<?xml version="1.0" encoding="utf-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
  <channel>
    <title><![CDATA[[SecurityRatty] tag: vmware]]></title>
    <link>http://securityratty.com/tag/vmware</link>
    <description></description>
    <pubDate>Mon, 15 Sep 2008 20:00:00 +0000</pubDate>
    <generator>iRatty Engine</generator>
    <docs>http://blogs.law.harvard.edu/tech/rss</docs>
    <item>
      <title><![CDATA[Commoditization of Anti Debugging Features in RATs - Part Two]]></title>
      <link>http://securityratty.com/article/0e4dba3738885b768d69cdefd3956f41</link>
      <guid>http://securityratty.com/article/0e4dba3738885b768d69cdefd3956f41</guid>
      <description><![CDATA[Yet another piece of malware promoted as a RAT (remote access tool) includes what's turning into the defacto set of anti-debugging features within RATs

As the authors point out, the Anti Virtual PC,...]]></description>
      <content:encoded><![CDATA[<div style="text-align: left;"></div><div class="separator" style="clear: both; text-align: center;"></div><a href="http://4.bp.blogspot.com/_wICHhTiQmrA/SO0Yx0zlTHI/AAAAAAAACRA/WI5KeS8KdX8/s1600-h/anti-debugging_DIY_builder.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" src="http://4.bp.blogspot.com/_wICHhTiQmrA/SO0Yx0zlTHI/AAAAAAAACRA/J9YN_209tN0/s200-R/anti-debugging_DIY_builder.jpg" /></a>Yet another piece of <a href="http://ddanchev.blogspot.com/2008/09/commercialization-of-anti-debugging.html">malware promoted as a RAT</a> (remote access tool) includes what's turning into the defacto <a href="http://ddanchev.blogspot.com/2008/09/commoditization-of-anti-debugging.html">set of anti-debugging features within RATs</a>.<br />
<br />
As the authors point out, the Anti Virtual PC, VMware, Virtualbox, Sandboxie, ThreatExpert, Anubis, CWSandbox, Joebox, Norman Sandbox features inevitably increase the server size. Next to the product, there's always the managed service of ensuring a lower detection rate for binaries submitted to the authors.<div class="feedflare">
<a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=KP7cM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=KP7cM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=S4IyM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=S4IyM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=JiDYm"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=JiDYm" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=TIfom"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=TIfom" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=cYnhM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=cYnhM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=1q9WM"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=1q9WM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?a=IpBLm"><img src="http://feeds.feedburner.com/~f/DanchoDanchevOnSecurityAndNewMedia?i=IpBLm" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~4/415607441" height="1" width="1"/>]]></content:encoded>
      <pubDate>Thu, 09 Oct 2008 00:00:40 +0000</pubDate>
      <category domain="http://securityratty.com/tag/remote access tool">remote access tool</category>
      <category domain="http://securityratty.com/tag/anti virtual">anti virtual</category>
      <category domain="http://securityratty.com/tag/authors">authors</category>
      <category domain="http://securityratty.com/tag/features">features</category>
      <category domain="http://securityratty.com/tag/defacto set">defacto set</category>
      <category domain="http://securityratty.com/tag/lower detection">lower detection</category>
      <category domain="http://securityratty.com/tag/rats">rats</category>
      <category domain="http://securityratty.com/tag/piece">piece</category>
      <category domain="http://securityratty.com/tag/sandboxie">sandboxie</category>
      <source url="http://feeds.feedburner.com/~r/DanchoDanchevOnSecurityAndNewMedia/~3/415607441/commoditization-of-anti-debugging.html">Commoditization of Anti Debugging Features in RATs - Part Two</source>
    </item>
    <item>
      <title><![CDATA[Security + Logging + Virtualization Podcast]]></title>
      <link>http://securityratty.com/article/3ef5ee6b581fa908366fdbdec8f17d6a</link>
      <guid>http://securityratty.com/article/3ef5ee6b581fa908366fdbdec8f17d6a</guid>
      <description><![CDATA[Here is a fun podcast a bunch of us (yes, including Chris , of course! ) did on security, logging and virtualization ( audio , full transcript

It is actually a fun read / listen , if you are into...]]></description>
      <content:encoded><![CDATA[<a href="http://briefingsdirect.blogspot.com/2008/09/virtualization-use-requires-improved.html">Here</a> is a fun podcast a bunch of us (yes, including <a href="http://rationalsecurity.typepad.com/blog/">Chris</a>, <span style="font-style: italic;">of course!</span>)  did on security, logging and virtualization (<a href="http://media.libsyn.com/media/interarbor/BriefingsDirect_LogLogic_Podcast_2.mp3">audio</a>,<a href="http://briefingsdirect.blogspot.com/2008/09/virtualization-use-requires-improved.html"> full transcript</a>).<br /><br />It is actually a fun <a href="http://briefingsdirect.blogspot.com/2008/09/virtualization-use-requires-improved.html">read </a>/ <a href="http://media.libsyn.com/media/interarbor/BriefingsDirect_LogLogic_Podcast_2.mp3">listen</a>, if you are into either/all of these three :-)<br /><br />Here is the brief blurb on that from the<a href="http://briefingsdirect.blogspot.com"> podcaster site</a>: "To help learn about new ways that systems log tools and analysis are aiding the ramp-up to virtualization use, I [<a href="http://briefingsdirectblog.blogspot.com/2008/09/improved-insights-and-analysis-from-it.html">Dana Gardner</a>] recently spoke with <a href="http://www.linkedin.com/in/charu">Charu Chaubal</a>, senior architect for technical marketing, at <a href="http://www.vmware.com/">VMware</a>; <a href="http://www.linkedin.com/in/choff">Chris Hoff</a>, chief security architect at <a href="http://www.unisys.com/">Unisys</a>, and <a href="http://www.chuvakin.org/">Dr. Anton Chuvakin</a>, chief logging evangelist and a <a href="http://en.wikipedia.org/wiki/Anton_Chuvakin">security expert</a> at <a href="http://www.loglogic.com/">LogLogic</a>."<div class="blogger-post-footer">About me: http://www.chuvakin.org</div><div class="feedflare">
