lthough Gartner expects this figure to fall to 30 percent by the end of 2015, analysts warned that many virtualization deployment projects are being undertaken without involving the information security team in the initial architecture and planning stages.
“Virtualization is not inherently insecure,” said Neil MacDonald, Vice President & Gartner Fellow. “However, most virtualized workloads are being deployed insecurely. The latter is a result of the immaturity of tools and processes and the limited training of staff, resellers and consultants.”
Gartner research indicates that at the end of 2009, only 18 percent of enterprise data center workloads that could be virtualized had been virtualized; the number is expected to grow to more than 50 percent by the close of 2012. As more workloads are virtualized, as workloads of different trust levels are combined and as virtualized workloads become more mobile, the security issues associated with virtualization become more critical to address.
Gartner has identified the six most common virtualization security risks that include the information security isn't initially involved in the virtualization projects; a compromise of the virtualization layer could result in the compromise of all hosted workloads; the lack of visibility and controls on internal virtual networks created for VM-to-VM communications blinds existing security policy enforcement mechanisms; workloads of different trust levels are consolidated onto a single physical server without sufficient separation; adequate controls on administrative access to the hypervisor/VMM layer and that the administrative tools are lacking while alongside there is a potential loss of separation of duties for network and security controls.
