Thoughts on enterprise IT

Dustin Amrhein

Subscribe to Dustin Amrhein: eMailAlertsEmail Alerts
Get Dustin Amrhein: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn


Related Topics: Cloud Computing, Virtualization Magazine, Security Journal, Secure Cloud Computing, Private Cloud

Private Cloud: Article

Security Needs Revamping on Delivery Front to Evolve with Private Cloud

New Gartner study draws focus on virtualization of security control

According to a recent report by Gartner, the shift to cloud environments must be accompanied by a parallel evolution in security procedures. Virtualization technology is generally the primary gateway for most businesses to step into private cloud. Security programs must become more "adaptive" to the cloud model where processes become disjointed from hardware equipment and provision dynamically. Gartner predicts that by 2015, 40 percent of the security controls used within enterprise data centers will be virtualized, up from less than 5 percent in 2010.

To combat cyber threats, physical, network and virtualization-based segmentation of systems is created to achieve more user control. While the essential traits and goals of IT security such as ensuring the confidentiality, integrity, authenticity, access, and audit of our information and workloads - don't change, delivery methods must.

Thomas Bittman, vice president and distinguished analyst at Gartner says, "Policies tied to physical attributes, such as the server, Internet Protocol (IP) address, Media Access Control (MAC) address or where physical host separation is used to provide isolation, break down with private cloud computing,"

Aside from virtualization of security controls , Gartner mentions that private cloud security must be an integral, but a separately configurable part of the private cloud fabric and should be designed as a set of on-demand, elastic and programmable services . In addition, security should be configured by policies tied to logical attributes to create "adaptive trust zones" capable of separating multiple tenants.

The industry analyst company further provides six necessary attributes of private cloud security infrastructure: A Set of On-Demand and Elastic Services, Programmable Infrastructure, Policies that are based on logical, not physical attributes capable of incorporating runtime context into real-time security decisions, Adaptive trust zones that are capable of high-assurance separation of differing trust levels, Separately configurable security policy management and control and ‘Federatable' security Policy and identity.