• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
Virtualization.com

Virtualization.com

News and insights from the vibrant world of virtualization and cloud computing

  • News
  • Featured
  • Partnerships
  • People
  • Acquisitions
  • Guest Posts
  • Interviews
  • Videos
  • Funding

StackSafe

StackSafe Test Center Gets Another Upgrade, Enhances Support for Virtualized Environments

August 5, 2008 by Robin Wauters Leave a Comment

StackSafe, a provider of pre-production staging and testing solutions for IT operations teams, announced today that StackSafe Test Center, which was launched in the beginning of this year and significantly upgraded 2 months ago, now includes automated import of virtual infrastructure components.

Users can easily import virtualized production environments into Test Center, enabling them to stage both virtualized and physical production environments for testing activities. With this upgrade, Test Center provides testing that covers the gamut of potential scenarios, from physical infrastructure stacks to virtual infrastructure stacks to “hybrid” environments that include both physical and virtual components.

With the uses of virtualization becoming more widespread, the IT Operations industry is beginning to see an increasing use of virtual infrastructure stacks in production. Enhanced support for virtualized infrastructure enables users to more easily import virtual workloads into Test Center, making it possible to test against virtual and physical environments for complete end-to-end infrastructure stack testing. This inclusion, along with the product’s existing support for external infrastructure connectivity, gives Test Center a broad view of the entire IT Operations infrastructure, enabling testing across:

  • Physical machines – Production machines equipped with Windows, Red Hat Linux and CentOS Linux
  • Virtual machines – Test Center currently supports virtual machines on VMware ESX 3.x
  • External infrastructure components – Including large databases, mainframes and other network components that cannot be virtualized into Test Center

Organizations choosing to employ StackSafe Test Center can now ensure that their entire software stack is represented in the testing process, enabling for faster change impact analyses and fewer rolled-back changes.

As part of StackSafe Test Center’s subscription licensing model, the updated release of Test Center is generally available to current Test Center users at no charge.

Filed Under: News Tagged With: import, StackSafe, StackSafe Test Center, staging and testing, Test Center, upgrade, virtual infrastructure, virtual infrastructure components, virtualisation, virtualization

A Round Table on Virtualization Security with Industry Experts

July 30, 2008 by Kris Buytaert 3 Comments

Virtualization security or ‘virtsec’ is one of the hottest topics in virtualization town. But do we need another abbreviation on our streets? Does virtualization require its own security approach and how would it be different from the physical world?

Different opinions fly around in the blogosphere and among vendors. Some security experts claim there is nothing new under the sun and the VirtSec people are just trying to sell products based on the Virtualization Hype. Some see a genuine need to secure new elements in the infrastructure, others claim that Virtualization allows new capabilities to raise security from the ground up and cynics claim it is just a way for the Virtualization industry to get a larger piece from the security budget.

So our editors Tarry and Kris set out to clarify the different opinions, together with the support of StackSafe, they organized a conference call with some of the most prominent bloggers, industry analyst and vendors in this emerging field.

On the call were Joe Pendry (Director of Marketing at StackSafe), Kris Buytaert (Principle at Consultant Inuits), Tarry Singh (Industry/Market Analyst Founder & CEO of Avastu), Andreas Antonopoulos (SVP & Founding Partner at Nemertes Research),Allwyn Sequeira (SVP & CTO at Blue Lane), Michael Berman (CTO at Catbird), Chris Hoff (Chief Security Architect – Systems & Technology Division and Blogger at Unisys) and Hezi Moore (President, Founder & CTO at Reflex Security)

During our initial chats with different security experts their question was simple: “what does virtsec mean?”. Depending on our proposed definition, opinions varied.

So obviously the first topic for discussion was the definition of VirtSec:

Allwyn Sequeira from Blue Lane kicked off the discussion by telling us that he defined Virt Sec as “Anything that is not host security or that’s not network-based security. If there’s a gap there, I believe that gap – in the context of virtualization – would fall under the realm of virtualization security. ” He continued to question who is in charge of Inter-VM communication security, or how features such as Virtual Machine Migration and Snapshottiting add a different complexity to todays infrastructure.