<a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=n88xM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=n88xM" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=OlK9M"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=OlK9M" border="0"></img></a> <a href="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?a=tCDWM"><img src="http://feeds.feedburner.com/~f/AntonChuvakinPersonalBlog?i=tCDWM" border="0"></img></a>
</div><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/408598332" height="1" width="1"/>]]></content:encoded>
      <pubDate>Wed, 01 Oct 2008 09:36:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/security expert">security expert</category>
      <category domain="http://securityratty.com/tag/chief security architect">chief security architect</category>
      <category domain="http://securityratty.com/tag/virtualization">virtualization</category>
      <category domain="http://securityratty.com/tag/chief">chief</category>
      <category domain="http://securityratty.com/tag/anton chuvakin">anton chuvakin</category>
      <category domain="http://securityratty.com/tag/fun">fun</category>
      <category domain="http://securityratty.com/tag/chris hoff">chris hoff</category>
      <category domain="http://securityratty.com/tag/chuvakin">chuvakin</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/408598332/security-logging-virtualization-podcast.html">Security + Logging + Virtualization Podcast</source>
    </item>
    <item>
      <title><![CDATA[Links List 9.29.08]]></title>
      <link>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</link>
      <guid>http://securityratty.com/article/48fee769715c390d500bbc1e0ea43623</guid>
      <description><![CDATA[Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work...]]></description>
      <content:encoded><![CDATA[<p><img style="border-right: 0px; border-top: 0px; margin: 5px; border-left: 0px; border-bottom: 0px" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/oracle.jpg" border="0" alt="oracle" width="240" height="164" align="left" /> Trade shows, trade shows and more trade shows. VMworld and Interop dominated the stage a couple of weeks ago and then there was the annual Oracle blowout in SF last week. Has anyone gotten any work done lately?? <em>(</em><a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank"><em>image from cdye1</em></a><em>)</em></p>
<p>Does <a href="http://sfcitizen.com/blog/2008/09/24/its-oracles-world-were-just-living-in-it/" target="_blank">Oracle run the world</a>? I would have to say no but Raj (Larry Ellison is his idol) and the 40,000 Oracle customers that descended upon SF last week might beg to differ. What do James Carville and Mary Matalin have to do with enterprise software? Pretty much nothing, except for the fact that they delivered the opening keynote for <a href="http://www.oracle.com/openworld/2008/index.html" target="_blank">Oracle OpenWorld</a>. (And that’s the only and last politically-oriented thing you’ll hear from me as we run up to the election). For a surprisingly funny and extensive photo gallery of the eye-popping event, check out <a href="http://flickr.com/photos/cdye/sets/72157607458101608/" target="_blank">cdye1’s photostream</a> on Flickr.</p>
<p>But UB40, Elvis Costello and Seal aside, Oracle OpenWorld did offer training, certifications, and always entertaining speeches by Ellison. Ben Worthen’s favorite – “<a href="http://blogs.wsj.com/biztech/2008/09/25/larry-ellisons-brilliant-anti-cloud-computing-rant/?mod=djemTECH" target="_blank">Larry Ellison’s Brilliant Anti-Cloud Computing Rant</a>” delivered to analysts on Thursday. From Ben’s slightly-edited excerpt:</p>
<p>“The interesting thing about cloud computing is that we’ve redefined cloud computing to include everything that we already do. I can’t think of anything that isn’t cloud computing with all of these announcements. The computer industry is the only industry that is more fashion-driven than women’s fashion. Maybe I’m an idiot, but I have no idea what anyone is talking about. What is it? It’s complete gibberish. It’s insane. When is this idiocy going to stop?</p>
<p>“We’ll make cloud computing announcements. I’m not going to fight this thing. But I don’t understand what we would do differently in the light of cloud computing other than change the wording of some of our ads. That’s my view.”</p>
<p>So did everyone catch that? Cloud computing is complete gibberish and idiocy, but apparently Oracle’s already been doing enough around it to advertise the fact. I will have my cake and eat it too!</p>
<p>We’ve been pumping out the posts from the shows we went to – let me tell you, live-blogging is hard when you’re trying to share apparently miniscule amounts of bandwidth with 14,000 other attendees – and we have even more to share as we step back, contemplate and describe how some of the announcements, info and especially roadmaps fit into our overall picture over here at ScienceLogic.</p>
