For more information, contact:

Karen Wucher
Nemertes Research
Phone: 972.335.7028
Cell: 972.872.0828
Karen.Wucher@nemertes.com

Server Virtualization Requires Shift in Security
Thinking

Analysis of risk factors sharpens
security focus

New York, NY – Feb. 12, 2008 – Rapid adoption of server virtualization is forcing companies to think about the security implications of virtualization.

Most IT departments currently secure physical and virtual servers the same way. Unfortunately, consolidating servers into a pool of virtual machines interconnected by virtual networks invalidates many of the assumptions that underlie current data center security techniques. While the focus has been on the security of the hypervisor, the real risks may lie elsewhere.

“As server virtualization has gained acceptance in corporate data centers, security has gone from an afterthought to a serious concern,” says Andreas M. Antonopoulos, senior vice president of Nemertes Research. Much of the focus has been on the technologies of virtualization rather than the operational, organization and economic benefits the technologies offer companies. For server virtualization to deliver its benefits as securely as possible, companies need to conduct a more rigorous analysis of the risks associated with it. “Part of the uncertainly arises because most companies do not have a good understanding of the real risks surrounding virtualization, “says Antonopoulos.

Companies need to understand that their risk profile changes as their use of virtualization changes. There are risks inherent in each stage of deployment and its corresponding architectures and operational processes. In fact, as companies continue their rapid adoption of virtualization, it is the new operational models that introduce unique challenges and risks. “This is important, said Antonopoulos, because it’s how you direct your time, money and attention to the places where it will reduce the risk more successfully.” One key fact is that excessive focus on the basic mechanism of virtualization – the hypervisor – distracts from the more important sources of enterprise risk: the flattening of data center network topologies and the creation of server pool monocultures.

Further detail and analysis on this topic is available in Nemertes’ latest issue paper, “Virtualization Risk Analysis.”

About Nemertes Research

Nemertes Research is a research-advisory firm that specializes in assessing the business value of emerging technologies. You can learn more about Nemertes Research at our website www.nemertes.com.

###