Broadband Developments

The last few weeks have been incredible for virtualization buzz, from the Cloud Computing Meme upsurge, to the launch of Hyper-V and then the shocking Greene departure at VMware. It is only a matter of time before we hear speculation about ESX price cuts in response to Microsoft’s aggressive Hyper-V pricing; much of the virtualization world will therefore be listening carefully to VMware in coming months or perhaps weeks.

Let’s face it, if Microsoft catches up with VMware in terms of product features and functionality VMware will have a very difficult time maintaining their ESX price points. Their history of innovation may serve them even more now that they face a formidable competitor.

VMware has two high potential strategies at this juncture: they can continue to innovate in ways that make data center deployments even more compelling (getting beyond Virtualization-Lite) and/or they can find new ways to monetize and differentiate existing partner ecosystem technologies.

If the hypervisor becomes a commodity then VMware will have a strong economic incentive to monetize premium functionality and capabilities as efficiently as possible. Addressing virtsec, I/O constraints that weaken VMotion as well as change management and compliance considerations more aggressively could help accelerate data center adoption; yet monetizing those capabilities could also help the company become less dependent on hypervisor revenues.

Across the long term I think VMware should consider a two-step attack against Microsoft: 1) move inward from the Virtualization-Lite beach head as quickly as possible (to broaden production deployments) in order to shrink Microsoft’s addressable market in the data center; and 2) quickly and efficiently monetize the unique ESX features and capabilities as soon as Microsoft attacks the data center, perhaps sooner.

The VMware partner eco-system (including the brilliant VMsafe initiative) was a sizable differentiator against Xen/Citrix; now with Microsoft entering the market it may become a double-edged sword. VMware needs unique, production-ready innovation in virtualization security now more than ever. They cannot wait for virtsec partner Godot or freeze the market with partner slide ware.

If they can increase the rate of data center virtualization, innovate and monetize unique features they can beat Microsoft in the data center, even if the Redmond team continues with the loss leader gorilla extension strategy.

Marketing should now play an even more strategic role at VMware.

Related reading: How Hyper-V could beat VMware - July 8 2008

My disclosure is available at: About Archimedius

A few hours ago I finished reading Nicholas Carr’s The Big Switch and was floored by his take on the impending mass adoption of cloud/utility computing and its impacts on information technology and the world. A few minutes ago I read another great piece from InfoWorld, this time on cloud computing and security: The Dangers of Cloud Computing.

I’ve been ranting at The Archimedius Report about virtualization and security and the inherent challenges of securing mobile, state-changing servers. That’s why these paragraphs from Ephraim’s article published Monday set off yet another “implication” for data center and network security, thanks to some insightful comments by Gartner’s chief security analyst John Pescatore:

The area that worries Pescatore most is how quickly cloud-based services are updated and changed. He cites Microsoft’s painstaking development of the SDLC (Software Development Life Cycle) initiative that assumes mission-critical software will have a three- to five-year period in which it will not substantially change.

“In the cloud, every two weeks we add a new feature, changing the app all the time. But the secure SDLC is not built to do that. We are going back to the old Netscape days of pushing out new features real quick, and nobody has a security cycle that moves that fast,” Pescatore says.

What makes matters even worse is that the business user can’t say he wants to stay on the old version. “In the cloud you have to accept the next version, possibly nullifying any security that was built into the old application or assumed through integration at the customer site.

- Ephraim Schwartz, InfoWorld, July 7 2008

As I mentioned in Virtualization-Lite the network security solution leaders have poor visibility into the hypervisor layer and even poorer hypervisor layer enforcement capabilities. Neither Cisco, nor Juniper nor McAfee are well-prepared for the tasks of defending fluid virtual server environments, unless each environment is confined within an individual hypervisor. That’s not really virtualization, but rather virtualization-lite. Virtualization-lite is the acceptance of a reduced business case for virtualization in exchange for a more stable network security posture.

The nature and scale of cloud computing would put even more pressure on this world of static security already put on notice by virtualization in the data center. Imagine millions of blade servers deployed around the world each hosting dozens of VMs capable of following the moon, as Kevin Kelly says.

That level of mobility (servers chasing cheap electricity around the globe thanks to ubiquitous cloud computing) would wreak havoc on the security status quo architected for years to defend fixed servers. Leading network security appliances have assumed inflexibility inside the perimeter, and that has been a key impediment to virtsec and to the rapid proliferation of virtualization of the data center.

