More virtualization fun..

Jul 1st, 2008

Comments: 0
Category: Uncategorized

More virtualization fun..

There’s an interesting post at Hoffs blog around virtualization and DMZs and to what level it’s “ok” to virtualize a given DMZ environment, following on from a white paper by VMware on the subject
As Hoff mentions you need to understand the wider context in any risk assessment, but I actually think that in the scenarios that VMware have painted out, I’d agree with Alessandro, that the fully collapsed DMZs talked about in the paper are a no-no.
And there’s a nice risk assessment reasoning here, it’s not just a “ooh hypervisors scary” kind of reaction, honest 🙂 ..
So here’s how it works. In the diagrams they’ve used they’ve laid out a picture of a number of security controls. The main one being separate firewalls segregating the Internet from each of the DMZs in turn. This would indicate to me that the risk assessment dictated that no one device should be a point of failure for the security being provided by the environment (a more cost effective, but traditionally seen as more risky design would be a single firewall with multiple interfaces, one for each network.)
So if we then introduce virtualization to this scenario then it seems that the option of a “partially collapsed” DMZ meets the security requirements as each DMZ has it’s own VMware ESX instance and a compromise of the hypervisor won’t result in a breach of DMZ segregation.
I think that in a lot of cases it’s easy to look at virtualization as something new but it should be possible to look at the current risk appetite in an environment (are you using separate devices to segregate things, are you relying on VLAN tagging for separation) and then apply that to come up with the appropriate virtualization design.

Add a comment

Your email address will not be shared or published. Required fields are marked *