Virtualization Directions - Presented by Computerworld & InfoWorld

Hear two security experts, Gene Kim from Tripwire and Mike Poor from Intelguardians, discuss virtualization security risks, as well as how to mitigate them. Topics addressed in this webcast will focus on VMware ESX, but can be used in any virtual computing environments.

The need for increased computing agility, coupled with the increasing cost and complexity of IT systems, have driven the rapid adoption of virtualization technologies. While virtualization has operational and economic rewards, the reality is that when information security controls are improperly implemented or neglected in virtualized environments, real security risks and exposures can be created faster than ever. The good news is that information security can take some practical steps right away to limit operational and security risks.

Dan Blanchard,

Paul Poppleton, Senior Staff Engineer with Qualcomm

Paul has working with virtual infrastructure since Qualcomm began adopting the technology six years ago. He has in-depth experience with the deployment, operation and management of some 4,000 virtual servers and related systems, storage and I/O hardware.

Jay Corn, Senior Manager, Accenture.

Jay is the North American lead for Accenture’s Infrastructure Automation initiatives as well as the global co-lead for Accenture’s Utility Computing and Virtualization practices. Jay’s background includes both infrastructure consulting as well as application development/deployment. Jay has extensive experience with program delivery for Fortune 100 clients across data center provisioning and rationalization, server/storage consolidation, system integration, and custom application development.

Enterprise Architect – Assistant Vice President
Amerisure Mutual Insurance Company

Mr. Wilson has been in the IT industry for 30 years and has owned his own consulting firm as well as a being a principal at Ernest & Young. His experience has included a number of companies and has spanned the insurance, finance, transportation, software and health industries in the United States and Europe. The depth of his experience includes system development, database administration and for the last decade architectural strategy, design and implementation.

Mr. Wilson started with Amerisure Insurance in 2004 as their first Enterprise Architect and has acted as a change agent in that organization to bring about a significant transformation, moving the company forward with a comprehensive virtualization strategy. The early and tangible success of these efforts have created a momentum for driving this strategy broader and deeper across the organization.

Mike Poor is a founder and Senior Security Analyst with Intelguardians. Mike conducts forensic analysis, penetration tests, vulnerability assessments, security audits and architecture reviews. His primary job focus however is in intrusion detection, response, and mitigation. Mike is an author and editor of the international best seller “Snort 2.1” book from Syngress, and is a Handler for the Internet Storm Center. Mike teaches Intrusion Detection for the SANS Institute and has supported Intrusion Detection and Incident Response teams for the military, and has worked for Sourcefire as a research engineer, and for the SANS Institute leading their Intrusion Analysis Team.

Gene Kim is the CTO and founder of Tripwire, Inc. In 1992, he co-authored Tripwire while at Purdue University with Dr. Gene Spafford. In 2004, he wrote the Visible Ops Handbook and co-founded the IT Process Institute, dedicated to research, benchmarking and developing prescriptive guidance for IT operations and security management and auditors. In 2003, was named by InfoWorld as one of the “Four Up and Coming CTOs to Watch" and in 2007, ComputerWorld added Gene to their “40 Innovative IT People Under The Age Of 40” list.

Scot Finnie is Editor in Chief of Computerworld. Finnie is an award-winning journalist who has nearly 25 years experience as a magazine and online editor and writer covering computers and IT.

Last week, Microsoft announced that it had shipped its Microsoft Hyper-V Server 2008 virtualization platform to market. And it is now readily available for download.

So what's new and different? Didn't they already release Hyper-V? This platform is slightly different from the version found in Microsoft's Windows Server 2008 operating system. According to Microsoft, it provides a simplified, reliable, and optimized virtualization solution for customers to consolidate Windows or Linux workloads on a single physical server or to run client operating systems and applications in server based virtual machines running in the datacenter. And it allows customers to leverage their existing tools, processes and skills. But perhaps best of all, Microsoft is making this product a no-cost Web download –- yup, it's free!

