IT ops, security pros at odds over virtualization risks

Does transitioning to virtualization increase security risks within a company? IT managers appear to be at loggerheads with IT security professionals over that question, even while sharing similar opinions on where risks might lie, according to a new survey.

The 2009 Security Mega Trends Survey from research firm Ponemon Institute -- which also looked at attitudes on other topics, such as outsourcing and Web 2.0 technologies -- shows roughly two-thirds of IT operations staff who responded said they felt virtualization of computer resources did not increase information-security risks. But about two-thirds of information security professionals surveyed felt the opposite way.

[ Find out more about virtualization's secret security threats. And learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

A full three-quarters of the survey's 1,402 respondents, all active in U.S.-based private sector firms or government agencies, said their organizations had already implemented virtualization of their computer resources, with about 90 percent in both the IT and security camps saying they were "familiar" or "very familiar" with virtualization.

The survey reflects the often upbeat attitudes about virtualization expressed by experienced IT pros about how the technology, most commonly that of VMware, Microsoft, and Citrix Xen, is bringing them the benefit of server consolidation.

But, there's a far more skeptical view of virtualization security often expressed by seasoned IT security pros, who harbor doubts that vendors on the virtualization front have really sorted out or addressed the risks associated with the underlying hypervisor transformation.

"The security for the virtualization itself is way, way behind," says Nelson Martinez, systems support manager for the City of Miami Beach, who is responsible for IT security in systems used by the city's 2,000 employees. Martinez says the city does make use of VMware for some Web servers, but "I would never host any kind of database or my e-mail server in that environment." There are performance and maintenance issues in running traditional security applications for each VM host application on each physical machine, while the industry still seems to be sorting out the security role the hypervisor can play, Martinez notes.

Jim Waggoner, director of product management at Symantec, says the three primary virtual-machine software providers, VMware, Citrix Xen, and Microsoft, are each still working on new approaches to security in a VM environment that aren't yet out and available.