Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

2/21/2014
09:58 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Is The Hypervisor Security's Goldilocks Zone?

RSA presentation to put virtualization forward as a tool to fix security's architectural problems

During the past several years, there's been much attention spent at security events on handwringing over the security risks of cloud and virtualization adoption in the enterprise. The upcoming sessions at RSA will be no exception, but one security researcher with VMware will be turning the theme on its head. He's got a talk planned on how the fundamental technology around virtualization and cloud could actually hold the key to solving a lot of security's architectural problems.

RSA Conference 2014
Click here for more articles about the RSA Conference.

"If you look at security spend, it outpaces IT spend already. And then the only thing that outpaces security spend is security losses," says Martin Casado, CTO of networking for VMware. "We continue to fight a losing battle and it's pretty clear that we can't spend our way out of this. So this suggests to me as a technologist that there's an architectural problem."

Known most for creating OpenFlow and for his work pushing the software-defined networking movement forward -- he was awarded the 2012 Grace Murray Hopper Award by the Association for Computing Machinery for that -- Casado actually has his technology roots in security. Prior to his post graduate work at Stanford, he spent nearly six years working for the Lawrence Livermore National Laboratory, with a good of his time spent on security. So it's a return to a comfort zone now as he's dedicated the past half year thinking deeply about how virtualization fits into the security ecosystem.

On Monday he'll be presenting with his colleague Tom Corn, vice president of security strategy at VMware, the concept of how virtualization and the hypervisor can actually be a security practitioner's best friend, rather than something to be feared. His theories revolve around isolation, context and a thing he likes to call 'The Goldilocks Zone.'

According to Casado, the architectural problem inherent with a lot of security's ills today are due to the fact that the industry lacks an 'ubiquitous horizontal layer ' to implement security. Instead, today's security products end up in places that don't do the full job necessary. In many cases, it's either lumped into the physical infrastructure or into the host layer, he says.

The problem with security built into physical infrastructure is one of context.

"The great thing about putting security in the infrastructure is that you're isolated. So if the end host gets attacked or gets compromised, then that attack cannot turn off the security controls. That's good," he says. "What is bad is you have effectively no context at all. So I had a security policy that was something like, oh, Martin shouldn't be accessing data X at time Y, you can't really do this with firewalls or with ACLs because they have no idea about who Martin is and they have no idea about the data."

On the flip side, host security has got that context available to it but falls short with isolation.

"You've got all of the context you need. You've got agents running in there. You're instrumenting the application. You know everything. You know users. You know the data that they're accessing. You know what files they have. You have the high level semantics," he says. "But the problem is you have absolutely no isolation. Now you're effectively putting your security controls in an untrusted entity. So it's like taking the on/off switch for an alarm system and putting it on the outside of a house."

Meantime, at the same time we fight this problem of a lack of a horizontal layer for security, cloud is creating one of the biggest business tech transformations of a generation, with virtualization as a core component of that. And even as consolidation has scared security practitioners at the risk, technologists have overlooked the potential that virtualization can have in reengineering security

That's because the hypervisor has the potential to be the proverbial Goldilocks Zone for security products. It's got just the right amount of context and isolation to make things work.

"It's a horizontal layer we can use to implement security services. The hypervisor is close enough to the application to get real context. But it's far enough away to get real meaningful isolation," he says, explaining that the hypervisor can be leveraged to look into the guest, the operating system, and the application to pull out meaningful context. "You can look at data, you can look at processes, you can look at threads. You can look at users on a machine and you can extract that information in a secure way. And then that information can be used and enforced within the hypervisor in a way that can't be turned off because it's isolated."

According to Casado, what he's putting forward is not a proprietary development where VMware is looking to compete in the security market. Instead, the idea he promotes is for security vendors to start using the virtualization layer as a platform to enhance their offerings.

"The idea is to provide a secure platform where third parties can pull out context and to have security controls enforced within the infrastructure," he says.

Not only are context and isolation a big factor, but so is the ubiquity of the hypervisor. And, Casado says, this isn't just applicable to the VMware platform, either.

"This is a general statement about the hypervisor. I think this gives us an opportunity as an industry to formalize this concept and say, we already have this horizontal security layer. We have it. Let's use it. Let's take advantage of it and let's actually improve things in a significant way," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
BGREENE292
50%
50%
BGREENE292,
User Rank: Apprentice
2/25/2014 | 7:46:37 AM
re: Is The Hypervisor Security's Goldilocks Zone?
ABORT RETRY FAIL ?
Readers short of time tend to choke on cutsie headline usage like "goldilocks zone".

Although the phrase comes from Cassado, himself, who surely knows more precise terminology, it actually leaves the meaning more obscure. Images of bears and porridge intrude.

This is not to suggest industry speakers and developers always seek clarity, or to reach their audiences with one attempt.
Cloud Security Threats for 2021
Or Azarzar, CTO & Co-Founder of Lightspin,  12/3/2020
Why Vulnerable Code Is Shipped Knowingly
Chris Eng, Chief Research Officer, Veracode,  11/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Assessing Cybersecurity Risk in Todays Enterprises
Assessing Cybersecurity Risk in Todays Enterprises
COVID-19 has created a new IT paradigm in the enterprise and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27772
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in coders/bmp.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned int`. This would most likely lead to an impact to application availability, but could po...
CVE-2020-27773
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/gem-private.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type `unsigned char` or division by zero. This would most likely lead to an impact to appli...
CVE-2020-28950
PUBLISHED: 2020-12-04
The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.
CVE-2020-27774
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/statistic.c. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of a too large shift for 64-bit type `ssize_t`. This would most likely lead to an impact to application availability, but co...
CVE-2020-27775
PUBLISHED: 2020-12-04
A flaw was found in ImageMagick in MagickCore/quantum.h. An attacker who submits a crafted file that is processed by ImageMagick could trigger undefined behavior in the form of values outside the range of type unsigned char. This would most likely lead to an impact to application availability, but c...