The company describes it as a stand-alone version of the Hyper-V role that's currently included in the Server 2008 OS. It is sort of looked at as a bare-metal version of Microsoft's hypervisor technology, detached from the rest of Windows Server 2008. In fact, the product will install much like Server 2008, though there is no GUI – and you are left with a command line UI unlike anything Microsoft has provided to folks in quite some time! It comes with a bare bones management tool, Hyper-V Manager, to help with remotely configuring things on the server.

Some of the requirements you'll need to keep in mind before downloading the product:

Over on the official Microsoft Windows Virtualization Product Group blog, they listed a few items about the release that people might be interested to know.

And Hyper-V Server is going to be available in a number of languages, including English, German, Japanese, French, Spanish, Chinese, Korean, Portuguese, Italian, and Russian.

The provisioning and management tools are based on Microsoft System Center, providing centralized, enterprise-class management of both physical and virtual resources. Microsoft also announced that Microsoft System Center Virtual Machine Manager (MSCVMM) 2008 will be released and available by the end of October. I was hoping it would be out sooner, but, if they can make it out before the end of the month, I think most people will be happy. Hopefully it doesn't get pushed out any further, or people will start to groan ... as well they should.

Over my lifetime, I've heard the saying over and over again: the only guarantees in life are death and taxes. But NetApp is going out on a limb offering its customers its own guarantee -- customers will use 50 percent less storage in their virtual environments with NetApp compared to traditional storage. And the company wants to assure its customers who leverage NetApp's unique storage-efficiency technologies that they will not only reduce overall storage usage, but also improve performance.

NetApp claims its software features, such as thin provisioning, data deduplication, and space-efficient snapshots, save capacity in VMware environments.

The company maintains that they are confident that customers will use 50 percent less storage, though they also said that the average customer savings are often even greater than that.

By following established best practices implemented by NetApp Professional Services and utilizing storage-efficiency technologies designed into the NetApp Data ONTAP operating system, the company said customers can save capacity and tap into the unrealized potential of their virtual infrastructure with these standard features:

Customers anywhere in the world who purchase a new system for their virtual desktop and server environment can take advantage of this program. If customers don't use 50 percent less storage after following best practices, NetApp will provide the additional capacity as needed to meet the shortfall at no additional charge, up to 50 percent of the original capacity purchased.

For more information about NetApp's guarantee, visit the company's Web site where you can also access an efficiency calculator.

The NetApp program is starting to roll out now, and the guarantee ends on March 31, 2009.

Parallels continues to advance the company's presence and market share by signing yet another key technology alliance. Last month, the virtualization company formed a technology alliance with DataCore Software, a leading provider of storage virtualization software. And a few months prior to that, the company signed a deal with Quest Software that launched a Virtual Desktop Infrastructure bundle and offered enterprises a centralized Windows desktop deployment and management platform.

The new alliance deal with DataCore is expected to provide mutual customers with an enhanced "complete virtualization" user experience by combining both vendor's best-of-breed solutions -- server virtualization plus storage virtualization. The deal is also expected to facilitate cross-qualification of their respective solutions on an ongoing basis.

"Businesses want to increase the efficiency and return on investment from their IT infrastructure and are recognizing the role virtualization plays in generating greater utilization, both in terms of storage and on their servers," said Serguei Beloussov, CEO of Parallels. "Together, Parallels and DataCore can provide customers with an immediate return on their virtualization investment and tremendous flexibility to meet or exceed tomorrow's needs."

DataCore's manufacturer-independent, software-based storage solutions run on any standard physical or virtual server, abstracting away the underlying hardware and freeing up the consumer from standardizing on one single hardware platform. According to both companies, this low-cost networked storage combined with Parallel's virtual server infrastructure enables benefits such as no downtime maintenance, automatic capacity management, and business continuity without a heavy hardware investment.

"Our objective is to work together to give our mutual customers the very best that the combination of storage and server virtualization can offer," said George Teixeira, president and CEO of DataCore Software. "A DataCore and Parallels combination is a great choice for customers because they each offer significant capability, performance, and price advantages and have strong track records of highly satisfied customers."

Working together and forming technology alliances like these give Parallels a better foothold when trying to go head-to-head with VMware.

