Embracing Virtualization : Opportunities And Threats To Information Security

Today, virtualization offers significant opportunities in terms of cutting infrastructure and maintenance costs. For this reason, it is not surprising that a large number of businesses are making the switch to these technologies, and especially cloud computing, which is often cited as a promising technology.

Yet, application hosting on an outside cloud computing service is coupled with risk. First of all, there are the risks tied to any kind of external application hosting, which can threaten not only the availability of the applications but also the confidentiality and integrity of the data being manipulated. Although this risk is not fundamentally different from traditional service provider risks, specific aspects of cloud computing, such as the geographic location of virtual machines able to move between data centers, and the resulting legal risks, must be considered.

At present, even though cybercriminals do not perceive Cloud computing as revolutionary, some have attempted to host certain malicious operations (including spam, intrusion attempts, and malware) on widely used clouds, such as Amazon EC2. These new architectures, which draw on the pooling of public IP addresses between several VMs, are problematic for security systems that are based on IP reputation analysis.

The major advantage to desktop virtualization is the fact that the information leak risk, as a result of IT equipment being lost or stolen, is almost entirely eliminated. However, these technologies require IS penetration detection systems to be totally reconsidered.

Our recommendation to banks having opted for virtualization of all or part of their IS is to examine the applications to be virtualized on a case by case basis, in order to size resources and study the specific risks. Service providers must meet strict service level requirements and, in so far as possible, be subject to routine audits.

Please Note: the instant online delivery is a Global License.