Security issues often seem to smolder more than burn, but these six are certainly capable of lighting a fire under IT professionals at a moment's notice. Handle with care.
Is server virtualization worth the risk?
The benefits of moving away from traditional servers to virtual-machine (VM) arrangements are the cost savings in hardware consolidation and remarkable flexibility. But less-welcome consequences can be security gaps and virtual-server sprawl, risks that draw fire from auditors.
VM security too often is being addressed after the fact, says Douglas Drew, senior consultant with BT's emerging technologies office and an auditor for the Payment Card Industry (PCI) standard. "How do you handle access control or auditing? Suppose I migrate an instance of a virtual machine from rack A to rack B: Is one a locking rack that needs a physical badge to get to the console and the other not? Does the VM hypervisor allow for separation of administrators A and B so A can only logically touch systems A and administrator B only touches B? How are you re-upping the risk assessment based on the architecture change?"
Like more traditional networks, the VM environment, whether based on VMware, XenSource or Microsoft, calls for applying best practices defined under the ISO 27002 standard for secure systems, Drew says. "We've seen some cases where people are slow to adopt VM because they haven't gotten their arms around this."
And many say VM software out of the box won't suffice for security.
"The virtual machines are mobile, they're designed to be mobile," says David Lynch, vice president of marketing at Embotics, a start-up that makes VM life-cycle management software. "You take a physical server and make a clone of it. You lose the identity of the physical server, but your existing management tools are based on the idea you have a physical server."
As designed today, VMware's VirtualCenter management won't prevent VM sprawl because VM ID numbers can be changed and re-set, Lynch contends. He adds it's not possible to ensure a unique VM ID system for an enterprise using more than one VirtualCenter.
The Embotics software, which works with VirtualCenter, tries to compensate by using a cryptographic hash, combined with VM meta-data, to brand a VM ID as legitimate and authentic. Other start-ups, including Fortisphere and ManageIQ, also are tackling the VM sprawl issue.
Some security vendors are convinced that the main VM software developers are in such a rush to get their products out to grab market share that as Andrew Hay, product program manager at Q1 Labs, puts it, "security is an afterthought."
Hay notes there's no Netflow-enabled virtual switch to help with activity monitoring. "You're creating a separate network that happens to reside on a box," Hay says. "But no one pushes for flow analysis in the virtualized world."
Should all this stop IT managers from going virtual? The bottom line, according to Hay: "It would be best to research your options before going full tilt."
Does stopping data leaks lure lawyers?
Data-loss prevention (DLP) — or call it data-leak protection — lets you monitor content for unauthorized transmission. (Compare Data Leak Protection products). But organizations gaining experience with it are finding DLP sheds so much light into the darker corners of the corporate network that IT and business managers may find themselves in regulatory and legal peril.
"You move from ignorance to compliance jeopardy," says Tony Spinelli, senior vice president of information security at credit information services firm Equifax, describing the early days of deploying the Symantec DLP in his organization. DLP became a spotlight in the dark, exposing data-storage practices that needed to be improved.
That puts both business and IT management on the spot to make changes. And more security managers are finding that picky auditors — once they know the DLP tools are in place — are demanding security changes that corporations would be at their legal peril to ignore.
So is this "see all, know all" aspect — in addition to the fact that DLP can still be expensive — enough of a downside to turn off potential buyers? Maybe, but it would mean turning away from the most promising content-monitoring approach, one that might be sorely needed to help keep your firm out of regulatory and legal trouble.
Knowing in advance that DLP may be a disruptive technology, security managers can make plans to prepare business managers — the rightful data owners in the eyes of most corporations — as well as auditors and legal staff.
One security professional with DLP experience, Ron Baklarz, who recently left MedStar Health to join Amtrak as chief information systems officer, said the approach he took with the Reconnex DLP used at MedStar was to bring business people into the data-oversight process.
"You need to partner with them on compliance," Baklarz advises. Giving authorized business staff a log-in to technical DLP systems makes them active participants in the data-loss prevention effort.
In-the-cloud security: Dreamy or dangerous?
According to John Pescatore, a Gartner security expert who keeps tabs on in-the-cloud security services, the basic thing about them — be they for e-mail, denial-of-service (DoS) protection, vulnerability scanning or Web filtering — is that they're an alternative to the do-it-yourself approach in buying software or equipment.
There are strong reasons to ascend into the cloud by buying a service — but also times to stay in the more earthly domain with your own stuff.
To start, it's worth thinking about enterprise in-the-cloud security services as two basic types, Pescatore suggests. The first is bandwidth-based, such as carrier- or ISP-based DoS protection and response.
"AT&T, for example, can do this better and more cheaply than you can, plus they're filtering out attacks further upstream than you can using their bandwidth," Pescatore says. The alternative would be buying anti-DoS equipment from a firm such as Arbor Networks and setting up protection on your own.
The second in-the-cloud type is what Gartner prefers to call"security as a service," which is "totally divorced from a bandwidth service," Pescatore says. Using an antispam service, for example, involves redirecting the MX record to the service provider but doesn't entail specific bandwidth services tied to one single carrier.
