have with our computers.  How long it takes to boot.  How many times have we had to do a quick task or just needed to look something up, only to wait literally minutes for first the bios and then that stupid Windows logo to disappear, only to wait even longer for all of our bloatware start up programs to load?  Splashtop solves the problem.  You can launch into a web enabled desktop literally within seconds.  Check out the You Tube video attached to see for yourself.  What a great idea.  It is chimp simple easy to use and gets you up and doing what you need to do right away. Splashtop is the brainchild of Mark Lee and some other really sharp folks. Mark has a long history of success and Splashtop looks like another winner. 

Splashtop actually is installed on the motherboard from what I know and takes advantage of virtualization technology.  By not booting the OS, it offers secure web surfing and even has a green angle, allowing people to shut their computers off more often. In the future as Google Apps and Microsoft Live and others bring more functionalit to web apps, more and more of the tasks we perform really don't need us to boot the whole OS.  Splashtop could be just the ticket.  You can also read more about Splashtop at their blog.

Don't worry Hoff, 2 out of 3 ain't bad - security in virtual environments, the next big thing

My friend Chris Hoff has himself all worked up. In fact Hoff is in a huff. What has Christofer (for those who may not realize he spells his name funny) so worked up you ask? It seems the good folks over at InfoWorld are staging an Executive Forum on virtualization next month down in NYC.  No where on the agenda is even a mention of security and the challenges that a secure virtualization environment poses.  Chris goes so far as to offer, on his own dime, to go down and personally deliver a presentation on security and virtualization. Well Chris it would be nice to see the InfoWorld folks take you up on this, but I would not hold my breath.

But Chris there is good news.  I know for a fact that security in virtualized environments is going to get the attention it deserves.  How do I know this you ask?  Simple, it is my 2 out of 3 ain't bad test.  No, I am not talking about some Meatloaf song from Bat Out of Hell.  I am talking about last week alone doing two interviews. One with a large analyst firm and one with a large VC firm who were only interested in my take and what StillSecure was going to do about the problems around security and virtualization.  The fact that both the analyst and VC asked me in the same week, makes it a high probability of this becoming the next hype sector in security.  In fact the only thing missing is a media interview request.  Something tells me I will get one of those very soon too.

So Chris you are out in front of this one, but have no fear.  Security in virtual environments is going to be big!

Does anybody want to buy just software anymore?

Meant to write about this but with being out in California this week, have not had a chance.  eEye announced that they were going to start offering a scanner appliance.  eEye was one of the last vulnerability management vendors that offered their product as software only (StillSecure's VAM is still offered as software, though we will pre-load it for you on a box).  Two things about this announcement that were interesting though. First was that the box comes with both Retina scanner and the ability to deploy and manage Blink.  That is both network based and host based vulnerability management.  Further evidence that eEye is moving more towards the host security side of things and perhaps away from network based scanning.

More importantly to me though, was the fact that they made the jump to appliances.  For all of the bitching and moaning about managing more boxes and appliance overload, it is clear that the market wants their security served up on a box.  It does not have to be any specialized hardware, but buying the software on a box already, is the preferred method of acquiring security software.  It took many many years for me to give up the ghost on this one, but I yell uncle!  Selling pure software only in the security market is just swimming against the tide.

Now, I think the battle is, how much can you put on the box.  Why stop with just one application, if you have the horsepower?  It seems wasteful.