<p>For example, we released the results of our annual industry IT survey last week. Twice a year – at FOSE (for Government IT) and at Interop NY (for enterprises) – we take advantage of the fact that we have a big beautiful booth at these shows and offer a fabulous ScienceLogic t-shirt in return for a couple of minutes time with attendees living the <a href="http://blog.sciencelogic.com/why-we-l-o-v-e-tradeshows/03/2008" target="_blank">problems we try to solve</a>. Instead of telling people what their problems and priorities are, we like to ask.<br />
<a href="http://blog.sciencelogic.com/interop-ny-survey-top-it-challenges-trends-and-what-it-is-spending-money-on/09/2008?" target="_blank">Interop NY Survey - Trends and Challenges</a><br />
<a href="http://www.sciencelogic.com/pressrelease_20080925.htm" target="_blank">Detailed Reports on Trends and Comparison to Government IT</a></p>
<p>And I just had to share this one because it is so bizarre. Are VMware and Paul Maritz guilty of <a href="http://it20.info/blogs/main/archive/2008/09/21/143.aspx" target="_blank">plagiarism</a>? You have to check this out to get even part of the picture. Apparently this guy has posted his slides (we know they are from VMworld 2007 because it says so in the lower-right-hand corner…) which prove that the “virtual datacenter operating system” idea was his idea a year before it showed up on Maritz’s keynote this year. Hmmm. And then after posting all these slides and making all the connections between his presentation and Maritz’s, he says he’s just kidding about the plagiarism. Can anyone sort this out and let me know?</p>
<p>I’ll tell you who wasn’t kidding when I went by their booth at VMworld – a certain chargeback vendor and VMware “partner” who was quite shocked two months ago when they walked into a meeting with VMware about future roadmap. Apparently, the slides they saw (preview of VMware’s announcement re adding extended chargeback capability within vCenter management services) were mighty might similar to slides they had given in a presentation to VMware about their own roadmap. Coincidence? I’ll let you decide. And I’ll also say, their strategy to combat this – support for Hyper-V coming early in 2009.</p>
]]></content:encoded>
      <pubDate>Mon, 29 Sep 2008 23:00:14 +0000</pubDate>
      <category domain="http://securityratty.com/tag/oracle openworld">oracle openworld</category>
      <category domain="http://securityratty.com/tag/oracle">oracle</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/annual oracle blowout">annual oracle blowout</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/vmware partner">vmware partner</category>
      <category domain="http://securityratty.com/tag/industry">industry</category>
      <category domain="http://securityratty.com/tag/annual industry">annual industry</category>
      <category domain="http://securityratty.com/tag/apparently oracles">apparently oracles</category>
      <source url="http://blog.sciencelogic.com/links-list-92908/09/2008">Links List 9.29.08</source>
    </item>
    <item>
      <title><![CDATA[IDS/IPS - is it Vitamins?]]></title>
      <link>http://securityratty.com/article/31be078399943afc01f74f3be65a1699</link>
      <guid>http://securityratty.com/article/31be078399943afc01f74f3be65a1699</guid>
      <description><![CDATA[Alan Shimel's post on &quot; IDS - the beast that just won't die &quot; triggered my hidden thoughts about IDS
Rather than thinking about IDS as a piece of device/software that provides fancy features. Let me...]]></description>
      <content:encoded><![CDATA[<P>Alan Shimel's post on&nbsp; "<A href="http://www.stillsecureafteralltheseyears.com/ashimmy/idsips/index.html">IDS - the beast that just won't die</A>" triggered my hidden thoughts about IDS.</P>
<P>Rather than thinking about IDS as a piece of device/software that provides fancy features. Let me try to summarize some assertions about&nbsp;IDS:&nbsp;</P>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<P>IDS can capture&nbsp;tons of intrusion&nbsp;events, there is so much of don't care events it is difficult&nbsp;to single out event such as zero day event in the midst of such noise. </P>
<P>It requires tremendous effort to sift through the log and derive meaningful actions out of the log entries.</P>
<P>IDS needs a dedicated&nbsp;administrator to manage.&nbsp;An administrator&nbsp;who won't get bored of looking at all the packets and patterns, a truly boring job for a security engineer. Probably this job would interest a geekier person and&nbsp;geeks tend to their own interesting research!</P>
<P>There are companies that do without IDS, and they do just fine. I agree with Alan's assessment that IDS is like&nbsp;a Checkbox in most cases.&nbsp; Business can run without IDS just fine, why invest in such a technology?</P>
<P>Firewalls and other devices have built in features of IDS, so why invest in a separate product.</P>
<P>IDS is like Vitamins, nice to have, not having won't kill you in most cases. Customers are willing to pay for Pain Killers because they have to address their pain right away. For Vitamins, they can wait. Stop and think for moment, without Anti-virus&nbsp;product,&nbsp;businesses can't run for few days. But, without IDS, most&nbsp;businesses can run just fine and I base it out of my own experience.</P>
<P>Probably, I would have offended folks from the IDS camp. I have a good friend who is a founder of an IDS&nbsp;company, I am sure he will react differently if he reads my narratives about IDS.&nbsp;&nbsp;Once businesses start realizing that&nbsp;IDS is&nbsp;a Checkbox, they will scale down their investments in this area. In the current economic climate, financial institutions are not doing well. Financial&nbsp;institutions are big&nbsp;customers in terms of security products, with the current scenario of financial meltdown, they would scale down heavily on their spending on Vitamins. </P>
