Broadband Developments

The last few weeks have been incredible for virtualization buzz, from the Cloud Computing Meme upsurge, to the launch of Hyper-V and then the shocking Greene departure at VMware. It is only a matter of time before we hear speculation about ESX price cuts in response to Microsoft’s aggressive Hyper-V pricing; much of the virtualization world will therefore be listening carefully to VMware in coming months or perhaps weeks.

Let’s face it, if Microsoft catches up with VMware in terms of product features and functionality VMware will have a very difficult time maintaining their ESX price points. Their history of innovation may serve them even more now that they face a formidable competitor.

VMware has two high potential strategies at this juncture: they can continue to innovate in ways that make data center deployments even more compelling (getting beyond Virtualization-Lite) and/or they can find new ways to monetize and differentiate existing partner ecosystem technologies.

If the hypervisor becomes a commodity then VMware will have a strong economic incentive to monetize premium functionality and capabilities as efficiently as possible. Addressing virtsec, I/O constraints that weaken VMotion as well as change management and compliance considerations more aggressively could help accelerate data center adoption; yet monetizing those capabilities could also help the company become less dependent on hypervisor revenues.

Across the long term I think VMware should consider a two-step attack against Microsoft: 1) move inward from the Virtualization-Lite beach head as quickly as possible (to broaden production deployments) in order to shrink Microsoft’s addressable market in the data center; and 2) quickly and efficiently monetize the unique ESX features and capabilities as soon as Microsoft attacks the data center, perhaps sooner.

The VMware partner eco-system (including the brilliant VMsafe initiative) was a sizable differentiator against Xen/Citrix; now with Microsoft entering the market it may become a double-edged sword. VMware needs unique, production-ready innovation in virtualization security now more than ever. They cannot wait for virtsec partner Godot or freeze the market with partner slide ware.

If they can increase the rate of data center virtualization, innovate and monetize unique features they can beat Microsoft in the data center, even if the Redmond team continues with the loss leader gorilla extension strategy.

Marketing should now play an even more strategic role at VMware.

Related reading: How Hyper-V could beat VMware - July 8 2008

My disclosure is available at: About Archimedius

A few hours ago I finished reading Nicholas Carr’s The Big Switch and was floored by his take on the impending mass adoption of cloud/utility computing and its impacts on information technology and the world. A few minutes ago I read another great piece from InfoWorld, this time on cloud computing and security: The Dangers of Cloud Computing.

I’ve been ranting at The Archimedius Report about virtualization and security and the inherent challenges of securing mobile, state-changing servers. That’s why these paragraphs from Ephraim’s article published Monday set off yet another “implication” for data center and network security, thanks to some insightful comments by Gartner’s chief security analyst John Pescatore:

The area that worries Pescatore most is how quickly cloud-based services are updated and changed. He cites Microsoft’s painstaking development of the SDLC (Software Development Life Cycle) initiative that assumes mission-critical software will have a three- to five-year period in which it will not substantially change.

“In the cloud, every two weeks we add a new feature, changing the app all the time. But the secure SDLC is not built to do that. We are going back to the old Netscape days of pushing out new features real quick, and nobody has a security cycle that moves that fast,” Pescatore says.

What makes matters even worse is that the business user can’t say he wants to stay on the old version. “In the cloud you have to accept the next version, possibly nullifying any security that was built into the old application or assumed through integration at the customer site.

- Ephraim Schwartz, InfoWorld, July 7 2008

As I mentioned in Virtualization-Lite the network security solution leaders have poor visibility into the hypervisor layer and even poorer hypervisor layer enforcement capabilities. Neither Cisco, nor Juniper nor McAfee are well-prepared for the tasks of defending fluid virtual server environments, unless each environment is confined within an individual hypervisor. That’s not really virtualization, but rather virtualization-lite. Virtualization-lite is the acceptance of a reduced business case for virtualization in exchange for a more stable network security posture.

