With the exponential growth of virtualization and its leverage at the enterprise, it is getting more and easier to create a replica of a solution set at any virtualization ready host farm.
Until recently, when talking about a solution that involves large data sets, sophisticated servers, and infrastructure, usually the destination for an “unapproved” copy of a solution set was restricted with enterprise networks vicinity.
Not anymore: Now that we have the full automation from cloud service providers and sophisticated cloud orchestration software/service providers – it is not very difficult to replicate and enterprise environment at the service provider side.. And let’s go with the jargon and call this private cloud. And maybe today your enterprise networks vicinity extends into some sort of private cloud hosted at an undisclosed location.
So who will be monitoring the “Rogue” copies of the private clouds?
How will you ensure that your private cloud has not been exported/imported into an undisclosed location for some further development tests?
If you believe that this is a low probability risk, the you should try to export a system to one of the cloud infrastructure service providers, you will see that the process is quite straight forward.
As a security practitioner, you all know that there are some controls to monitor the rogues. The easy ones are:
1- Establish strong administrative control and change management monitoring on all virtualized systems,
2- Make sure that all snapshots, backups, copies are encrypted and the keys are not portable (use DRM solutions or encrypt with key managers like RSA RKM and maybe some DLP),
3- Monitor network anomalies for large dataset movements, and control I/O to tapes/DVD drives and all attached storage types.
And then the new technology will soon allow us to:
1- Utilize Intel TXT type of hardware checks to marry VMs with your platforms .Since hardware and the OS are decoupled with today’s virtualization (which is an advantage) maybe it is time to go back and revisit the hardware authentication options like Intel/McAfee’s deepsafe,
2- Ask developers to write location aware applications,
3- Embed LoJack/Anti-theft into virtualized machines.
Proactive vigilance will help prior to having the actual problem and it is also reasonable to modify the security policies with the statements like:
“Thou shalt not run corporate applications on unapproved platforms”
Cheers,
- yinal ozkan
p.s. This platform does not allow "easy" comments, you may reach me at mail@yinal.net