Virtualization and Compliance:

How to Maintain Speed While

Navigating Bumps in the Road

Hemma Prafullchandra
CTO, HyTrust, Inc.
hemma@hytrust.com
 Virtualization Today
Virtualization Emerges from the Test/Dev
Sandbox

• 18-25% of servers in SMB and large enterprise are

virtualized today

• More than 70% of users are comfortable deploying

production apps on shared environments

• “Virtualization First” is the deployment goal for

many larger enterprises
Source: Taneja Group

2
 Virtualization Today
Virtualization Emerges
from the Test/Dev
ROI is Proven for Dev-Test
Sandbox and Tier 2 Applications
• 18-25% of servers
in SMB and large enterprise
are virtualized today • Primary Use Case to Date:
• More than 70% of users
Consolidation
are comfortable deploying
production apps on shared
environments • Primary IT Challenges: P2V, Rapid
• “Virtualization First” is the
Provisioning, Sprawl Management
deployment goal for many
larger enterprises
• Server virtualization has driven
storage and network virtualization
Source: Taneja Group

3
 Virtualization Today
Virtualization Emerges
from the Test/Dev
Sandbox
• 18-25% of servers
in SMB and large enterprise
are virtualized today
• More than 70% of users
are comfortable deploying
production apps on shared
environments
• “Virtualization First” is the
deployment goal for many
larger enterprises
Source: Taneja Group
ROI is Proven for Dev-
Test and Tier 2
Applications
• Primary Use Case to Date:
Consolidation
• Primary IT Challenges:
P2V, Rapid Provisioning,
Sprawl Management
• Server virtualization has
driven storage & network
virtualization
The Next ROI Challenge: Tier
1 Business-Critical
Applications
• More than ¾ plan to virtualize
an additional 25% of servers by
mid-2012
• The combination of sprawl and
higher business criticality for the
next wave of virtualized
workloads will place heavy
burdens on IT operations teams
• Demands higher levels of
infrastructure security,
automated management, and
best-practice control processes
4
 Virtualization Management Inflection Point
Virtualization in Transition
Growth Phase Transition Control Phase
• VM numbers increasing
• Workload priority is higher
• CapEx savings leveling off
• OpEx efficiency declining
• Risk curve rising rapidly
Ops
Compliance Efficiency
Risk Management Focus Shifts:

From Growth to
CapEx Command and Control
Savings

Lower-Priority Business-Critical
Workloads Workloads Source: Taneja Group

5
Before Virtualization

Established Controls
 Physical Security
 Identity and Access Mgmt
 Firewall Mgmt (incl. WAF)
 Perimeter/network segmentation
 Asset Management
Administrator
s
 Vulnerability & Patch Mgmt
 Log/Event Monitoring & Mgmt
 Backup, encryption
 A/V, IDS/IPS, …
Physical Datacenter
 Incident Mgmt
 Policies & Procedures

6
 Before Virtualization
Established Controls
 Physical Security
 Identity and Access Mgmt
 Firewall Mgmt (incl. WAF)
 Perimeter/network segmentation
 Asset Management
 Vulnerability & Patch Mgmt
Administrators  Log/Event Monitoring & Mgmt
 Backup, encryption, A/V, IDS/IPS
…
 Incident Mgmt
 Policies & Procedures
Physical Datacenter
Typical Challenges
Poor hardware utilization leading to higher power/space costs
Limited flexibility
• Rigid architecture
• Long Mean-Time-To-Recovery
Near zero agility – provisioning assets/infrastructure
Limited redundancy/DR setup

7
Compliance Today
Reached a certain level of maturity

• Much to comply with: HIPAA, PCI DSS, SOX, GLBA, FISMA, NIST
800-*, SAS 70, NERC, …

