Research by Varonis, a provider of data governance software, found that data security in virtualised environments is often neglected by IT organisations, with near half (48 per cent) either reporting or suspecting unauthorised access to files on virtualised servers. The study, at VM World conferences suggests that there is a limited awareness of security matters when it comes to virtualised servers, with 70pc of respondents having little or no auditing in place on virtual servers.
Application servers were virtualised by almost all respondents (87pc), mainly due to speedier deployment (76pc) and disaster recovery (74pc). On the other hand, those who do not virtualise cite disk storage (37pc), performance (30pc) and a lack of advantages (20pc) as the three main reasons for not doing so.
Across company sizes, one area that appears to be neglected by organisations is file security. While almost 60pc said they were very careful about setting permissions and controlling subsequent updates, a revealing 70pc, regardless of company size, had implemented little or no auditing – even at the high end of the enterprise space. In fact, 20pc of enterprises with more than 5,000 employees admitted to having no file logging capabilities in place.
The lack of sufficient security is further highlighted by 48pc either reporting or suspecting unauthorised access to files on their virtualised servers – putting sensitive company information at risk of being misused, lost or stolen. Surprisingly, even for those who do audit all activity, 68 per cent believe there is still unauthorised access.
David Gibson, VP of Strategy at Varonis, said: “We suspect that for IT departments, virtualisation may be something of a black box. We have found that, after a workload is virtualised, the actual details of managing file permissions and monitoring access is considered to be automatically ‘taken care of’. It is also quite possible that the teams managing virtualisation projects see file security and governance as outside their discipline. The security team may have no visibility of what is happening.”
The results suggest that, while virtualisation has been groundbreaking in allowing IT to isolate applications and services with a few clicks, it doesn’t solve permissions management and access auditing – in fact it might make it even more complex. Gibson said: “Data protection, obviously, requires the same level of vigilance in a virtual environment – and perhaps even more so given the complexities of managing multiple operating systems on a single computing box. For organisations to stay on top of their digital assets it is vital to further IT education in this area, both in terms of training staff in understanding virtual file systems, as well as in effectively using automation to uncover security holes, monitor activity, and control permissions.”
To download the full virtualisation research report, visit http://hub.varonis.com/virtualization-report