<P>Running IDS software on VMware sounds fancy.&nbsp;&nbsp;Technology does not matter unless you can address real world pain and prove the&nbsp;utilitarian value of such a technology. I am really surprised that&nbsp;IDS continues to exist. Proof&nbsp;of existence does not forebode&nbsp;great future. Running IDS on VMware does not make it any more utilitarian.&nbsp;I see a bleak future for IDS.</P></BLOCKQUOTE>]]></content:encoded>
      <pubDate>Wed, 24 Sep 2008 14:35:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/ids">ids</category>
      <category domain="http://securityratty.com/tag/ids camp">ids camp</category>
      <category domain="http://securityratty.com/tag/ids continues">ids continues</category>
      <category domain="http://securityratty.com/tag/ids company">ids company</category>
      <category domain="http://securityratty.com/tag/ids software">ids software</category>
      <category domain="http://securityratty.com/tag/vitamins">vitamins</category>
      <category domain="http://securityratty.com/tag/businesses">businesses</category>
      <category domain="http://securityratty.com/tag/financial institutions">financial institutions</category>
      <category domain="http://securityratty.com/tag/vmware sounds fancy">vmware sounds fancy</category>
      <source url="http://ravichar.blogharbor.com/blog/_archives/2008/9/24/3899861.html">IDS/IPS - is it Vitamins?</source>
    </item>
    <item>
      <title><![CDATA[Links for 2008-09-23 [del.icio.us]]]></title>
      <link>http://securityratty.com/article/2af80556b9f0e7dd51df3553792d655a</link>
      <guid>http://securityratty.com/article/2af80556b9f0e7dd51df3553792d655a</guid>
      <description><![CDATA[Rational Survivability: VMWare's VirtSec Vision...Virtual Validation
Security and Risk Management Strategies Blog: PCI V1.2, a good start but still not enough Monitoring and audit while the PCI DSS...]]></description>
      <content:encoded><![CDATA[<ul>
<li><a href="http://rationalsecurity.typepad.com/blog/2008/09/vmwares-virtsec-visionvirtual-validation.html">Rational Survivability: VMWare's VirtSec Vision...Virtual Validation?</a></li>
<li><a href="http://srmsblog.burtongroup.com/2008/09/pci-v12-a-good.html">Security and Risk Management Strategies Blog: PCI V1.2, a good start but still not enough</a><br/>
Monitoring and audit – while the PCI DSS recommends minimum timeframes for scanning, doing pen tests, etc. what are the real levels of monitoring and audit needed for ensuring security?  With the Hannaford and Okemo breaches that occurred (both where PCI compliant), neither discovered the problem until months after the breaches had happened.  So identifying what should be scanned and tested and if some of this should be on a continuous basis still requires refinement.</li>
<li><a href="http://www.computerweekly.com/blogs/stuart_king/2008/09/i-was-supposed-to-be.html">PCI Compliance - dispelling some common myths (Stuart King's Security and Risk Management Blog)</a></li>
</ul><img src="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~4/401466847" height="1" width="1"/>]]></content:encoded>
      <pubDate>Tue, 23 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/pci compliant">pci compliant</category>
      <category domain="http://securityratty.com/tag/pci">pci</category>
      <category domain="http://securityratty.com/tag/pci compliance">pci compliance</category>
      <category domain="http://securityratty.com/tag/risk management blog">risk management blog</category>
      <category domain="http://securityratty.com/tag/breaches">breaches</category>
      <category domain="http://securityratty.com/tag/okemo breaches">okemo breaches</category>
      <category domain="http://securityratty.com/tag/security">security</category>
      <category domain="http://securityratty.com/tag/continuous basis">continuous basis</category>
      <category domain="http://securityratty.com/tag/virtsec vision">virtsec vision</category>
      <source url="http://feeds.feedburner.com/~r/AntonChuvakinPersonalBlog/~3/401466847/anton18">Links for 2008-09-23 [del.icio.us]</source>
    </item>
    <item>
      <title><![CDATA[Interop NY: Hypervisor Quick Poll]]></title>
      <link>http://securityratty.com/article/5f4e1b85bcb4d172e0ed7994ef95ea8e</link>
      <guid>http://securityratty.com/article/5f4e1b85bcb4d172e0ed7994ef95ea8e</guid>
      <description><![CDATA[On the final day of Interop NY 2008 , we conducted a second quick poll of attendees ( check out the first poll on virtualization here ), asking which hypervisors were currently in use. In asking the...]]></description>
      <content:encoded><![CDATA[<p><b><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; margin: 0px 10px 10px 0px; border-right-width: 0px" height="99" alt="clip_image002" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/clip-image002.gif" width="91" align="left" border="0"></b>On the final day of <a href="http://www.interop.com/">Interop NY 2008</a>, we conducted a second quick poll of attendees (<a href="http://blog.sciencelogic.com/interop-ny-virtualization-quick-poll/09/2008">check out the first poll on virtualization here</a>), asking which hypervisors were currently in use. In asking the question, we had certain assumptions – mainly that most people were currently using VMware – and that the real question here was to gauge how quickly Microsoft Hyper-V adoption was coming along. The results both confirmed what we thought and surprised us.