This genre includes e-mail spam and antivirus filtering; vulnerability scanning; and Web filtering. What it doesn't include, by and large, is either DLP content monitoring and filtering or identity access and management, which are tightly coupled to internal business changes.
Using security-as-a service in the cloud makes a lot of sense to protect mobile laptops or provide protection for widely distributed branch offices, Pescatore says."For the very large global corporations, this is attractive," he says.
However, most companies will probably find it as easy and cost-effective to continue to guard internal operations by deploying their own security gear to filter spam, viruses and restrict Web access.
There are potential risks to filtering services. You might not want to transmit sensitive business transactions through this kind of third-party service. And, there's always a chance the service might go out of business.
All of these in-the-cloud services are still fairly new, seeing a growth spurt only in the past three years, Pescatore says, with MessageLabs, Microsoft, Google's Postini and Websense to be counted among the vendors. Gartner estimates that in-the-cloud e-mail security services don't account for more than 20 percent of the total e-mail security market but will jump to 35 percent by year-end and 70 percent by 2013.
According to research firm IDC, last year the market for e-mail security software was $1.38 billion, and appliances another $692.2 million. In-the-cloud services, which IDC calls hosted services, were $454 million. Software and appliances are expected to continue steady growth (see chart), and hosted services will jump to $638 million this year and $1.39 billion by 2011.
This kind of expansion of in-the-cloud services encourages the Jericho Forum, an organization of about 60 corporations which has been actively pushing for innovative e-commerce security that reaches outside the traditional corporate boundary of the perimeter.
"Web filtering in the cloud has only taken off in the last 16 months," says Paul Simmonds, a member of the Jericho Forum board."There are many more in-the-cloud services today than there were a few years ago." Simmonds said the"disappearing perimeter" in corporate networks is making in-the-cloud security services an appealing option that many businesses are exploring today.
Will Microsoft ever get security right?
When it comes to security, can Microsoft get any respect?
Even Bill Gates has humbled himself at times to explain why Microsoft has fumbled the ball so often on security. In his last public appearance at the RSA 2007 Conference, on stage with Craig Mundie, to whom he handed the baton to direct product security going forward, the two offered a mea culpa explanation on why Microsoft's software has fallen short.
"Humans are humans and they make mistakes," said Mundie, with the duo later indicating that the inadequate security plaguing Microsoft software in the past can be traced to a naïveté in the early years based on the perception few controls were needed because"everybody was really good" and the data center seemed carefully tucked away.
This decades-old baggage remains a burden for Microsoft, says Andreas Antonopoulos, senior vice president and founding partner at Nemertes Research.
"Even today, the fundamental design decisions made 25 years ago still haunt Microsoft," Antonopoulos says."Windows Vista is not a new operating system; there are a lot of the older operating systems under the cover, which carries with it the baggage of the last 20 years to ensure backward compatibility of applications."
Microsoft is caught in a conundrum, Antonopoulos asserts. If the company really decides to make a fresh start on software, it would likely have to sacrifice financial advantages."That's not likely to happen," he says.
Burton Group analyst Dan Blum expresses a similar opinion, saying,"They are compromised in that sense. They have the constraints of backward compatibility in mind."
A few years ago, Microsoft sought to make a break with the past in what was called the Next-Generation Secure Computing Base (NGSCB) project, but"they killed it," Blum says.
According to Blum, Microsoft remains driven along a path of"convenience and flexibility and backwards compatibility," which gives them the best advantage in the marketplace. Blum muses if he were Bill Gates, he would have tried a"parallel approach" to develop a next-generation trusted operating system, even if it broke with existing applications.
In other respects, Microsoft has produced a viable identity strategy overall, Blum says, but it's been hobbled by its Windows-centric approach."They never put a stamp on any platform that's different," he says. Microsoft's lack of support for the SAML standard, for instance,"is a big mistake and not in the best interests of the industry."
Linux, Unix and Macintosh operating systems ship with better"secure by design postures" than those from Microsoft, Antonopoulos contends.
But Antonopoulos and Blum both say Microsoft has improved with Vista and XP2.
"The problem is Microsoft has developed a bad reputation and it's hard to outlive that," Antonopoulos says. Microsoft has plenty of talented engineers with identity and trust expertise, but their ideas expressed during engineering conferences seldom seem to get adopted in Microsoft software."I think they must get overruled."
For some third-party security software providers that work closely with Microsoft, it's also been trying at times.
"It's been a roller coaster," says Phil Lieberman, president of Lieberman Software, which makes password and administrative management tools that work with Microsoft desktop and server products."The problem with Microsoft is it's not just one company; it's divergent ones on different paths fighting each other."
In some Microsoft units, such as those managing CRM or Office products, there's no effort to work with third-party applications for security while"the core operating system group is more open," Lieberman says.
But the most aggravating part of working with Microsoft — which may be necessary to gain official Microsoft certification — is that the company isn't keeping up on the technical documentation.
"A tremendous amount of the operating system is undocumented," Lieberman says."They're moving so fast and doing so many releases and updates, no one is keeping track of what they're doing. For instance, if Microsoft goes and changes something for Patch Tuesday, and a [Data Link Library] is changed, they don't bother to change the documentation, and your application stops working. We have to go research this and we find they've changed it."