Andreas Antonopoulos of Nemertes Research takes a different approach and has two ways of looking at VirtSec “How do you secure a virtualized environment” and in his opinion a more interesting question is “How do you virtualize all of the security infrastructure in an organization” Andreas also wonders how to call the new evolutions “What do you call something that inspects memory inside of VM and inspects traffic and correlates the results? We don’t really have a definition for that today, because it was impossible, so we never considered it.” He expects virtualization to change the security landscape “Just like virtualization has blurred the line between physical server, virtual server, network and various other aspects of IT, I see blurring the lines within security very much and transforming the entire industry.”

Hezi Moore from Reflex Security wants to search for actual problems. He wants to know what changed since we started virtualizing our infrastructures. “A lot of the challenges that we faced before we virtualized; are still being faced after we virtualized. But a lot of them got really intensified, got much more in higher rate and much more serious.”

Michael Berman from Catbird thinks the biggest role of VirtSec still is Education, “..and the interesting thing I find is the one thing we all know that never changes is human nature.” He is afraid of virtualization changing the way systems are being deployed with no eye on security. Virtualization made it a lot easier to bypass the security officers and the auditors. The speed at which one can deploy a virtual instance and a bigger number of them has changed drastically regarding to a physical only environment, and security policies and procedures have still to catch up. “We can have an argument whether the vendors are responsible for security, whether the hypervisors about who attack servers. The big deal here is the human factor. “

Chris Hoff summarizes the different interpretations of VirtSec in three bullets:

  • One, there is security in virtualization, which is really talking about the underlying platforms, the hypervisors. The answer there is a basic level of trust in your vendors. The same we do with operating systems, and we all know how well that works out.
  • Number two is virtualized security, which is really ‘operationalization’, which is really how we actually go ahead and take policies and deploy them.
  • The third one is really gaining security through virtualization, which is another point.

Over the past decade different Virtualization threats have surfaced, some with more truth than others. About a decade ago when Sun introduced their E10K system, they were boasting they really had 100% isolation between guest and host OS. But malicious minds figured out how to abuse the management framework to go from one partition to another. Joana Rutkowska’s “Blue Pill” Vulnerability Theory turned out to more of a myth than actual danger. But what is the VirtSec industry really worried about?

It seems the market is not worried about these kind of exploits yet. They are more worried about the total lack of security awareness. Andreas Antonopoulos summarizes this quite well “I don’t see much point in really thinking too much about five steps ahead, worrying about VM Escape, worrying about hypervisor security, etc. when we’re running Windows on top of these systems and they’re sitting there naked”.

Allwyn from Blue Lane however thinks this is an issue…certainly with Cloud Computing becoming more popular, we suggest to seriously think about how to tackle deployment of Virtual Machines in environments we don’t fully control. The Virtual Service Providers will have to provide us with a secure way to manage our platforms, and enough guarantee that upon deployment of multiple services these can communicate in a secured and isolated fashion.

Other people think we first have to focus on the Human Factor, we still aren’t paying enough attention to security in the physical infrastructure, so we better focus on the easy to implement solutions that are available today, rather than to worry about, exploits that might or might not occur one day.

Michael Berman from Catbird thinks that Virtualization vendors are responsible to protect the security of their guest. A memory Breakout seems inevitable, but we need to focus on the basic problems before tackling the more esoteric issues…He is worried about scenarios where old NT setups, or other insecure platforms are being migrated from one part of the network to another, and what damages can occur from such events.

Part of the discussion was about standardization, and if standardization could help in the security arena. Chris Hoff reasons that today we see mostly server virtualization, but there is much more to come, client virtualization, network virtualization, etc. As he says: “I don’t think there will be one one ring zero to rule them all.”. There are more and more vendors joining the market, VMWare, Oracle, Citrix, Cisco, Qumranet and different others have different Virtualization platforms and some vendors have based their products on top of them.

In the security industry standardization has typically been looked at as a bad thing, the more identical platforms you have the easier it will be for an attacker, if he breaks one, he has similar access to the others. Building a multi-vendor or multi-technology security infrastructure is common practice.

