Infotech Lead America: Data security in virtualized environments is neglected by IT organizations, with 48 percent either reporting or suspecting unauthorized access to files on virtualized servers.
According to research conducted by Varonis, a provider of data governance software, at VM World conferences, there is a limited awareness of security matters when it comes to virtualized servers, with 70 percent of respondents having little or no auditing in place on virtual servers.
According to Gartner, there are more than 50 million installed virtual machines (VMs) on servers. In line with this, application servers were virtualized by almost all respondents (87 percent), mainly due to speedier deployment (76 percent) and disaster recovery (74 percent). Those who do not virtualize cite disk storage (37 percent), performance (30 percent) and a lack of advantages (20 percent) as the three main reasons for not doing so.
While almost 60 percent said they were very careful about setting permissions and controlling subsequent updates, a revealing 70 percent, regardless of company size, had implemented little or no auditing — even at the high end of the enterprise space. In fact, 20 percent of enterprises with more than 5,000 employees admitted to having no file logging capabilities in place.
The lack of sufficient security is further highlighted by 48 percent either reporting or suspecting unauthorized access to files on their virtualized servers — putting sensitive company information at risk of being misused, lost or stolen. Surprisingly, even for those who do audit all activity, a significant 68 percent believe there is still unauthorized access.
“We suspect that for IT departments, virtualization may be something of a black box. We have found that, after a workload is virtualized, the actual details of managing file permissions and monitoring access is considered to be automatically ‘taken care of.’ It is also quite possible that the teams managing virtualization projects see file security and governance as outside their discipline. The security team may have no visibility of what is happening,” said David Gibson, VP of Strategy at Varonis.
Varonis suggest that data protection requires the same level of vigilance in a virtual environment. For organizations to stay on top of their digital assets it is vital to further IT education in this area, both in terms of training staff in understanding virtual file systems, as well as in effectively using automation to uncover security holes, monitor activity, and control permissions.
