Facebook Plunges Again
Tumblr 101: Tips And Tricks To Get Started
60% of virtual servers are less secure than their physical counterparts
It's all the rage at the moment: drop your cumbersome, expensive and high-maintenance physical servers and get some virtual servers! Basically, instead of managing an entire physical server -- hard disk, processors, power, etc. -- you can now buy a share of a large server. They're called VPS or VDS -- virtual private/dedicated servers -- and it turns out the majority of these new servers are not very secure.The report by Gartner (which costs $95) highlights the usual, inherent risks of moving to a new platform. VPSes, due to the new and immature software used to split a server's resources, can be insecure. It's not such a huge problem now, with only 18% of enterprise processing occurring on virtual servers, but by 2012 that will climb to over 50%. Right now, with the sheer number of unsecured physical dedicated servers, hackers are unlikely to target VPSes... but that will change!
Gartner suggests that organizations do their homework before switching to virtualized server resources -- and specifically they need to know the 'hypervisor' backwards and forwards. The hypervisor's job is to effectively split the physical server into discrete portions -- but as you can imagine, if the hypervisor is compromised, every user's data then becomes available. Such security concerns also pertain to cloud computing, though you have to assume that providers like Amazon know what they are doing.
This is just a teething issue, and I'm sure network and system administrators will get on top of things sooner rather than later.
[via Network World]
Comments
7
Subscribe to commentsZeRoMar 16th 2010 10:30AM
:) Finally something refreshing
RichMar 16th 2010 11:42AM
My company has been pushing to get everything into the cloud to save some costs. I've been fighting it tooth and nail. The concept hasn't had enough time on it to warrant jumping on the bandwagon. With a small company like mine, any type of breach would pretty close us down whether they got the financials or our drawings/schematics/firmware.
I'll have to get the report and use it in the next meeting where it comes up.
Sebastian AnthonyMar 16th 2010 1:22PM
I think you're probably OK in the cloud (though not as secure as standard well-secured dedicated servers)... it's the poorly-maintained VPSes I'd worry about.
VPSes rely on both your network admin AND your ISP/data centre knowing what they're doing... bit risky.
JadedMar 21st 2010 8:21PM
@Sebastian Anthony: Are you kidding? "You're probably OK in the cloud?" What is the cloud other than a bunch of virtualized servers own and managed by someone else...you're putting all of your trust in them...
I'm not against the "cloud" but you'd better know exactly what you're getting into before storing your lifeblood there. You'd better know how they are building out your servers, who is sharing them, how they are secured, and what their data recovery/migration plans are...
JesseMar 16th 2010 11:56AM
It's called IPSec, learn it, use it, love it!
Sebastian AnthonyMar 16th 2010 1:18PM
With a mind like that, I hope you are an employed network admin...!
NeilMar 21st 2010 8:16PM
You can secure the data path all you want with IPSec but if I own your server - be it virtualized or physical, I own your data...