Another important change is the shift of responsibilities, traditionally you had the Systems people and the network people, and with some luck an isolated security role. Today the Systems people are deploying virtual machines at a much higher rate , and because of Virtualization they take charge of part of the network, hence giving the Network people less control. And the security folks less visibility

Allwyn Sequeira from Blue Lane thinks the future will bring us streams of Virtualization Security, the organizations with legacy will go for good VLAN segmentation and some tricks left and right because the way they use Virtualization blocks them for doing otherwise. He thinks the real innovation will come from people who can start with an empty drawing board.

Andreas Antonopoulos from Nemertes Research summarized that we all agree that the Virtualization companies have a responsibility to secure their hypervisor. There is a lot of work to be done in taking responsibility so that we can implement at least basic security. The next step is to get security on to the management dashboard , because if the platform is secure, but the management layer is a wide open goal, we haven’t gained anything.

Most security experts we talked to still prefer to virtualize their current security infrastructure vover the products that focus on securing virtualization. There is a thin line between needing a product that secures a virtual platform and changing your architecture and best practices to a regular security product fits in a Virtualized environment.

But all parties seem to agree that lots of the need for VirtSec comes from changing scale, and no matter what tools you throw at it, it’s still a people problem

The whole VirtSec discussion has just started, it’s obvious that there will be a lot of work to be done and new evolutions will pop up left and right. I`m looking forward to that future So as Chriss Hoff said “Security is like bell bottoms, every 10-15 years or so it comes back in style”, this time with a Virtualization sauce.

Listen to the full audio of the conference call!

Filed Under: Featured, Guest Posts, Interviews, People Tagged With: Allwyn Sequeira, Andreas Antonopoulos, Avastu, Blue Lane, Catbird, Chris Hoff, conference call, Hezi Moore, interview, Inuits, Joe Pendry, Kris Buytaert, Michael Berman, Nemertes Research, Reflex Security, round table, StackSafe, Tarry Singh, Unisys, virtsec, virtualisation, virtualization, virtualization security

A Conversation About Virtualization Security, The Quotes

June 11, 2008 by Kris Buytaert 2 Comments

Last week, an interesting conference call took place with several industry leaders in the virtualization security (virtsec) area, initiated by Virtualization.com. The panel included:

  • Joe Pendry, Director of Marketing – StackSafe,
  • Kris Buytaert – Infrastructure Architect; Open Source Expert; Principle Consultant Inuits; Blogger & editor at Virtualization.xom,
  • Tarry Singh – Sr. Consultant, Blogger, Industry/Market Analyst; Founder & CEO of Avastu & editor at Virtualization.xom
  • Andreas Antonopoulos, SVP & Founding Partner – Nemertes Research
  • Allwyn Sequeira ,SVP & CTO – Blue Lane, Michael Berman, CTO – Catbird
  • Chris Hoff, Chief Security Architect – Systems & Technology Division and Blogger – Unisys
  • Hezi Moore, President, Founder & CTO – Reflex Security

We’ll publish the highlights from our conversations shortly, but as a teaser, here are some of the most interesting quotes:

“I don’t see much point in really thinking too much about five steps ahead, worrying about VM Escape, worrying about hypervisor security, etc. when we’re running Windows on top of these systems and they’re sitting there naked.”

“We’re dealing with virtualized storage, while nobody will ever raise their hand saying they’re a security expert when it comes to that.”

“More than 75 percent of the people we asked, how are you securing virtualized environments? Their answer was VLANs. That’s where we stand today.”

“This was a network guy and his email went: WTF, you need 30 VLANS on one server? That’s the first time he became aware of virtualization. That team wasn’t even working with him. And the first inkling he had when he got a request that was just so out of the norm he just didn’t know what was going on.”

“To me, security is like bell bottoms, every 10-15 years or so, it comes back into style.”

Watch Virtualization.com for more!

Filed Under: Featured, Interviews, People Tagged With: Allwyn Sequeira, Andreas Antonopoulos, Avastu, Blue Lane, Catbird, conference call, interview, Inuits, Joe Pendry, Kris Buytaert, Michael Berman, Nemertes Research, quotes, StackSafe, Tarry Singh, virtsec, virtualisation, virtualization, virtualization security

StackSafe Upgrades Test Center

June 3, 2008 by Robin Wauters Leave a Comment

StackSafe, a provider of pre-production staging and testing solutions for IT Operations teams, announced today the external infrastructure connectivity upgrade to its staging and testing solution, StackSafe Test Center, which it recently unveiled at the DEMO 2008 Conference.