The nature and scale of cloud computing would put even more pressure on this world of static security already put on notice by virtualization in the data center. Imagine millions of blade servers deployed around the world each hosting dozens of VMs capable of following the moon, as Kevin Kelly says.

That level of mobility (servers chasing cheap electricity around the globe thanks to ubiquitous cloud computing) would wreak havoc on the security status quo architected for years to defend fixed servers. Leading network security appliances have assumed inflexibility inside the perimeter, and that has been a key impediment to virtsec and to the rapid proliferation of virtualization of the data center.

Of course, Kelly’s “follow the moon” vision is further off than the vision of virtualization and smaller independent clouds/utilities. Yet there is still trouble on the horizon. If you accept Carr (that utility computing is inevitable) the picture for IT as we know it today is bleak. The security industry wouldn’t be in much better shape either:

In the long run, the IT department is unlikely to survive, at least not in the familiar form. It will have little left to do once the bulk of business computing shifts out of private data centers and into “the cloud.”

- Nicholas Carr, The Big Switch, page 118

A few weeks ago I talked about the tactical nature of network security and its occasional quicksand mentality, where every new move means a risk of sinking even deeper into the perceived risk abyss. At this point it appears that tactical network security teams are not taking the lead when it comes to unleashing virtualization, for obvious reasons. They’re deploying the hypervisor VLANs we just discussed, which limit flexibility and movement to within the confines of a single hypervisor.

IN A NUTSHELL

Security solutions are behind when it comes to virtualization. Security pros are taking a tactical posture. Yet change is coming according to Carr.

With sunrise over the data center comes an array of clouds stretched out as far as the eye can see. Will those clouds tease us into accepting a potentially weaker security posture in exchange for lower IT costs and greater convenience? I think the answer is yes.

Storm Clouds then Much-Needed Rain

As network security pros and pundits struggle to create ROI models for security or new rationales for more proactive postures within increasingly reactive bureaucracies I think it is obvious that we’ll accept more breaches in exchange for more convenience. That is, until the defining moment of an attack so audacious that it forces innovation as a means of service provider survival.

A cloud breach could be monumental and shocking. It may be what netsec needs to get back on top of the game.

A cloud attack could drive a new renaissance in security, with new outlooks and probably even panic overspending. Maybe we would even see application service providers market security in the same way that Swiss banks once marketed privacy. That could make security strategic to brand. And many enterprises already know how to calculate brand ROI.

===================================

Disclosure: I’m the VP Marketing for Blue Lane Technologies, a winner of the 2007 InfoWorld Technology of the Year for security, Best of Interop 2007 in security and the AO 100 Top Private Company award for 2006 and 2007. Blue Lane is also a 2007 Best of VMworld Finalist in data protection. I’ve been a marketing executive at Juniper Networks, Redline Networks, IntruVert Networks and ShoreTel. I’ve been an Always On blogger/columnist since 2004. My recently launched personal blog is: www.archimedius.net . I recently added my blog to a growing lineup of editors at BroadDev.com. These are all my opinions, and do not represent the opinions of employers, spouses, kids, etc.

VMware has enjoyed having the virtualization market to itself, with only peripheral competition from Citrix and others. As I’ve talked about virtualization and security it also seemed like the only story in town was VMware; Microsoft has been silent and Citrix has taken a more passive stance.

With Microsoft’s blog on Hyper-V posted June 25, it appears that they’re now ready to start putting the squeeze on VMware by announcing their intentions to go into areas underserved by VMware, including eventually entering the data center. The impact of their announced intentions is a signal to VMware’s customers and prospects that Microsoft is on the way.

This officially puts VMware on notice that any delays in penetrating data centers with virtualization will increase the prospects of Microsoft competition: possibly including lower margins and longer sales cycles. Microsoft has a formidable presence. They won’t have to have a better product. If they deliver a more secure approach to virtualization it could also spell trouble for VMware, as that is currently a very significant barrier to the full benefit of virtualization.

