Virtualization Security Announcements: Architecture Concerns

There have been a large number of Announcements that have been made for VMworld Copenhagen with respect to virtualization and cloud security. This shows quite an interesting growth in the market, and that even 1 month apart there is still more to be announced within the virtual and cloud security spaces. There are three very interesting announcements that show further integration between vendors.
Integration between vendors in the virtualization security space is crucial as it shows that vendors also realize that there is no one tool to solve all security concerns and that picking tool A does not mean you ignore tool B, as they work together.

• HyTrust and CA announced integration between the HyTrust tool and CA’s new Access Control for Virtual Environments, which provides a single policy enforcement layer not only for the virtual machines, but for the administration of those virtual machines.
• HyTrust and Trend Micro have announced integration between HyTrust and Trend Micro’s Deep Security product. HyTrust will handle enforcement of access policy for the virtual environment and Trend Micro Deep Security will do the rest, so to speak.
• AFORE Solutions has announced that their CloudLink tool will also work with VXLAN and vCloud Connector, which is an important step in cloud security.
• VMware vCenter Protect Essentials Plus was also announced with prings the Shavlik Netchk Product into the VMware  vCenter product family

Even so, these integrations raise some interesting architecture concerns about how to now put the growing number of collaborative efforts properly into an ever changing landscape of virtual and cloud computing. One issue are tools that not only manage the virtual environment, but also manage the identity and other aspects of the user environment. This cross-domain management could creates architectural issues where data that should not be allowed outside the virtualization management network, ends up in the user-management network. While this does not sound like a big issue, if not done correctly, it leaves the virtualization management network open to attack. Such an opening is equivalent to leaving the door to your datacenter unlocked and opened with the cameras off to anyone who wishes to take hardware.
These tools help to improve overall security, but security still starts with architecture and design as well as a firm understanding of the basics of what you are trying to protect as well as what weaknesses exist in what you are trying to protect. Gather good intelligence on threats and attacks and then employ the proper suite of protections. These three announcements list a pretty good set of tools. Trust but verify, start with your architecture.