<p><b>The Results: </b>
<p><b><i>Which hypervisor(s) are you currently using?</i></b><i></i>
<ul>
<li><b>72%</b> VMware </li>
<li><b>17%</b> Using something else </li>
<li><b>9%</b> Hyper-V and VMware </li>
<li><b>2%</b> Hyper-V </li>
</ul>
<p>(based on 46 responses)
<p>So the VMware responses were in line with what we thought, although I’ve seen numbers up to 90% share of the market. And about 10% are at least playing with Hyper-V – pretty good numbers just a few months out from launch. But look at 17% using a hypervisor other than Hyper-V and VMware!
<p>We know from talking with people that several brought up Xen. I have to tell you that other than from media and analysts, we never hear about Xen (Citrix), which is why we didn’t include it in the survey as a specific selection. Perhaps it took the introduction of Hyper-V, with the attendant marketing juggernaut, to break people of the VMware-only habit. Xen couldn’t really carry that “heterogeneous” hypervisor environment message on its own, but now that Hyper-V is available, the genie’s out of the bottle. Bears watching.
<p>On another note: We were more successful in hanging onto our marbles on day two – people seemed more in tune to the poll and less focused on collecting giveaways than on day one! [Note: no attendees were <a href="http://blog.sciencelogic.com/interop-ny-virtualization-quick-poll/09/2008">irrevocably harmed</a> during the execution of the polls. :)] At Interop Vegas, May 17 – 19, 2009, we’ll be about a year out from Microsoft launching Hyper-V and will make sure to ask the same question then to track changes in hypervisor adoption.</p>
]]></content:encoded>
      <pubDate>Mon, 22 Sep 2008 14:30:46 +0000</pubDate>
      <category domain="http://securityratty.com/tag/vmware-only habit">vmware-only habit</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/quick poll">quick poll</category>
      <category domain="http://securityratty.com/tag/hypervisor">hypervisor</category>
      <category domain="http://securityratty.com/tag/poll">poll</category>
      <category domain="http://securityratty.com/tag/hyper-v">hyper-v</category>
      <category domain="http://securityratty.com/tag/hyper-v pretty">hyper-v pretty</category>
      <category domain="http://securityratty.com/tag/vmware responses">vmware responses</category>
      <category domain="http://securityratty.com/tag/interop">interop</category>
      <source url="http://blog.sciencelogic.com/interop-ny-hypervisor-quick-poll/09/2008">Interop NY: Hypervisor Quick Poll</source>
    </item>
    <item>
      <title><![CDATA[People a big security threat to virtualization, Interop speaker says]]></title>
      <link>http://securityratty.com/article/055eb72ccdba8ce78e26264263df0853</link>
      <guid>http://securityratty.com/article/055eb72ccdba8ce78e26264263df0853</guid>
      <description><![CDATA[While VMware this week is holding its own VMworld party in Las Vegas, 2,200 miles away, attendees at Interop New York were told about the potential security risks of virtual environments, not the...]]></description>
      <content:encoded><![CDATA[While VMware this week is holding its own VMworld party in Las Vegas, 2,200 miles away, attendees at Interop New York were told about the potential security risks of virtual environments, not the least of which are people.]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/potential security risks">potential security risks</category>
      <category domain="http://securityratty.com/tag/vmworld party">vmworld party</category>
      <category domain="http://securityratty.com/tag/las vegas">las vegas</category>
      <category domain="http://securityratty.com/tag/people">people</category>
      <category domain="http://securityratty.com/tag/interop">interop</category>
      <category domain="http://securityratty.com/tag/virtual environments">virtual environments</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/attendees">attendees</category>
      <category domain="http://securityratty.com/tag/week">week</category>
      <source url="http://www.networkworld.com/news/2008/091808-interop-people-security-threat.html?fsrc=rss-security">People a big security threat to virtualization, Interop speaker says</source>
    </item>
    <item>
      <title><![CDATA[VMworld 2008 Keynote with Paul Maritz]]></title>
      <link>http://securityratty.com/article/27088f9fffd4d9e8619b6768dd0513fa</link>
      <guid>http://securityratty.com/article/27088f9fffd4d9e8619b6768dd0513fa</guid>
      <description><![CDATA[Traveling towards VMworld 2008
I, along with thousands of others, wended my way through a vast dimly lit cavern of a place helped along by the strangely surreal sight of ushers in black waving wispy...]]></description>