Of course, Kelly’s “follow the moon” vision is further off than the vision of virtualization and smaller independent clouds/utilities. Yet there is still trouble on the horizon. If you accept Carr (that utility computing is inevitable) the picture for IT as we know it today is bleak. The security industry wouldn’t be in much better shape either:

In the long run, the IT department is unlikely to survive, at least not in the familiar form. It will have little left to do once the bulk of business computing shifts out of private data centers and into “the cloud.”

- Nicholas Carr, The Big Switch, page 118

A few weeks ago I talked about the tactical nature of network security and its occasional quicksand mentality, where every new move means a risk of sinking even deeper into the perceived risk abyss. At this point it appears that tactical network security teams are not taking the lead when it comes to unleashing virtualization, for obvious reasons. They’re deploying the hypervisor VLANs we just discussed, which limit flexibility and movement to within the confines of a single hypervisor.

IN A NUTSHELL

Security solutions are behind when it comes to virtualization. Security pros are taking a tactical posture. Yet change is coming according to Carr.

With sunrise over the data center comes an array of clouds stretched out as far as the eye can see. Will those clouds tease us into accepting a potentially weaker security posture in exchange for lower IT costs and greater convenience? I think the answer is yes.

Storm Clouds then Much-Needed Rain

As network security pros and pundits struggle to create ROI models for security or new rationales for more proactive postures within increasingly reactive bureaucracies I think it is obvious that we’ll accept more breaches in exchange for more convenience. That is, until the defining moment of an attack so audacious that it forces innovation as a means of service provider survival.

A cloud breach could be monumental and shocking. It may be what netsec needs to get back on top of the game.

A cloud attack could drive a new renaissance in security, with new outlooks and probably even panic overspending. Maybe we would even see application service providers market security in the same way that Swiss banks once marketed privacy. That could make security strategic to brand. And many enterprises already know how to calculate brand ROI.

===================================

Disclosure: I’m the VP Marketing for Blue Lane Technologies, a winner of the 2007 InfoWorld Technology of the Year for security, Best of Interop 2007 in security and the AO 100 Top Private Company award for 2006 and 2007. Blue Lane is also a 2007 Best of VMworld Finalist in data protection. I’ve been a marketing executive at Juniper Networks, Redline Networks, IntruVert Networks and ShoreTel. I’ve been an Always On blogger/columnist since 2004. My recently launched personal blog is: www.archimedius.net . I recently added my blog to a growing lineup of editors at BroadDev.com. These are all my opinions, and do not represent the opinions of employers, spouses, kids, etc.

Now that Hyper-V is officially shipping you can expect to see a series of new developments in the data center virtualization market. Microsoft appears to be leveraging Hyper-V and virtualization to extend the reach of Server 2008 versus launching it as a head to head offering versus ESX.

Microsoft clearly wants to play to its incumbent strengths in the data center as a way to put increasing pressure on VMware. By releasing a low cost product that bundles, Microsoft has positioned themselves as an incumbent disruptor:

Hyper-V is a late arrival to the party and is taking a different approach to garner recognition. First off, Hyper-V, for all intents and purposes, is a free virtualization solution; it is included with several editions of Windows Server 2008 and is deployed using WS08’s roles wizard. That bundling, ease of installation and initial “no cost” ideology will make Hyper-V a hard technology to ignore. What’s more, those looking to bring virtualization into their enterprises will be forced to take a long hard look at an upgrade path that includes Windows Server 2008.

- Frank Ohlhorst, eWeek June 26, 2008

It isn’t that different than how Cisco has been treating Riverbed lately, using the gorilla factor (aggressive, competitive product pricing bundled in with a breadth of offerings and relationships) to apply pressure to a smaller foe with more specialized products within fewer categories. It’s a commonly used marketing strategy that forces competitors -out of necessity- to innovate more and make less in order to land the same customers.

Now that Microsoft has played its first hand I think it’s clear that both VMware and Citrix are going to be looking to differentiate more aggressively. That should mean less talk about the general benefits of virtualization (Microsoft will be doing that on perhaps a larger scale with Hyper-V) and more about the business case for unique features and perhaps even focusing on more specialized sub-categories.

You can expect both to start talking about roadmaps that will keep them ahead of Microsoft and the strategic importance of their ecosystems, capabilities and specialized data center requirements. I think the existing virtualization-lite dynamic that has played itself out since VMsafe’s awe-inspiring launch at VMworld Cannes, now needs to mature into full-blown virtualization within the data center.

That doesn’t mean complete virtualization of the data center, but rather quickly extending from the hypervisor VLAN beach head into deployments that make the business case for virtualization even stronger. With Citrix it may mean more focus on desktops versus virtual servers.

