The Ashimmy Blog

I want to go to VMWorld and need your vote

OK, here is the deal, plain and simple:

My friend Edward Haletky of the Virtualization Practice has asked me to appear on a panel at VMWorld in San Fran, late August.  The panel is on Compliance Challenges within IaaS. The abstract is:

"Compliance within the Cloud is just starting to be discussed, Get in on the ground floor with a discussion featuring industry, government, and compliance bodies. We will discuss the current and future directions of Compliance within IaaS as well as cost-effective guidance for implementation. "

The way VMWorld is doing things this year, if you register with VMWorld you vote for which tracks you would like to see. So if you would take a moment and vote for Compliance Challenges within IaaS I would be eternally grateful.

Take not that there are lots of great panels to vote for. My name is not mentioned on this one, the moderator is Peter Mell of NIST.  Please vote if you can. Also my friend Ed is up for a few more panels, if you can vote for more than one, vote for Ed too. He is a walking dictionary on VMware and virtual security and literally wrote the book on it.

Cloud computing officially enters pop culture

OK its official, Cloud Computing is just not cool anymore.  Nothing that goes too mainstream pop can be cool. Too commercial. Watching Monday Night Football tonight, I saw the IBM commercial for cloud computing.  Personally I think it is the kiss of death.

Does this signify critical mass or a fad that is on the way down? 

Related articles by Zemanta

• IBM launches private business analytics cloud (news.cnet.com)
• Cloud to suck money out of market, report says (news.cnet.com)
• IBM Tells Reluctant Enterprises "Just Do It" (cloudave.com)
• A Day of Straight Talk on Cloud Computing, Coming December 10 (xconomy.com)
• Cloud Computing - A Really Poor Name (lockergnome.com)
• IBM announces new beta services for cloud software development (infoworld.com)

Chateau Cloud ‘09, before the rains

Sometimes I just can’t help myself. No matter what I do, I get myself in trouble. For the most part I have stayed out of the whole cloud thing. I have watched on the sidelines as Hoff, Amrit and countless others have pontificated ad nausem about cloud this, virtual that, a new paradigm here, a revolution in the making there.  I stayed away from the hype.  To me I had been there and done that and have a bunch of worthless stock certificates to prove it. Back when StillSecure CEO Rajat Bhargava and I were getting Interliant going we were one of the early entrants in the ASP market (the cloud providers of our day).  We were hosting and managing all kinds of applications, web sites and other infrastructure, including dare I say it, managed security. I have also been through my share of market hype (NAC anyone?) too and recognize much of the cloud buzz for what it is.

Today I tried to write a small commentary on what was truly a tragedy on multiple levels. One of the least levels of tragedy was what can happen when we trust our providers to store our (take your pick) – applications, data, IP, stuff – on line in a shared or virtual environment.  This is why security of our cloud environments is so important. Without that security in place which allows the user to trust in the provider, the cloud will never ascend.  The real tragedy of this story is that not only did 10’s of thousands of people lose their websites and data probably for good, but a young man who developed the software that was hacked felt so guilty that he apparently took his life by hanging himself. Can you imagine! When many software vendors today won’t even acknowledge some vulnerabilities this poor soul took his life.  I guess its lucky Bill Gates never felt that personally responsible for any Microsoft vulnerabilities.  It is not a joking matter though. Many thousands of people effected. A web hosting business in shambles and a young life snuffed out.  Securing the cloud is rather minor on this scale.

But my friend Hoff (now of Cisco. Should be interesting to see what effect this may have on the blog) and Kirsh from someplace called CloudAve.com, took me to task.  Evidently this was just a shared environment and to “fear monger” about the cloud being insecure was totally out of line. Chris fails to see how a “PHP script vulnerability in a virtualization management program” equates to a cloud problem.  Geez I don’t know. Like I wrote in my reply, perhaps I don’t have the sophisticated palate that these gentlemen have to recognize a fine cloud when I see one. I felt like I was out on a Saturday night with some of my Boca friends when they debate the merits of this bottle of wine or that one. Hey aren’t they all just a bunch of grapes. Or better yet discussing maduro wrappers versus lighter tobacco wrappers, Dominican versus Cuban. Come on now. I had a flashback to Jim Ignatowski on the show Taxi smelling cocoa leaves to see where they were grown and when.