      <content:encoded><![CDATA[<p><em><img style="border-top-width: 0px; border-left-width: 0px; border-bottom-width: 0px; margin: 5px; border-right-width: 0px" height="160" alt="paulmaritzvmware" src="http://blog.sciencelogic.com/wp-content/uploads/2008/09/paulmaritzvmware.jpg" width="240" align="left" border="0" /> Traveling towards VMworld 2008</em></p>
<p>I, along with thousands of others, wended my way through a vast dimly lit cavern of a place helped along by the strangely surreal sight of ushers in black waving wispy red flags to guide us not to the empty seats in front of us, but to the ones 50 yards on. (Ah Vegas, my feet hurt already.) Perhaps the point was to live in the moment, soak in the pre-rock concert atmosphere complete with a hip and cool soundtrack ripped off from Apple commercials. (Do they all use the same ad firm?) A better way to build the anticipation for, yes, the kickoff keynote session at <a href="http://www.vmworld.com/conferences/2008/" target="_blank">VMworld 2008</a>. (<em><a href="http://www.flickr.com/photos/jumpingshark/2862470725/" target="_blank">photo credit: lodev</a>)</em></p>
<p>To the sounds of <a href="http://www.youtube.com/watch?v=PEinqCHPY08" target="_blank">Hey Ya</a> (Shake it like a Polaroid picture), we shifted forward in our uncomfortable temporary seating placed, as at all tech conferences, too close for all but the skinny girls. The moment was here &#8211; one of those videos started playing on the dozen or so huge monitors floating above the convention crowd. You know this video; you&#8217;ve probably seen it before from HP or someone like that. One of those videos with instrumental Coldplay music in the background with time <a href="http://www.hp.com/hpinfo/newsroom/hpads/" target="_blank">lapse/speeded-up video</a> of people in motion and floating captions dropping into the images that leave you with a slight smile on your face as you &#8220;get&#8221; the relationship between image and text. (Do they all use the same ad firm?)</p>
<p>And here he is, announced like a Vegas headliner, <a href="http://vmblog.com/archive/2008/07/23/forbes-interviews-vmware-ceo-paul-maritz-after-financial-analyst-call.aspx" target="_blank">Paul Maritz, the new CEO of VMware</a>. Hmm. After all that hype, I rather expected someone in a black turtleneck and jeans to come out. Instead here&#8217;s this guy with pleat-front pants and an admittedly cool accent (New Zealand?) who looks a little like Al from Home Improvement. Not that there&#8217;s anything wrong with that &#8211; everyone likes Al.</p>
<p><em>And then the real fun begins.</em></p>
<ul>
<li>30 years ago, Paul Maritz started off his business career as a developer </li>
<li>10 years ago, VMware was founded by <a href="http://blog.sciencelogic.com/diane-greene-ousted-from-vmware/07/2008" target="_blank">Diane</a> <a href="http://virtualization.com/news/2008/07/08/diane-greene-vmware-paul-maritz/" target="_blank">Greene</a> and <a href="http://www.cio-weblog.com/50226711/found_rosenblum_leaves_vmware.php" target="_blank">Mendel</a> <a href="http://blog.sciencelogic.com/another-vmware-founder-leaves/09/2008" target="_blank">Rosenblum</a> (BTW, 10 seconds spent showing a slide with cartoon-ized images of the founders, &#8220;thanks for what you did for the company for the past 10 years&#8221;. 10 seconds after 10 years&#8230;but maybe more would have been hypocritical&#8230;) </li>
<li>a retrospective of centralized vs. decentralized computing initiatives from the 1960&#8217;s to today </li>
<li>of course VMware milestones from 1998 to today </li>
<li>and then an analyst-ready diagram showing the product roadmap (to be delivered in 2009) with, you guessed it, finally a connection between <a href="http://advice.cio.com/laurianne_mclaughlin/vmworld_ceo_maritz_outlines_broad_plans_for_cloud_and_client" target="_blank">VMware and cloud computing</a> (remember Maritz&#8217;s cloud-computing company was bought by EMC just a couple of years ago and that&#8217;s the section he headed up at EMC before being brought into VMware). </li>
</ul>
<p><em>Forward Looking</em></p>
<p>2008 (and probably much of 2009) will be a very busy year for VMware. If you believe the roadmap, <a href="http://www.uberpulse.com/us/2008/09/vmwares_ambitious_expansion_plan.php" target="_blank">VMware seems to be taking on the management of everything</a> &#8211; from chargeback and capacity planning to virtual storage and virtual networking (more to come on just what the planned vStorage and vNetwork will deliver) &#8211; but all of it VMware-centric. As <a href="http://blog.sciencelogic.com/vmware-is-better-than-microsoft/09/2008" target="_blank">we said in an earlier post,</a> they&#8217;ve moved away from &#8220;defending&#8221; the hypervisor business proposition to focusing on management services on top of their own hypervisor platform. Revenue pressures must be excruciating &#8211; who wants to be a public company these days?</p>