For VMware that makes virtualization security, VMotion and any potential capability roadblocks now strategic to success. Months ago features were tactical. With Hyper-V some will now be strategic.

As Microsoft uses its position to pressure VMware in the same way that large product portfolio players squeeze one category specialists, VMware will now need to accelerate execution on strategic features and move inland from the hypervisor VLAN beach head to win and defend critical data center infrastructure.

VMware may become even more aggressive on the roadmap front, and articulate an even more powerful vision for its marketplace. The coming VMworld could be the best ever from the standpoint of attendance, buzz and innovation.

The difference between success and failure is often a matter of momentum, focus, aggression and execution. VMware has done very well so far; the question now is how effectively they can get their partners, prospects and customers to take the next step while Microsoft prepares its next moves.

===================================

Disclosure: I’m the VP Marketing for Blue Lane Technologies, a winner of the 2007 InfoWorld Technology of the Year for security, Best of Interop 2007 in security and the AO 100 Top Private Company award for 2006 and 2007. Blue Lane is also a 2007 Best of VMworld Finalist in data protection. I’ve been a marketing executive at Juniper Networks, Redline Networks, IntruVert Networks and ShoreTel. I’ve been an Always On blogger/columnist since 2004. My recently launched personal blog is: www.archimedius.net . My blog also appears at www.broaddev.com, John Furrier’s new 24 hour blogzine. These are all my opinions, and do not represent the opinions of employers, spouses, kids, etc. They also do not represent any stock recommendations of any kind.

VMware has enjoyed having the virtualization market to itself, with only peripheral competition from Citrix and others. As I’ve talked about virtualization and security it also seemed like the only story in town was VMware; Microsoft has been silent and Citrix has taken a more passive stance.

With Microsoft’s blog on Hyper-V posted June 25, it appears that they’re now ready to start putting the squeeze on VMware by announcing their intentions to go into areas underserved by VMware, including eventually entering the data center. The impact of their announced intentions is a signal to VMware’s customers and prospects that Microsoft is on the way.

This officially puts VMware on notice that any delays in penetrating data centers with virtualization will increase the prospects of Microsoft competition: possibly including lower margins and longer sales cycles. Microsoft has a formidable presence. They won’t have to have a better product. If they deliver a more secure approach to virtualization it could also spell trouble for VMware, as that is currently a very significant barrier to the full benefit of virtualization.

Virtualization-lite, or the adoption of hypervisor VLANs with restricted movement and flexibility, will not be enough to hold back Microsoft. VMware will need to get VMsafe members to step up and deliver elegant hypervisor visibility and enforcement. If they can heighten the VMware business case by unleashing the full power of virtualization in the data center they will have a substantial head start; and that could be Microsoft’s Achilles heel.

===================================

Disclosure: I’m the VP Marketing for Blue Lane Technologies, a winner of the 2007 InfoWorld Technology of the Year for security, Best of Interop 2007 in security and the AO 100 Top Private Company award for 2006 and 2007. Blue Lane is also a 2007 Best of VMworld Finalist in data protection. I’ve been a marketing executive at Juniper Networks, Redline Networks, IntruVert Networks and ShoreTel. I’ve been an Always On blogger/columnist since 2004. My recently launched personal blog is: www.archimedius.net . My blog also appears at www.broaddev.com, John Furrier’s new 24 hour blogzine. These are all my opinions, and do not represent the opinions of employers, spouses, kids, etc. They also do not represent any stock recommendations of any kind.

Microsoft has their heads in the clouds or do they? Today many conversations around cloud this and cloud that.  Many of my recent blogs at Archimedius have talked about cloud computing from a macroeconomic perspective, with anecdotes about small towns mixed in with lessons from world economic history. Now let’s talk about why ever company with an IT operations department hasn’t yet flown into the clouds to save money and enhance agility.

A farm made up of racks and stacks of hypervisors is incredibly cost efficient, and can allow servers to be brought up and down on short notice in order to scale to meet user demand. That kind of flexibility is a powerful IT operations enabler, especially for businesses with significant user load spikes.

Without virtualization (or cloud computing) organizations have to overprovision servers to support peak; they even keep unused servers running simply to ensure system availability for potential peak usage. That consumes plenty of extra electricity and has caused crowding and data center expansion for many enterprises, which also means extra real estate expense.

If server farms were interconnected around the world in a massive cloud, servers could chase cheap power and only consume electricity when needed. That would be a massive boost in server efficiency and reduction in energy consumption, as articulated in Follow the Moon (or whatever).

