Recent Posts

Post another title here

by Jake Wilson

Post another title here

by Joe Cool

Post another title here

by Jake Wilson

Recent Forum Topics

This front page section will display the latest half dozen forum posts to encourage click-through to the Community Forum.

Latest Video / Whitepaper, etc.

This front page section could display a video tutorial or an interview with a project leader. Visitors are encouraged to visit the Resources section for more learning materials and reference links.

Recent Polls

This section would display a current poll and a list of past polls.

Main
Wednesday
Jul212010

New Draft Computer Security Document Focuses on Cloud Computing and Virtualization Technology

For Immediate Release: July 21, 2010
Contact: Evelyn Brown 301-975-5661

The National Institute of Standards and Technology (NIST), an agency of the U.S. Commerce Department, has issued draft recommendations for securely configuring and using full virtualization technologies, which, by means of software, duplicate a computer's operating system and its applications on other machines.

Because it helps maximize the use and flexibility of computing resources—multiple operating systems can run simultaneously on the same hardware—full virtualization is considered a key technology for cloud computing, but it introduces new issues for IT security.

The proposed security recommendations are contained in the draft document, NIST Special Publication 800-125, Guide to Security for Full Virtualization Technologies. NIST is requesting public review of the new draft computer security publication and soliciting comments until August 13.

For cloud computing systems in particular, full virtualization can increase operational efficiency because it can optimize computer workloads and adjust the number of servers in use to match demand, thereby conserving energy and information technology resources. The guide describes security concerns associated with full virtualization technologies for server and desktop virtualization and provides recommendations for addressing these concerns.

Karen Scarfone, the publication's primary author, says that most existing recommended security practices also apply in virtual environments.

"The practices described in this document build on and assume the implementation of practices described in other NIST computer security publications," Scarfone says.

The guide is intended for system administrators, security program managers, security engineers and anyone else involved in designing, deploying or maintaining full virtualization technologies. In the draft, NIST recommends for organizations to:

•          Secure all elements of a full virtualization solution and maintain their security;

•          Restrict and protect administrator access to the virtualization solution;

•          Ensure that the hypervisor, the central program that runs the virtual environment, is properly secured; and

•          Carefully plan the security for a full virtualization solution before installing, configuring and deploying it.

The draft of NIST Special Publication 800-125, Guide to Security for Full Virtualization Technologies may be obtained from the NIST Computer Security Resource Center here. Submit comments here with "Comments SP 800-125" in the subject line.