<p>The best part of that new &#8220;Virtual Data Center Operating System&#8221; <a href="http://www.vmware.com/technology/virtual-datacenter-os/" target="_blank">diagram/roadmap</a> was the addition (and I mean addition) of something called <a href="http://vmetc.com/2008/09/16/vmwares-vcloud-iniatives-the-vision-for-the-next-10-years/" target="_blank">Cloud vServices</a>. (Did anyone else find it odd that <a href="http://virtualization.com/news/2008/09/15/vcloud-vmware-to-be-cloud-computing-provider-too-but-inside-your-private-dc-and-not-tomorrow/" target="_blank">Cloud vServices</a> is kind of on its own in the Infrastructure vServices area? AND, I&#8217;ll have to get the other version of the diagram/roadmap I actually saw at the show because that one shows an inexplicable 4<sup>th</sup> box in the Application vServices area titled &#8220;&#8230;&#8221;. Really. Maybe to balance out the addition of <a href="http://www.itpro.co.uk/606237/vmwares-paul-maritz-goes-on-offence" target="_blank">Cloud vServices?</a>)</p>
<p>What was clear is that the move from VirtualCenter to vCenter &#8211;and the new vServices for rolled-up management of <a href="http://www.virtualization.info/2008/09/live-from-vmworld-2008-day-2-vmware.html" target="_blank">virtualization components</a>/capability to span multiple <a href="http://blogs.zdnet.com/virtualization/?p=542" target="_blank">VirtualCenters</a> (or future vCenters) for reporting, monitoring and management at scale &#8211; has been in the works for a bit (but in tech time, that could mean 6 months), but the cloud stuff&#8230;not so much.</p>
<p>Beyond the very high-level speak appropriate to a keynote (100+ service provider partners for off-premise cloud&#8230;suspended VM&#8217;s that you don&#8217;t have to pay for until you need it), the details are uber-fuzzy. There was a session that Dave went to which was supposed to shed more light, but when questions were asked about how it really works, the answers seemed to be TBD. Does anyone know more? If VMware really has figured out practical cloud computing for enterprises, kudos to them. But I fear they&#8217;re <a href="http://news.cnet.com/8301-13505_3-10042463-16.html?part=rss&amp;subj=news&amp;tag=2547-1_3-0-20" target="_blank">like everyone else</a> (except maybe AT&amp;T) and are still working out the details.</p>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 15:00:53 +0000</pubDate>
      <category domain="http://securityratty.com/tag/vservices">vservices</category>
      <category domain="http://securityratty.com/tag/infrastructure vservices">infrastructure vservices</category>
      <category domain="http://securityratty.com/tag/cloud vservices">cloud vservices</category>
      <category domain="http://securityratty.com/tag/cloud">cloud</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/vmware milestones">vmware milestones</category>
      <category domain="http://securityratty.com/tag/keynote">keynote</category>
      <category domain="http://securityratty.com/tag/vmware-centric">vmware-centric</category>
      <category domain="http://securityratty.com/tag/paul maritz">paul maritz</category>
      <source url="http://blog.sciencelogic.com/vmworld-2008-keynote-with-paul-maritz/09/2008">VMworld 2008 Keynote with Paul Maritz</source>
    </item>
    <item>
      <title><![CDATA[Interop NY Keynotes: Cisco]]></title>
      <link>http://securityratty.com/article/c55a3293fe594f4363a5830f6da4d48c</link>
      <guid>http://securityratty.com/article/c55a3293fe594f4363a5830f6da4d48c</guid>
      <description><![CDATA[After some rousing introduction music, Marie Hatter , Vice President, Network Systems and Security Solutions Marketing / CMO of Cisco began her presentation on virtualization
Introduction...]]></description>
      <content:encoded><![CDATA[<p>After some rousing introduction music, <a href="http://blogs.cisco.com/authors/bio/83" target="_blank">Marie Hatter</a>, Vice President, Network Systems and Security Solutions Marketing / CMO of Cisco began her presentation on virtualization.</p>
<p><strong>Introduction</strong></p>
<p>Virtualization is a word used by consumers and also by IT. But, do we all mean the same thing?</p>
<p>A very cool video from Cisco provided answers to &#8220;what is virtualization&#8221; from an  engineering perspective, data center perspective, IT perspective and the user perspective (virtual world).</p>
<p>Virtualization is about breaking the bonds between applications and server hardware, nodes and networks, applications and operating systems.</p>