StackSafe

The solution creates a virtual copy of the software infrastructure, and thanks to this upgrade, the virtualized Test Center environment can now be extended to interact with non-virtualized system components that reside outside of the Test Center environment.

“Virtualization technology offers the potential to deliver time-stressed, resource-thin IT operations staff a low risk way to test and assess the impact of making changes to the IT production environment,” commented Richard Ptak, Founder and Analyst, Ptak Noel & Associates. “StackSafe’s Test Center provides a validation environment that resolves a number of existing application deployment issues.”

According to the company, complex software infrastructure environments may include components that cannot be virtualized into StackSafe Test Center. These include physical storage tiers, large databases, hardware-based network topologies, or distributed components not owned by the IT Operations team. By enabling the inclusion of these components in the test scenarios, users can now have a more complete view of the impact of changes across the entire end-to end IT service.

The addition of external infrastructure connectivity adds the following features:

  • Enabling inbound connectivity from external infrastructure components and services into Test Center
  • Enabling outbound connectivity from Test Center to external infrastructure components and services
  • Customized control of connectivity options

As part of StackSafe Test Center’s subscription licensing model, the updated release of Test Center is generally available to current Test Center users at no charge.

Filed Under: News Tagged With: StackSafe, StackSafe Test Center, staging and testing, Test Center, virtualisation, virtualization

StackSafe Unveils Test Center at DEMO 08

January 30, 2008 by Robin Wauters 2 Comments

I’m currently watching the live stream from DEMO 08 , listening to a pitch from StackSafe which is really compelling. The company was foreseeing enough to publish a press release in conjunction with the product launch.

“StackSafe, Inc., a provider of pre-production staging and testing solutions for IT operations teams, announced today the immediate availability of StackSafe™ Test Center . Test Center is the first virtualized staging and testing solution for IT Operations teams that improves availability and resiliency through enhanced software infrastructure testing. StackSafe’s solution directly addresses incomplete and ineffective IT Operations testing and analysis of changes to multi-tiered software infrastructure stacks.

“If IT Operations teams can test and certify changes to software infrastructures before they go live, then IT services become more available and resilient as well as more repeatable and better documented,” said Donna Scott, vice president and distinguished analyst at Gartner. “Comprehensive and efficient staging, testing and analysis are essential to achieving optimum levels of availability.””

Watch the Flash demo here .

These are the key benefits according to StackSafe:

* Reduces the uncertainty and downtime associated with IT changes, thus avoiding costly application and system failure
* Enables pre-production changes to be made safely before they are implemented into the live environment
* Helps IT Operations teams to understand the potential impacts that changes could have on their environment-before they impact production systems
* Enables IT Operations to be more responsive to dynamic and changing business process requirements
* Improves confidence in IT changes, while reducing the percentage of time spent on testing and staging-which can significantly lower IT operating costs

Filed Under: News, Videos Tagged With: DEMO, DEMO 08, StackSafe, StackSafe Test Center, Test Center, virtualisation, virtualization

Primary Sidebar

Tags

acquisition application virtualization Cisco citrix Citrix Systems citrix xenserver cloud computing Dell desktop virtualization EMC financing Funding Hewlett Packard HP Hyper-V IBM industry moves intel interview kvm linux microsoft Microsoft Hyper-V Novell oracle Parallels red hat research server virtualization sun sun microsystems VDI video virtual desktop Virtual Iron virtualisation virtualization vmware VMware ESX VMWorld VMWorld 2008 VMWorld Europe 2008 Xen xenserver xensource

Recent Comments

  • C program on Red Hat Launches Virtual Storage Appliance For Amazon Web Services
  • Hamzaoui on $500 Million For XenSource, Where Did All The Money Go?
  • vijay kumar on NComputing Debuts X350
  • Samar on VMware / SpringSource Acquires GemStone Systems
  • Meo on Cisco, Citrix Join Forces To Deliver Rich Media-Enabled Virtual Desktops

Copyright © 2025 · Genesis Sample on Genesis Framework · WordPress · Log in

  • Newsletter
  • Advertise
  • Contact
  • About