Maybe I will never be on the cover of Cloud Aficionado magazine, but I think most people have the same view I do. When I am talking about my stuff being kept up and off of my premises, it is up in the cloud. It doesn’t have to be fancy or sophisticated. You don’t need fancy diagrams or long winded treatises with story book names. it is really quite simple. When my stuff is up there I am getting it in the cloud. A PHP vulnerability on a shared server is not very different than a vulnerability in salesforce.com, if it means someone can gain access to salesforce and wipe out my data. 

To satisfy my own curiosity I went to Wikipedia and looked up Cloud Computing. Oh now that cleared it up - NOT. There is grid computing, utility computing, SaaS, PaaS, IaaS, yada, yada, yada. I don’t know about you all, but I would bet the common man would still have a tough time distinguishing today’s cloud versus the service bureaus and time sharing on the main frames from back when I was a kid and I went to work with my Mom (yeah I am that old). I am tired of hearing about paradigm shifts (the dot com bubble, the housing bubble, now the cloud bubble).  But lets leave the cloud snobishness out of it. Don’t forget that though some may sit around letting the wine breathe, enjoying a fine smoke discussing the more subtle points of a good cloud architecture, the rest of the world has to live,work and deal with this stuff everyday.

Related articles by Zemanta

• CloudNews for May 22nd, 2009 (cloudave.com)
• Intalio|Cloud (slideshare.net)
• Has 'cloud-computing' lost its VC luster? (news.cnet.com)
• Security Flaw Hits VAserv; Head of LxLabs Found Hanged (it.slashdot.org)
• Be careful putting your trust in the clouds (guardian.co.uk)

This is why cloud security matters

I have heard many people who say that this whole cloud security thing is much ado about nothing. Besides getting Hoff’s blood pressure going, most people just shrug.  Yesterday’s article in the Register detailing the erasure of perhaps 100,000 web sites from a UK based web host is a poster child of the stakes in play with cloud security.

The web host evidently used virtualization software from a  company based in Banglore called LxLabs. Today comes word that the CEO of the company was found dead by hanging in an apparent suicide (what is it with people hanging themselves lately, will we hear rumors of sexual asphyxiation next?) Anyway, the software in question had either a zero day vulnerability or one that was a few weeks or months old (It all depends on who you believe on that one). In any event, the vulnerability gave the intruders root access to the machines in question.  The kind folks who perpetrated this crime then proceeded to wipe out the files of all of these web sites.  Perhaps half of these sites did not pay for any back up service, so their data and files may in fact be lost for good. That is just crazy!

So here are the stakes for the cloud. If something goes wrong and there is an incident, that incident can effect 10s or 100s of thousands of people and organizations.  With that much @stake (no pun intended), we cannot afford to be very serious about securing our cloud based environments!

Related articles by Zemanta

• After 100K sites wiped clean LxLabs boss found hanged (inquisitr.com)
• LxLabs boss found hanged after vuln wipes websites (theregister.co.uk)
• Security Flaw Hits VAserv; Head of LxLabs Found Hanged (it.slashdot.org)

The Jericho Forum moves beyond de-perimeterization to the cloud

Saw this recent release on two new board members joining the board of the Jericho Forum and it sparked a synapse in my brain about a good panel discussion I caught during the SC World Congress in December by several Jericho Forum members.  You can watch two of the presentations delivered that day here.  Getting away from all of the rhetoric around de-perimertization and talking about securing the cloud and other topical security subjects made the Jericho folks much more relevant to me.

One of the new board members is Phillipe Courtot, CEO of Qualys.  Of course Qualys's SaaS vulnerability management solution is more of a cloud solution and not about perimeters.  For me anyway, I think this is welcome change in focus by the Jericho Forum.

Does VMware want to own the virtual ecosystem?

VMware has obviously staked out the clear dominant position in the virtual machine market. However, owning the hypervisor alone may not be enough. VMware announced the acquisition of B-hive Networks, a California and Israeli based company that developed application performance management for virtual applications. According to this article in ComputerWorld, the news is comes as bad news for several start ups that were were trying to establish themselves. With VMware themselves including virtual application performance management, a 3rd party competitor is going to be at an extreme disadvantage to the built in VMware solution. It clearly signals a move by VMware that they want not only to provide the environment for virtual machines, but also the necessary software to make them useful and productive.