Yet despite the opportunities to go cloud there are still technical hurdles; and one of those hurdles is virtualization security. Sharing processing power among many organizations, applications, etc would require a new level of security enforcement well beyond the systems in use today to protect physical servers. Most were created to protect known, static servers, and deployed at an outer perimeter. Very few are capable of looking at traffic inside a hypervisor and protecting virtual servers (VMs) from each other. Many use older deep packet inspection engines to scan traffic for growing lists of attack signatures, which is very compute intensive, which means sizable hypervisor resources being tied up in security tasks.

Because these solutions are compute intensive enterprises would have to create elaborate hairpins between hypervisors, agents and multiple hardware security appliances in order to properly protect the hypervisor layer.

As a result, most enterprises that have virtualized portions of their production data centers have implemented what I’ve called virtualization-lite. There is very little flexibility and cost savings with virtualization-lite relative to virtualization and cloud computing, but it’s the most common response to the protection of VMs by older network security equipment.

Virtualization security is therefore one of the factors restricting the benefits of data center virtualization, and would be an even a larger impediment to cloud computing; the benefits of clouds depend on higher levels of flexibility and server motion.

The established network security and virtualization players need to tackle this issue in order to drive the wider adoption of virtualization and cloud computing. They need to deliver deeper and more robust hypervisor inspection and traffic management capabilities, without having to resort to hypervisor hogging and movement restrictions driven by multiple, specialized security agents or elaborate appliance hairpins.

There is no question that the major players will eventually deliver on the promise of an elegant, comprehensive virtsec solution. Technologies have come to market to address the unique requirements of VM security and hypervisor layer enforcement. The key is their rate of adoption into mainstream virtualization projects. According to security expert Mike Rothman that adoption will take years. Yet the virtualization, security and cloud computing players could reap massive gains as a result of cloud computing. They could establish leadership and considerable revenue momentum as the world’s data centers are re-architected.

Yet the market will have to walk before servers can fly.

===================================

Disclosure: I’m the VP Marketing for Blue Lane Technologies, a winner of the 2007 InfoWorld Technology of the Year for security, Best of Interop 2007 in security and the AO 100 Top Private Company award for 2006 and 2007. Blue Lane is also a 2007 Best of VMworld Finalist in data protection. I’ve been a marketing executive at Juniper Networks, Redline Networks, IntruVert Networks and ShoreTel. I’ve been an Always On blogger/columnist since 2004. My recently launched personal blog is: www.archimedius.net . My blog also appears at www.broaddev.com, John Furrier’s new 24 hour blogzine. These are all my opinions, and do not represent the opinions of employers, spouses, kids, etc. They also do not represent any stock recommendations of any kind.

Rothman as Metapho

Yesterday security pundit and all around nice guy Mike Rothman unleashed a Special Incite called: “VirtSec: Don’t Hold your Breath.”

He mentioned a few of us security bloggers and talked about how long it will take before virtsec takes off and why. I think our “pragmatist” has really confused vision and tech strategy with market sizing.

Most of the larger netsec players argue that “size equals significance”, while startups usually correlate significance and innovation with growth potential. The truth is probably somewhere in between, although the last few years have been rewarding incrementalism more than innovation.

By falling into the “size matters” camp, Mike ends up becoming a perhaps unwilling metaphor for today’s numero uno problem. I’ll call it the netsec quicksand rationalization, which goes like this: “every move you make causes you to sink even further”. Whether it’s the thousands of new attack permutations a day, the knowledge of an increasing population of vulnerabilities, or the no rest posture of waiting for the next attack, I think Rothman represents a common perspective shared by many in the security industry.

For years netsec has become a land of incremental innovations, driven mostly by past decisions, regulatory events and exploit publicity dynamics. Every new security category looks a lot like the airline industry as it starts, with more funds going out than coming in. Under those kinds of pressures a few survivors emerge, and fewer yet find exits for their investors.

As IT teams evaluate new technologies they hold them against a higher standard than those already installed. As Andy Kyte said at a recent Gartner keynote covered by Network World:

“We see people putting money into products and solutions that are clearly dying. Instead of investing in them, they should be investing in migrating off of them.” - Andy Kyte quoted in Network World

Most large enterprises have made an attempt to protect themselves from the negative effects of bad decisions by establishing a multitude of committees to approve purchases. They collectively evaluate new technologies, placing more emphasis on analyzing innovations than the value of what they’ve already installed. The result: innovation faces disproportionate scrutiny versus the scrutiny placed on the negative effects of obsolete legacy decisions.

That environment of “selective persecution” puts a substantial burden on anything truly new, while rewarding incremental innovations which are complementary to five or ten years of past product decisions. No wonder Mike has advised repeatedly to go to the midmarket when launching a new netsec product.