• Many methodologies and frameworks to help: ITIL, COBIT,

VALIT,GAIT, ISO27K, …

• Clear delineation of roles and responsibility

• Typically top-down, risk-based approach

8
 Compliance Today
Reached a certain level of BUT, constantly evolving given innovation
maturity
in technology and threats/risks; and new
• Much to comply with: regulatory/policy requirements
HIPAA, PCI DSS, SOX,
GLBA, FISMA, NIST 800-*,
SAS 70, NERC … • PCI SSC established a Virtualization SIG in
• Many methodologies and
February 2009
frameworks to help: ITIL,
COBIT, VALIT, GAIT, ISO27K • Draft-800-125 released by NIST in July
…
2010
• Clear delineation of roles
and responsibility
• Cloud Security Alliance developing
• Typically top-down, risk- guidance, frameworks and audit tools for
based approach
Cloud Computing

9
 Compliance Today
Reached a certain level
of maturity
• Much to comply with
(HIPAA, PCI DSS, SOX,
GLBA, FISMA, NIST 800-*,
SAS 70, NERC, …)
• Many methodologies and
frameworks to help ITIL,
COBIT, GAIT, ISO27K, …)
• Clear delineation of roles
and responsibility
• Typically top-down, risk-
based approach
BUT, constantly evolving
given innovation in
technology and
threats/risks; and new
regulatory/policy
requirements
• PCI SSC established a
Virtualization SIG in Feb09
• Draft-800-125 released by
NIST in July10
• Cloud Security Alliance
developing guidance,
frameworks and audit tools
for Cloud Computing
Challenge: Adoption and
implementation
• Demands actionable,
auditable & portable controls
for the emerging highly
dynamic environments
• Greater automation and
improved processes
• Continuous visibility and
compliance auditing become
critical
• Models and frameworks
have to span both internal
and external clouds
10
After Virtualization

Administrators

Benefits
 Lower OpEx and CapEx
 Greater flexibility
 Ability to recover more quickly
Virtualized Datacenter
 Speed of server deployment
• Template-based provisioning
 Easy to maintain redundancy
 Cost effective for DR/backup

11
After Virtualization
Virtualized Datacenter

Administrators

Control and Visibility Challenges

Benefits
 Lower OpEx and CapEx
 Greater flexibility
 Ability to recover more quickly
 Speed of server deployment
• Template-based provisioning
 Easy to maintain redundancy
 Cost effective for DR/backup
Unknown Perimeter
New powerful layer – hypervisor
• Configuration management
• Separation of duties
Undefined access paths/new remote APIs
Virtualized infrastructure components
Server consolidation – density & diversity
Fully functioning Assets are mobile
Lack of Visibility
• Trouble-shooting root cause
• Logs from each components

12
Re-review with Virtualization in Mind
Plan Establish policies, processes, procedures, and security
Plan
controls taking a top-down risk based approach.
Implement and operate policies, controls, processes
Act Do
Do and procedures focusing on automation and
consistency.
Check Check Monitor/assess and review focusing on continuous.
Maintain and improve, take corrective and preventive
Act
actions focusing on automation and consistency.
Operational and
support-oriented
processes

Compliance
and security
IT goals

Compliance
and risk
Four Inter-related Domains of COBIT
Source: ISACA business goals

13
Existing controls/solutions are inadequate
Security Control Domain
Access and User Administration:
- Centralize User and Group (de)provisioning
- Grant access on need basis
- Enforce least privilege
- Reduce and monitor privileged access
Change and configuration:
- Inventory and track all assets
- Authorize and track all change mgmt activity
- Monitor and manage configuration
Operations:
- Vulnerability and patch management
- Retain granular logs for audit/forensic needs
- Regularly review collected logs
Additional Virtualization-specific controls
- Consider both physical and logical access
- Segregate hypervisor administrative duties (e.g. by
function, purpose or ownership)
- Control all access paths/remote APIs
- Segment virtual networks
- Segregate resources by purpose or ownership
- Harden hypervisor, virtual machine container,
virtualized infrastructure components & associated
management servers configurations & monitor drift
- Inventory and track all virtual components/resources
- Ensure that critical virtualized infrastructure
components are NOT turned off (accidently /otherwise)
- Patch hypervisor and virtual machines (offline &
online)
- Collect logs from hypervisor, management servers,
virtualized infrastructure components
- Log records MUST state who did what, when and on
what virtual object residing on what host
14
 Questions?
Click on the questions tab on your screen, type in your question, name
and e-mail address; then hit submit.

15