What risks do application virtualization products pose to enterprise security?

By Michael Cobb | Jan 8, 2009

0 comments

Facebook

LinkedIn

Digg

I'm working for the U.S. Air Force in Europe, and it is deploying multiple virtualization products in its environment; I'm working specifically with application virtualization. Have there been any reviews of application virtualization products (rather than OS virtualization) and the risks they pose to enterprise security?

Phrases that continue to be used with this type of virtualization are "isolation" or "bubble," but I really would like to know if application virtualization truly is an isolated state from risks possibly entering or escaping those 'isolated' environments. Over the past few years, virtualization has really taken off, as it can help an organization's infrastructure to work harder and faster while reducing costs. Some of the benefits of virtualization include saving space, resources and power consumption, providing redundancy and provisioning capabilities, and improving security. The first virtualization techniques that came into the market were those of server virtualization -- one approach being operating system virtualization, where everything is run from a so-called virtualized disk on the network, encapsulating the entire operating system from the hardware.

With operating system virtualization, the whole OS is virtualized, as opposed to specific applications. Although vendors have different types of products, the general principle of application virtualization is to separate application code from the restrictions of individual servers, operating systems and clients to improve portability, manageability and compatibility. A virtualized application is not installed on the hard disk of the machine, but is packaged and run on a virtualization layer, which transparently intercepts all file and registry operations of the virtualized application. The application believes that it is directly interfacing with the operating system and its resources, whereas it is actually encapsulated from them and running in its own virtual space or "bubble."

Since all the required files are available in the bubble for that specific application, these separated virtual spaces ensure that applications cannot conflict with each other. This separation allows superior control over where application data is stored. Data can be located in the corporate data center where it is easier to ensure access policies and regulatory compliance rules are adhered to.

0 comments

Facebook

LinkedIn

Digg