Last year I was chatting with my cousin the IT guy, who has spent close to 20 years working for a large IT consulting firm. We were talking about various hot new technologies and he commented: “My frustration is that it takes us about two years to evaluate and deploy a new, innovative product; and that’s if it’s hot.”

That brings me back to Rothman’s hold your breath rant. Taking any new discussion and waving the “it’s two years guys” flag just exacerbates the quick sand mentality. Everyone knows that new markets start slow and the first 50 customers are the hardest; but virtualization is already established and spreading like gangbusters, VMware is openly declaring their intentions to permeate the data center and the cloud, and security is clearly a new challenge for platforms developed within the confines of devtest. The strategic importance of virtsec has indeed drawn a great deal of attention as plans are made.

Virtualization is an opportunity to examine the possibilities of the old and the new and to make network security and IT strategic. As enterprises deploy virtualization-lite as a first step, let’s use this opportunity to rethink what is working and what isn’t, and to plan a more proactive future. Let’s place equal scrutiny on yesterday’s decisions as we do on tomorrow’s innovations.

That is why it is important for people like Hoff and Rothman and others to keep the conversation looking forward, beyond the beer already spilled. It will take innovation on multiple levels to help us get ahead of the game, so let’s not get distracted by the bureaucracy that won’t jump until it’s too late. We’ve seen that story play itself out many times before.

There is also a considerable consensus that the requirements of virtualization security are different than those of fixed physical servers; and that most of the security players, including Cisco, Juniper and Symantec, may not be ready for the demands of elegant hypervisor layer visibility and enforcement.

I think the coming collision between virtualization and security in the data center gives us plenty to talk about. Or we could just sit still and breathe slowly while waiting for someone to hand us a vine.

While competitors watch and wait VMware has engineered the equivalent of a Normandy beach landing in production data centers. The company once known for heightened devtest flexibility and server utilization has become the leader in virtualization security. VMware CEO Diane Green is talking to the press about the virtsec opportunity while its competitors fiddle.

A year ago virtualization security was a whisper at best, thanks to a handful of visionary analysts, pundits and editors who understood the security implications of a new hypervisor layer inside the data center. VMware had their fingers on the pulse of the conversation and launched VMsafe at VMworld in Cannes.

Despite the network security world being slow to announce virtsec products, VMware was able to get many of these vendors to announce partnerships based on API access that would eventually lead to products. That promise led to a remarkable up swell in interest, as I blogged months ago.

Part of the challenge faced by netsec vendors is the inability of their solutions to peer into the hypervisor layer and deliver protection without tying up substantial hypervisor resources. That is easier said than done for signature-based AV and intrusion prevention products, for example, that have been fed for years by the dedicated hardware upgrade game that fueled remarkable revenue growth in an otherwise lackluster overall IT spending environment.

That’s why I think the first order outcome of VMsafe has been the emergence of virtualization-lite in the data center. Virtualization-lite is the use of existing network security appliances to protect individual hypervisors and zone them off from one another. The highly flexible, rack and stack promise of virtualization gets partitioned into multiple VLANs.

While VLAN spaghetti is not optimum from either a security or virtualization business case standpoint, it does give VMware and the traditional network security players a competitive beachhead. Virtualization-lite allows VMware into the data center, socializes virtualization with a new array of enterprise network professionals and allows for some additional operations flexibility over and beyond the previous physical server infrastructure.

It also allows the network security players (vendors and enterprise pros) to play with the hypervisors and gain valuable experience in real settings. Virtualization-lite minimizes emerging security requirements and management burdens, and limits the change and flexibility to within well-defined domains.

At the end of the day, virtualization-lite is only a beachhead. The faster that VMware can make a more aggressive business case for the energy savings and flexibility benefits of hypervisor meshes, the faster that it will grow more lucrative data center deals and the more distance it will place between itself and competitors. That will require more security than virtsec-lite; it will require comprehensive solutions that can protect VMs without the heavy hypervisor loads and elaborate hairpins between the hypervisor layer and multiple security appliance toll booths.

And these hypervisor VLAN configurations are still vulnerable to the same old attacks against unsafe software that will never be safe enough. Add in a mix of mobility and mutation and you get a fluid attack surface with a higher propensity for surprises. The Verizon Breach Report identified plenty of implications for virtsec challenges over and above those already present in less flexible physical infrastructure. More change and less visibility even within partitioned VLANs isn’t a long term answer, it is only a temporary position as vendors prepare their next moves and enterprises get a taste of the payoff.

As VMware has acknowledged with words and actions, virtsec is strategic to data center virtualization.