Virtualization-lite, or the adoption of hypervisor VLANs with restricted movement and flexibility, will not be enough to hold back Microsoft. VMware will need to get VMsafe members to step up and deliver elegant hypervisor visibility and enforcement. If they can heighten the VMware business case by unleashing the full power of virtualization in the data center they will have a substantial head start; and that could be Microsoft’s Achilles heel.

===================================

Disclosure: I’m the VP Marketing for Blue Lane Technologies, a winner of the 2007 InfoWorld Technology of the Year for security, Best of Interop 2007 in security and the AO 100 Top Private Company award for 2006 and 2007. Blue Lane is also a 2007 Best of VMworld Finalist in data protection. I’ve been a marketing executive at Juniper Networks, Redline Networks, IntruVert Networks and ShoreTel. I’ve been an Always On blogger/columnist since 2004. My recently launched personal blog is: www.archimedius.net . My blog also appears at www.broaddev.com, John Furrier’s new 24 hour blogzine. These are all my opinions, and do not represent the opinions of employers, spouses, kids, etc. They also do not represent any stock recommendations of any kind.

Microsoft has their heads in the clouds or do they? Today many conversations around cloud this and cloud that.  Many of my recent blogs at Archimedius have talked about cloud computing from a macroeconomic perspective, with anecdotes about small towns mixed in with lessons from world economic history. Now let’s talk about why ever company with an IT operations department hasn’t yet flown into the clouds to save money and enhance agility.

A farm made up of racks and stacks of hypervisors is incredibly cost efficient, and can allow servers to be brought up and down on short notice in order to scale to meet user demand. That kind of flexibility is a powerful IT operations enabler, especially for businesses with significant user load spikes.

Without virtualization (or cloud computing) organizations have to overprovision servers to support peak; they even keep unused servers running simply to ensure system availability for potential peak usage. That consumes plenty of extra electricity and has caused crowding and data center expansion for many enterprises, which also means extra real estate expense.

If server farms were interconnected around the world in a massive cloud, servers could chase cheap power and only consume electricity when needed. That would be a massive boost in server efficiency and reduction in energy consumption, as articulated in Follow the Moon (or whatever).

Yet despite the opportunities to go cloud there are still technical hurdles; and one of those hurdles is virtualization security. Sharing processing power among many organizations, applications, etc would require a new level of security enforcement well beyond the systems in use today to protect physical servers. Most were created to protect known, static servers, and deployed at an outer perimeter. Very few are capable of looking at traffic inside a hypervisor and protecting virtual servers (VMs) from each other. Many use older deep packet inspection engines to scan traffic for growing lists of attack signatures, which is very compute intensive, which means sizable hypervisor resources being tied up in security tasks.

Because these solutions are compute intensive enterprises would have to create elaborate hairpins between hypervisors, agents and multiple hardware security appliances in order to properly protect the hypervisor layer.

As a result, most enterprises that have virtualized portions of their production data centers have implemented what I’ve called virtualization-lite. There is very little flexibility and cost savings with virtualization-lite relative to virtualization and cloud computing, but it’s the most common response to the protection of VMs by older network security equipment.

Virtualization security is therefore one of the factors restricting the benefits of data center virtualization, and would be an even a larger impediment to cloud computing; the benefits of clouds depend on higher levels of flexibility and server motion.

The established network security and virtualization players need to tackle this issue in order to drive the wider adoption of virtualization and cloud computing. They need to deliver deeper and more robust hypervisor inspection and traffic management capabilities, without having to resort to hypervisor hogging and movement restrictions driven by multiple, specialized security agents or elaborate appliance hairpins.

There is no question that the major players will eventually deliver on the promise of an elegant, comprehensive virtsec solution. Technologies have come to market to address the unique requirements of VM security and hypervisor layer enforcement. The key is their rate of adoption into mainstream virtualization projects. According to security expert Mike Rothman that adoption will take years. Yet the virtualization, security and cloud computing players could reap massive gains as a result of cloud computing. They could establish leadership and considerable revenue momentum as the world’s data centers are re-architected.