This is in contrast to VMware's VMsafe program where they have made available APIs to allow security companies have access to secure the virtual environments. That would seem to indicate that VMware is willing and looking for 3rd party security companies to secure the virtual environment. Is this only a temporary condition and will VMware eventually seek to security the virtual environment themselves? Clearly it appears that Citrix will look to 3rd parties to secure their virtual environments.

At the end of the day does VMware take a page out of the Microsoft playbook and use their dominance in the virtual environment space to eventually also control and monetize the entire virtual environment? If so does that present opportunity to Citrix and Microsoft to form a consortium to take VMware on? I guess we will have to wait and see how this shakes out.

Virtualization and security

No doubt about it, virtualization is quickly becoming the new darling of the security media. Of course I am judging strictly by the media requests we are receiving for interviews. I am still learning about all of the different issues here and will have to pick Hoff's brain a bit, but thinking out loud, here is what I am seeing in terms of categories:

1. Utilizing virtual machines for security versus securing virtual machines. In another words is virtualization an enabler of security. Many security companies by allowing their products to run in a virtual machine claim they have a story around virtual security. To me they are just using virtualization as an enabler to let their product be more efficient and less hardware intensive. However, I don't quite buy that this is virtual security.

2. Virtual to real security - This is security that plays at the intersection of virtual data flows into "real" networks. I don't think you need that much virtual special sauce to play at this intersection, but there are companies jumping the virtual bandwagon by doing just this.

3. Server vs desktop virtual security - A lot of focus has been on the data center/server/application virtualization aspect. I do think that this is where we are going to see a lot product innovation in the coming months. However, over the longer run we are going to see security issues around desktop virtualization. Whether it be desktop agents or better sandboxes that are more OS and HW independent (not just floating on top of the OS), I think there is opportunity here for innovation as well.

4. Virtual to virtual security - this is the part that has me most excited. I think controlling this virtual to virtual data flow is going to take a new class of security. More than the APIs in VMsafe, we are already starting to see a new products and companies filling this niche.

I will be watching RSA carefully to see if this virtual security theme is the "next big thing" for this years show. I think you should too!

NAC - virtually impossible?

Many people have written over the last months the significant problems that virtualization poses for NAC. While there has been a bit of the sky is falling over this, the fact is that today virtual environments are being seen more in server and data centers than on desktops and endpoints. However, make no mistake about it, virtualization is coming to a desktop near you! How is your NAC going to handle this? Tim Greene's column today is on exactly that topic.

Tim rightfully points out that virtualization for inline NAC vendors poses a significant hurdle. I would take it even one step further. NAC on virtualized endpoints on any NAC appliance is a problem. Tim has it right when he says:

"Routing traffic from a virtual machine, out of the physical server, through the NAC appliance then back into the physical server to another virtual host is inefficient. Efficiency is something virtualization is supposed to improve, not make worse."

The answer of course lies in software. If your NAC solution can be done in software you have a much better chance of tackling this problem. Other ways to handle it are to work with the virtual machine vendors, ala VMsafe. I think there is an even better way to do it that we are working on at StillSecure. Here is the bad part though. I can't tell you more about it just yet. Stay tuned for more details, but there is a solution to make this work.

Is VMsafe the answer for virtual security?

It is no secret that virtualization is revolutionizing the data center, the desktop and the very fabric of IT. My friend Hoff has been on the soapbox for a while now on this topic and he has many excellent posts on the subject. Just about every pundit and security person has weighed in with their feelings on virtualization as well. With VMware's announcement of VMsafe a few weeks ago and the impressive list of partners getting behind it, you would think that the leader in virtual machines has staked out the first movers high ground in terms of securing virtual enviroments. However, I am not quite so sure of that.

One obvious drawback is does this work on only on VMware environments. What about Citrix or Microsoft? Also does this set of API's really allow us to truly secure VM environments. Not just VM to non-VM, but VM to VM? What about allowing you to leverage VM inside of security applications to bring greater functionality to existing security solutions? I don't hold myself out as any kind of expert on this (yet), but I don't see VMsafe providing the answers and functionality that we need there. I think it is a great start and gives security vendors a place to start in terms working with the hypervisor to security tomorrows virtualized mission critical environments.

I am interested in your thoughts and comments on this. Please feel free to put your two cents in on this discussion. As I dig deeper, I would like to know what others are thinking on this.

VMware gets spanked!

Ouch!