Virtual servers are not free, but some users are treating them that way. It's so easy and inexpensive to provision new virtual servers these days that users are asking for them for all sorts of temporary applications - and then not telling anyone when they're done with them. At one point the practice became common enough at Qualcomm that IT jokingly coined a term for people who were sitting on idle virtual server capacity: Server huggers.

While the term sounds funny, the problem isn't, particularly as a virtual server farm scales into thousands of virtual machines. Here's how it can happen, says Paul Poppleton, senior staff engineer at Qualcomm. A business unit manager might request several servers for testing applications, but then forgets about them - or decides to keep the idle virtual servers when he's done, just in case he needs them for something else down the road. Because virtual servers can be provisioned so quickly and inexpensively, idle, abandoned or forgotten virtual servers can add up even more quickly than did orphaned physical servers.

Just how big are the resource implications? Consider this: Over five years Qualcomm's virtual server farm has grown to 4,000 virtual servers. During the same time it reclaimed 4,500 virtual machines. Had it not been watching virtual server use, Qualcom's IT operation could conceivably have been managing twice as many virtual servers, more than half of which would be idle. That's why today when a user requests a virtual server at Qualcomm they must state whether or not the server is permanent - and IT follows up.

Poppleton has more than five years of nuts and bolts experience to share about scaling a virtual server infrastructure. He will be joining me on Thursday, October 22nd for an online panel discussion entitled "Virtualization Gotchas" - and you're invited. The discussion is, aptly enough, part of Computerworld's virtual trade show, called Virtual Directions, so you don't have to travel to be there. You just sign up by clicking here.

Scaling up with virtualization? Paul and our other panelists will be starting at 1:15 p.m. Eastern time - and we'll leave plenty of time for your questions. I hope you can join us.

As a technology, virtualization is said to still be in its infancy even though virtualization stretches back to the late 1950s and 60s and x86 virtualization dates back to 1998. But it has only been in the last few years that the technology has been fully embraced by the IT world.

However, virtualization has always found a friend in the academic community. And support in that community has grown. VMware's Academic Program has quadrupled in the last 12 months. The program has given 1,350 computer science, engineering, and information systems academic departments in 54 countries open access to resources, research, and VMware's virtual infrastructure technology.

To answer academia's growing need for virtualization information, VMware has created yet another community portal called GoVirtual.org.

According to VMware, the new community site is intended to provide research and instruction on virtualization-related topics by enabling the sharing of ideas, results, materials, and tools among its members. The site is described as a comprehensive resource and knowledge base where members of academia can go to find the latest research and interact with leading researchers.

GoVirtual.org is on its way to becoming a great source of virtualization information. The community supports blogs and discussion forums for members to communicate with each other. It also provides a list of academic- and research-oriented virtualization conferences. To help educators and students with their virtualization research projects, the site includes a download section with source code and software tools. And it also includes a collection of several technical papers as well as freely available courseware. The 25 free courses currently being made available include concepts such as the basics of virtualization, interpretation and binary translation, I/O architectures of virtualization, and binary optimization.

Universities such as Carnegie Mellon University, Ecole Polytechnique Federale De Lausanne (EPFL), Georgia Tech, Harvard University, Massachusetts Institute of Technology (MIT), and University of California at Berkeley are already benefiting from the VMware Academic Program.

"GoVirtual.org is a much-needed resource given the rapid growth of the VMware Academic Program and the academic community's high interest in virtualization and VMware products," said Dr. Stephen Herrod, CTO at VMware. "I invite educators and students to use the site as a forum to exchange ideas, papers, and courseware; to discuss new ways to use virtualization in the classroom and labs; and to brainstorm ground-breaking research ideas to make virtualization even more useful and impactful for datacenter and desktop management."

The site is supposed to be open to all virtualization platforms, technologies, and features. So it will be interesting to see if Microsoft, Citrix, and others take part in the VMware-owned and controlled community. And it will be interesting to see just how open VMware makes the site. VMware's virtualization trade show, VMworld, is supposed to be open to all virtualization technology as well, but it is still owned, controlled, and dominated by VMware. As this is an academic site, hopefully it can remain impartial.