Yet the market will have to walk before servers can fly.

===================================

Disclosure: I’m the VP Marketing for Blue Lane Technologies, a winner of the 2007 InfoWorld Technology of the Year for security, Best of Interop 2007 in security and the AO 100 Top Private Company award for 2006 and 2007. Blue Lane is also a 2007 Best of VMworld Finalist in data protection. I’ve been a marketing executive at Juniper Networks, Redline Networks, IntruVert Networks and ShoreTel. I’ve been an Always On blogger/columnist since 2004. My recently launched personal blog is: www.archimedius.net . My blog also appears at www.broaddev.com, John Furrier’s new 24 hour blogzine. These are all my opinions, and do not represent the opinions of employers, spouses, kids, etc. They also do not represent any stock recommendations of any kind.

Like The Wisdom of Clouds author James Urquhart I was floored by the cloud computing meme explosion. What was an initial comment about Who will Ride the Clouds was picked up by tech visionary Nicholas Carr Monday, in addition to several new media outlets.

While I’ve been living in networking and security technology the last ten-plus years, the implications of cloud computing took me back to an econ history course I took in grad school taught by Walt Rostow. Walt authored several economic history textbooks, including a tome from the sixties called The Stages of Economic Growth, which was subtitled “a Non-Communist Manifesto”.

Walt’s wonderful course was about how fluctuating terms of trade over hundreds of years between raw material and finished goods economies were a backdrop to various stages of economic growth and development experienced by nations around the world. Cultural factors, geographical conditions and markets shifted wealth across hundreds of years and thousands of miles as demands and trade routes shifted, technologies and tastes evolved and new raw material sources were discovered or depleted.

For his time Walt was highly controversial in many circles, not just because of his belief in the triumph of capitalism (especially in the sixties) but also because of his unwavering support for the war in Vietnam. Yet I found his economic history perspective refreshing, especially before the outright collapse of communism.

Because of Walt’s scholarship I saw cloud computing within an even larger context than its impact on network and security equipment/software. As cloud computing decouples software, services and servers from physical hardware it poses an incredible impact on who benefits from IT. It promises to shift IT operations careers from highly congested and expensive real estate markets to remote farming communities in areas with cheap power.

We’re already witnessing shifts in how technology firms operate, including the rise of teleworking and the movement of larger firms with mature technologies to lower cost (especially real estate and tax) locations. When you add virtualized cloud IT to the mix you add an even more powerful dynamic that is already moving IT operations to remote areas like Quincy, WA which offer cheap electricity and cheap real estate, not to mention less congestion.

As massive server farms are built, small farming towns become the factories of tomorrow. The Detroit-styled, urban bureaucracies and wealth transfer engines (that relied upon proximity to unprecedented wealth creation to insulate residents from the ongoing dance between productivity and resources) start crumbling at a faster pace.

IT operations flight would disproportionately hit communities that have depended upon unprecedented gains in tax revenues driven by their proximity to powerhouse technology company headquarters and branch offices; and would deliver the equivalent of a route change for the information superhighway. Remember the ghost towns created by dried up mines or shifts in railroad routes?

Similarly, large technology companies that fight the tide by keeping IT operations in higher cost metro areas pay disproportionately for the same services as their competitors. The Googles, Microsofts and Amazons enjoy competitive advantages by spreading the wealth into communities that were once isolated from the industrial and computer age, where many residents don’t have an email address.

The age of motorized transportation drove incredible resources to the automobile and the petroleum industry, enriching towns and even deserts with manufacturing or processing plants and oil facilities. The information technology age may similarly empower a new generation of communities, companies and electricity producers.

If cloud computing and virtualization launch the age of strategic electricity, power plants could become as important to economic growth as universities and entrepreneurs. New investments in new energy technologies could finally give us the impetus to break our dependence upon fossil fuels.

There are still technology barriers to the cloud computing vision, including virtualization security, application management and delivery, I/O processing and change management, to name a few. New companies have already emerged to tackle these challenges and as their new approaches get adopted new potentials are unleashed. I’ll be talking about them here at Archimedius in coming months. I just had to tee them up within the larger context as a tribute to Walt Rostow, a great professor and scholar.

