eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Among the wonders of virtualization, Dennis Hoffman is impressed by the ability to move a virtual machine from one system to another without interrupting its operation.
“It’s a communication of a system, a complete system state, a running machine,” Hoffman, the vice president and general manager of the data security group and chief strategy officer at EMC’s RSA division, recently told eWEEK. “[You] not only have the data, you’ve got the entire application set, the entire operating system, you’ve got everything.
“It becomes possible with virtualization not to steal [just] data, you can steal machines over the wire.”
And therein lies a new business opportunity for Hoffman and his team. As companies increase virtualization, new security gaps emerge that RSA is eager to plug – particularly with VMware, also owned by EMC, leading the way in the virtualization market.
He spoke about those opportunities and threats as well as the new direction of RSA products in an exclusive interview with eWEEK’s Brian Prince. Here is an edited transcription of the conversation.
Where do you see an opportunity for EMC in virtualization security?
Looking at it from the product side, the idea is relatively simple. Virtualization of the endpoint represents an opportunity to redefine the security of the endpoint.
If you think about if you had very strong control over the endpoint, in terms of the ability to sandbox one environment from another, you have the ability to solve a number of security challenges that way. So we’re of course going to partner with virtualization companies, and by that I mean everybody from Citrix (Systems) to Microsoft and of course VMware.
There is a lot of opportunity to redefine the way desktop security and to some extent data-centric security is done by using virtualization. The other dimension of course to the question is at one level a virtual machine is nothing more and nothing less than a container. As such, it needs to be a secure container, so we will look to work to use our technologies that we use to secure EMC products to help secure virtualization products.
I’ll give you a very simple example. One of the neat things that you can do with a virtual machine is you can actually move it from one system to another without interrupting its operation.
VMware for example calls this VMotion. I know VMware is incredibly focused on continuing to lead the industry on the security of virtual machines, the container.
So at RSA we’ve really got two plays. One is the question of using our technology to help people that make virtual machines make more secure ones, and the other dimension is the opportunity to really redefine elements of the security stack because of virtualization.
Working with Other Companies
Specifically, how do you see RSA bringing its products to bear when you work with companies such as VMware and Citrix?
Same basic things we do now. There’s been four dimensions to the way we solve security problems that are very information-centric.
The first thing we do is we manage the security of access, by managing identity, so bringing SecurID and One-Time password technology to the remote use of a virtual machine. There’s the security of the virtual machine itself, where we have a set of technologies, everything from role-based access control to technologies for better logging and auditing of the virtual machine environment.
On the image itself, there’s the whole issue of encryption. It’s all software so it becomes feasible to actually encrypt an entire machine, as well as to use our technologies to encrypt that conversation between points. All that encryption requires management of keys, with the number of virtual machines most companies are managing, the more they start to extend this to the desktop the more you have a key management problem, which is an opportunity for RSA’s key management suite.
A very fascinating opportunity within the whole data loss space, I mean a virtual machine actually has every, it has the actual memory registers of the information, it has more detail on the data at hand than an application does. So while this is I think certainly something for the future, there’s an opportunity to use that knowledge to do more-deep data inspection to help with the issue of loss prevention.
And then finally there’s the whole making sure its all secure. How you collect information from the machines, understand whether or not they are conforming to policy, use that information to prove compliance. So same basic thing-secure the gear, the data, secure the access through the people and then prove compliance through security information and event management.
Looking ahead to this year, what does RSA see for itself in the security market?
I guess at the highest level, one of the themes that we’ve been talking about a lot internally is that…it’s very clear at this point that we are in a new era of information security, and the old guard is no longer viewed really in security as security leaders.
A lot of what’s happening in the marketplace today is confusion and concern-and in some cases fear-people have over securing their information, over truly, fundamentally protecting their data.
It’s a new era. It’s all about securing the data, not so much about anti-virus and anti-malware.
For us the question is who’s going to emerge as the leader of this new security world, and why not us? Why wouldn’t RSA, as a division of EMC be capable of reaching for and establishing our presence, if not at the very top, in the top three of security companies worldwide because it’s become a lot more about the things we do.