VMware and Long View have released a new document called VMware VDI Storage Considerations. This information guide focuses on design choices for the storage environment that forms the foundation of a production VMware VDI implementation.

Within the IT world, there are a number of ways to deploy Microsoft Windows XP and Vista environments out to end-users. The traditional desktop model still exists where each user is provided with the necessary desktop hardware to run one of these operating systems locally; an alternative approach exists where a thin client or low-end desktop is used to access a common server running Microsoft Terminal Services or Citrix; and then there is VDI, a hybrid approach of sorts where each end-user has a thin client and connects to a private Windows XP or Vista image that is hosted on a virtual infrastructure.

VDI gives the administrator more control over the user environment by consolidating the Windows images onto server-class hardware. More security is achieved as well because the image is stored and managed in the datacenter. Training is limited because the Windows environment appears to the end-user as a normal local installation.

The document goes into a deeper dive to help you understand more about the four protocols of choice supported by VMware ESX 3.0 and later: Fibre Channel Protocol (FCP), iSCSI, NFS, and 10-Gigabit Ethernet (10GbE). And it then details the primary considerations for protocol choice: maximum throughput, VMDK behavior on each protocol, and the cost of reusing existing versus acquiring new storage infrastructure.

This document is a good read to help you gain a better understanding of the disk and storage needs and the design choices of a VMware VDI implementation.

You can download VMware VDI Storage Considerations from the VMware Resources Web site.

VMware has addressed a number of security problems with its latest set of patches and updates. With VirtualCenter Update 3 and a number of other updates to different VMware products, the company addresses a host of security issues such as privilege escalation, HA problems, and other vulnerabilities.

VMware has recently released a set of new updates and patches for a number of its products to help address several security issues that have been identified. These multiple security issues are described in a new security announcement covering VMware VirtualCenter 2.5 Update 3 and patches for ESX and ESXi. There is also an updated VMware security advisory that details information on other VMware products such as Workstation, Player, ACE, Server, and VCB.

VMware released updates for ESX and ESXi as well as an Update 3 patch for VirtualCenter 2.5. One reason why people are flocking to virtualization is because it offers an easy high-availability solution, and this is one area that is being addressed with the latest round of patching. A number of issues have been addressed with VMware High Availability: network compliance checking, HA-DRS clustering and maintenance mode, advanced settings, and user permission issues.

VMware VirtualCenter Update 3 also addresses potential information disclosure and updates to Java JRE packages. The new update resolves an issue where a user's password could be displayed in cleartext. When logging into VirtualCenter Server 2.0 with Virtual Infrastructure Client 2.5, the user password might be displayed if it contains certain special characters. The dialog box displaying the password can appear in front or hidden behind other windows. The patch also updates the JRE package to Version 1.5.0_16, which addresses multiple security issues that existed in the previous version of JRE.

You can read more about these issues in the VirtualCenter 2.5 Update 3 Release Notes.

The latest security advisory also addresses an in-guest privilege escalation on 64-bit guest operating systems in ESX, ESXi, and previously released versions of the company's hosted product line. A flaw in VMware's CPU hardware emulation could allow the virtual CPU to jump to an incorrect memory address. Exploitation of this issue on the guest operating system does not lead to a compromise of the host system but could lead to a privilege escalation on the guest operating system.

And updates to VMware Workstation, Player, ACE, Server, and VCB also address information disclosure, privilege escalation, and other security issues.

One of the ISAPI extensions provided by VMware is vulnerable to a remote denial of service attack. By sending a malformed request, IIS might shut down. IIS 6.0 restarts automatically, but IIS 5.0 does not when its Startup Type is set to Manual.

This release also fixes privilege escalation vulnerabilities in host systems. Exploitation of this vulnerability allows users to run arbitrary code on the host system with elevated privileges.

Keep your VMware ESX environment patched and updated. And you can also download VMware's VirtualCenter 2.5 Update 3 patch here.

Posted by David Marshall on October 5, 2008 12:51 PM