By Tom Schmidt
Thanks to virtualization capabilities being built into a new generation of system hardware, IT managers can expect to see robust security solutions that are cost-effective and that give them appropriate levels of control. Read on to see how virtual environments can help enterprises better manage and secure their PCs.
Virtualization basics
So just what is virtualization? While it has been a part of the IT landscape for decades, only recently have the benefits of virtualization appeared on industry-standard x86-based platforms, which now form the majority of desktop, laptop, and server shipments. As defined by virtualization specialist VMware:
"The term virtualization broadly describes the separation of a resource or request for a service from the underlying physical delivery of that service. With virtual memory, for example, computer software gains access to more memory than is physically installed, via the background swapping of data to disk storage. Similarly, virtualization techniques can be applied to other IT infrastructure layers -- including networks, storage, laptop or server hardware, operating systems and applications.
This blend of virtualization technologies -- or virtual infrastructure -- provides a layer of abstraction between computing, storage and networking hardware, and the applications running on it. The deployment of virtual infrastructure is non-disruptive, since the user experiences are largely unchanged. However, virtual infrastructure gives administrators the advantage of managing pooled resources across the enterprise, allowing IT managers to be more responsive to dynamic organizational needs and to better leverage infrastructure investments."
With virtualization, users see resources as if they were dedicated to them. Administrators manage and optimize resources across the data center.
Why is that important? For CIOs and IT managers in particular, virtualization can enable them to effectively address a number of critical business challenges, including cost-effective utilization of IT infrastructure, responsiveness in supporting new business initiatives, and flexibility in adapting to organizational changes. Virtualization is also a welcome technological innovation in today's climate of IT budget constraints and stringent regulatory requirements.
Virtualization in action
With the security threat landscape in a typical enterprise changing on a daily basis, security vendors must develop more innovative ways to protect desktop endpoints. Evolutionary security enhancements have just managed to keep pace with threats, but it is clear that more revolutionary security models will be needed to secure the desktop in the future.
Recently, security solutions for Intel's new vPro virtualization technology became available that will allow IT managers to manage security threats outside the main PC operating system. In this isolated virtual environment, embedded within the vPro technology, security solutions will be more tamper resistant and "always on," monitoring and protecting the desktop.
Isolating the security software is possible through Intel Virtualization Technology, which is new hardware support for virtualization. This allows for the creation of a secure partition on the PC, which can be used to run applications such as a firewall, intrusion prevention, antivirus, and other security software.
By isolating the security technology from the operating system, the security technology has not been compromised, so we can trust the result that it gives. Second, more intelligent scanning is available for threats without interfering with the operating system. Third, the security technology is always on, always protecting the end user. These applications also can protect against a broad range of threats allowing administrators to spend less time worrying about cleaning up the environment. The Intel technology enables virtualization, creating a simplified, self-contained environment that can be dedicated to functions like security.
PCs with the Intel vPro technology built-in are expected to be broadly available in the third quarter.
One of the primary concerns that manufacturers hope to address through this collaboration is the amount of control end users have over their computing environment. Currently, end users have the ability to modify that environment by, for example, disabling security solutions and installing new programs (both authorized and unauthorized). All this creates additional security threats for security administrators to worry about. Isolating the computer's protection in a virtual environment outside the main operating system would limit the amount of control the end user has and increase the amount of control the security administrator has.
Deploying security in a separate virtual partition also acknowledges the realities of the emerging threat landscape. Increasingly, this landscape contains threats aimed at disabling security technology, and such threats are becoming stealthier and more difficult to detect all the time. By having endpoint security in a separate partition, the security functionality is isolated from the operating system and any possible conflicts within the OS environment. In the event that malware is successful in infecting a desktop environment, the virtual security solution would contain the threat on that particular desktop, isolating it from other network resources.
Virtualization can also improve IT's management capabilities, especially in the areas of remote management, provisioning, problem resolution, asset management, and off-hours maintenance. Because a virtualization solution works even if the user OS is compromised or down, IT can now receive more accurate information for compliance and day-to-day IT management reporting.
Conclusion
The use of virtualization technology will offer a major step forward in enterprise security. This innovative approach creates a new layer of security that will be more effective in protecting critical information and applications. Virtualization will also help enterprises to lower IT costs through increased flexibility and responsiveness. Managing a virtual infrastructure enables IT to connect resources to business needs quickly and consistently. As VMware puts it:
"With a virtual infrastructure, IT organizations can provision new services and change the amount of resources dedicated to a software service. A data center can be treated as a single pool of processing, storage and networking power. Virtual infrastructure lets organizations optimize their data center and move towards utility computing."
Tom Schmidt writes frequently about information security topics. He has more than 15 years' experience as a writer and editor in high-tech publishing.