A horse's ass approach to virtualization security - The four horsemen

I opinioned a bit about the current approaches to virtualization security and how they might be failing to address current and future threats - let me explain further what I mean.

In the previous blog I gave a summary of my argument. In this second blog of the series I want to talk about the four elements that make up every computing environment
(i.e. the four horsemen :)): This will setup the argument I hope to make in my next blog.

• Devices: These are the hardware and operating system combinations that host or store the execution environment.
• Applications: Applications execute on host environments (devices + OS) and transform data into information useful for the business.
• Data: Digital representation of information that is acted upon by applications.
• Networks: Enable collaboration and the sharing of information across multiple devices and/or applications.

All four are absolutely essential to complete any transaction in the modern business world. However, to gain competitive advantage, organizations are looking to optimize the usage of these four elements. Technology, flexibility, and agility are becoming increasingly important in a fast-changing business world and have therefore led to the rise of virtualization.

In my next post I will discuss how these elements are being changed in a virtual environment and what impact it has on security.

Virtualization and information-centric security

Many more of the customers I talk to are focused on virtualization as a core infrastructure strategy. They obviously want to know more about how this will affect how they look at security. While I am not the expert on anti-virus/malware, NAC, intrusion prevention etc, one area that I get excited about is the data protection implications of this trend...

As devices get abstracted and pushed to the background, it appears we are left, at the core, with applications and data. The interactions between the two dictate productivity, security et al. In this context, an information-centric security paradigm becomes even more important.

There are no devices to lock down (these will be virtual - appearing and dissapearing as required). Much of the data will be accessed from virtual containers. Therefore, protecting the data itself, regardless of the applications, the devices, the networks will become crucial in this evolving landscape...