Rothman as Metapho

Yesterday security pundit and all around nice guy Mike Rothman unleashed a Special Incite called: “VirtSec: Don’t Hold your Breath.”

He mentioned a few of us security bloggers and talked about how long it will take before virtsec takes off and why. I think our “pragmatist” has really confused vision and tech strategy with market sizing.

Most of the larger netsec players argue that “size equals significance”, while startups usually correlate significance and innovation with growth potential. The truth is probably somewhere in between, although the last few years have been rewarding incrementalism more than innovation.

By falling into the “size matters” camp, Mike ends up becoming a perhaps unwilling metaphor for today’s numero uno problem. I’ll call it the netsec quicksand rationalization, which goes like this: “every move you make causes you to sink even further”. Whether it’s the thousands of new attack permutations a day, the knowledge of an increasing population of vulnerabilities, or the no rest posture of waiting for the next attack, I think Rothman represents a common perspective shared by many in the security industry.

For years netsec has become a land of incremental innovations, driven mostly by past decisions, regulatory events and exploit publicity dynamics. Every new security category looks a lot like the airline industry as it starts, with more funds going out than coming in. Under those kinds of pressures a few survivors emerge, and fewer yet find exits for their investors.

As IT teams evaluate new technologies they hold them against a higher standard than those already installed. As Andy Kyte said at a recent Gartner keynote covered by Network World:

“We see people putting money into products and solutions that are clearly dying. Instead of investing in them, they should be investing in migrating off of them.” - Andy Kyte quoted in Network World

Most large enterprises have made an attempt to protect themselves from the negative effects of bad decisions by establishing a multitude of committees to approve purchases. They collectively evaluate new technologies, placing more emphasis on analyzing innovations than the value of what they’ve already installed. The result: innovation faces disproportionate scrutiny versus the scrutiny placed on the negative effects of obsolete legacy decisions.

That environment of “selective persecution” puts a substantial burden on anything truly new, while rewarding incremental innovations which are complementary to five or ten years of past product decisions. No wonder Mike has advised repeatedly to go to the midmarket when launching a new netsec product.

Last year I was chatting with my cousin the IT guy, who has spent close to 20 years working for a large IT consulting firm. We were talking about various hot new technologies and he commented: “My frustration is that it takes us about two years to evaluate and deploy a new, innovative product; and that’s if it’s hot.”

That brings me back to Rothman’s hold your breath rant. Taking any new discussion and waving the “it’s two years guys” flag just exacerbates the quick sand mentality. Everyone knows that new markets start slow and the first 50 customers are the hardest; but virtualization is already established and spreading like gangbusters, VMware is openly declaring their intentions to permeate the data center and the cloud, and security is clearly a new challenge for platforms developed within the confines of devtest. The strategic importance of virtsec has indeed drawn a great deal of attention as plans are made.

Virtualization is an opportunity to examine the possibilities of the old and the new and to make network security and IT strategic. As enterprises deploy virtualization-lite as a first step, let’s use this opportunity to rethink what is working and what isn’t, and to plan a more proactive future. Let’s place equal scrutiny on yesterday’s decisions as we do on tomorrow’s innovations.

That is why it is important for people like Hoff and Rothman and others to keep the conversation looking forward, beyond the beer already spilled. It will take innovation on multiple levels to help us get ahead of the game, so let’s not get distracted by the bureaucracy that won’t jump until it’s too late. We’ve seen that story play itself out many times before.

There is also a considerable consensus that the requirements of virtualization security are different than those of fixed physical servers; and that most of the security players, including Cisco, Juniper and Symantec, may not be ready for the demands of elegant hypervisor layer visibility and enforcement.

I think the coming collision between virtualization and security in the data center gives us plenty to talk about. Or we could just sit still and breathe slowly while waiting for someone to hand us a vine.