Skip to main content

Compliance challenges while virtualizing

Chris @ Fortisphere writes:

Here are five challenging aspects of IT compliance when dealing with virtualisation:

  1. Discovery and inventory: You can't measure what you can't see (or for that matter, don't even know exists). Determining which virtual machines (VMs) are active, which are abandoned or dormant and what data they are accessing is a fundamental part of defining your scope of compliance and applying the appropriate IT controls. Perhaps of a greater concern is how organisations cope with unapproved or rogue VMs.

  2. Chain of custody: Can you provide an audit trail for critical VMs as they move from development to testing to production? Are only approved changes occurring and are they made by the appropriate personnel? Due to the dynamic and mobile nature of virtualisation, keeping track of where the VMs are, who touched them and what changed is key for audit documentation and a true lifesaver in incident response scenarios.

  3. Separation of critical assets (especially in a hosted environment): How do you know that customer A VMs are properly segregated from customer B VMs? Are low risk, non-critical VMs being hosted on the same box as high risk, mission critical VMs? Add features like VMotion and DRS in plus some modern storage solutions and there is good chance that things are not so cleanly separated. Having the ability to make VMs aware of their risk profile and location is going to be critical as more organisations adopt virtualisation.

  4. Software license violations: Push-button provisioning has become a huge contributor to virtual sprawl and major corporate licensing violations. This one seems simple but take the case of a software development shop. The vendor tools make it quick and easy to build a server for coding or testing purposes but then you can clone it, copy it and move it and before long there are numerous copies of the OS, applications and development tools floating around. Software inventory and metering will have to learn some new tricks in the context of products like VMware's Lab Manager.

  5. Subject Matter Expertise (SME): Virtualization is being rolled out faster than IT audit staff is being trained. IT compliance and audit professionals have just not had the training and time they need to appropriately understand the role virtualization plays in regulatory compliance. This is an area that can be solved but it will take effort from the vendor community working alongside organisations like ISACA, ISSA, IIA and SANS.
Maybe its time to checkup with John at Fortisphere and ask how they've been faring.

More news here


Popular posts from this blog

DeepLearningTrucker Part 1

Avastu Blog is migrating to; 1st Jan 2009 live


I will send out emails personally to those who are using my link(s) on their sites.

Thanks much for your co-operation and hope you enjoy the new site and its cool new features :-)

Not like the site is unlive or something..on the contrary, its beginning to get a lot of attention already. Well most of the work is done, you don't have to worry about anything though:

What won't change

Links/Referrals: I will be redirecting the links (all links which you may have cross-posted) to - so you don't have to do anything in all your posts and links. Although, I would urge however that you do change the permalinks, especially on your blogs etc yourselfThis blog is not going away anywhere but within a few months, I will consider discontinuing its usage. I won't obviously do …

Redhot Future Of IT Part I :Marketing yourself as IT professional

I had promised about the "RedHot IT Future Series" and so we discuss here how you should market yourself EFFECTIVELY as an IT professional in this new (and dangerous) web age! Web is the place where you're a hero today and villain tomorrow. While there are lots of professionals who are active on the web, not all are enjoying a good reputation as they got "personal" with others and got into a cockfight. The passive IT professional has nothing to lose but nothing to gain at all!

I know "marketing" might seem as a greasy term but the idea is to have the truth about you out there. You know you're a good person and your family knows that you're really smart person but the rest of the world doesn't!

So the question is how do I market myself on the web as a true "nouveau IT professional". A guy who companies will be tempted to pick up the phone as say "Hey, we wanna talk with you. Can you fly over to Palo Alto (or Guatemala or Johan…