<p>Why is this interesting? Virtualization holds the promise to transform the way we work, live, learn and play.</p>
<p><strong>Why virtualize?</strong></p>
<p>The real estate boom over the last 30 years has driven people to the suburbs. People didn&#8217;t mind commuting for an hour with lower gas prices. Today, we have a weak economy and gas prices are high. Something has to change.</p>
<p>Many are opting to stay at home. Businesses are trying out telecommuting, some (like Cisco) are even offering telepresence. This helps by reducing carbon footprint. Corporations are breaking free from physical requirements. The global workforce is also having an impact on the network. These changes are having a huge impact on the network.</p>
<p>We are on the cusp of transitioning from virtualization to VIRTUALIZATION.</p>
<p><strong>&#8220;One to many&#8230;.many to one.&#8221;</strong></p>
<p>This is Cisco&#8217;s idea of virtualization.</p>
<p>Consider the different roles we play in life - one to many. Spouse, executive, friend, parent, gym rat. This would be &#8220;one to many&#8221;. This is exactly what virtualization does. It allows you to partition resources off that you can use on the fly.</p>
<p><strong>Where do I start?</strong></p>
<p>Virtualization starts with server and storage. But, it&#8217;s the network that touches everything - it spans the physical, the virtual, and the cloud. This provides the connectivity to all these resources. The network brings transparency to the picture. It allows you to better monitor performance and better implement security - great benefits!</p>
<p><strong>Why do I need this?</strong></p>
<p>At Cisco, we saw that we were only using 20% of our storage utilization. We wanted to virtualize our datacenters. When we did that, we were able to get 68% storage utilization. For each year that we were able to defer buildup, we saved $40 million.</p>
<p>From a business standpoint, virtualization helps you differentiate and work faster. Provisioning in minutes, improved productivity and competitive differentiation, using less power (environmental impact), and up the ante of business continuity. If VMWare fails? It&#8217;s OK. You can reprovision it on the fly.</p>
<p><strong>Is it for everyone?</strong></p>
<p>IT organizations tend to be siloed. You have the IT side and the Operations side. Each has responsibility. For virtualization to work, these walls have to come down. The concept of virtualization depends on shared resources.</p>
<p><strong><a href="http://en.wikipedia.org/wiki/Metcalfe%27s_law" target="_blank">Metcalfe&#8217;s Law of the Network</a> Effect</strong></p>
<p>Everytime you add a node to the network, you increase the value. This is what happens with virtualization. Every device you virtualize increases the power of each device. More control of environment and more efficiency.</p>
<p>This leads to&#8230;</p>
<p><strong>Cloud computing.</strong></p>
<p>Wow, show of hands from the audience when Marie asked &#8220;how many are using cloud computing?&#8221; and &#8220;how many are using your own clouds?&#8221; - not a lot of hands were raised. Interesting considering the coverage cloud computing has and the focus of it.</p>
<p>Cloud computing has three possibilities at Cisco:</p>
<ul>
<li>Flexible infrastructure (hosting)</li>
<li>Abstract services (APIs)</li>
<li>Application services (SaaS)</li>
</ul>
<p>Automation is going to be key, and will need to integrate virtualization-aware elements.</p>
<p>Can you imagine if you wanted interoperability in the cloud? People haven&#8217;t even begun thinking about it.</p>
<p><strong>Conclusion</strong></p>
<p>As you virtualize, your role will change. You will think more about strategy. But keep in mind these &#8220;minefields&#8221; of virtualization:</p>
<ul>
<li>Insufficient planning</li>
<li>Lack of standards</li>
<li>Weak security</li>
</ul>
<p>Security cannot be an afterthought. It has to be planned. We&#8217;ve seen new forms of malware, hypervisor attacks, and root kit infections.</p>
<p>As higher expectations from end users evolve, we&#8217;re becoming not server oriented, but SERVICE oriented.</p>
<p><strong>Tips:</strong></p>
<ul>
<li>Think holistically</li>
<li>Consider IT culture - equipment and people</li>
</ul>
]]></content:encoded>
      <pubDate>Wed, 17 Sep 2008 10:11:05 +0000</pubDate>
      <category domain="http://securityratty.com/tag/virtualization">virtualization</category>
      <category domain="http://securityratty.com/tag/virtualization starts">virtualization starts</category>
      <category domain="http://securityratty.com/tag/virtualization helps">virtualization helps</category>
      <category domain="http://securityratty.com/tag/helps">helps</category>
      <category domain="http://securityratty.com/tag/virtualization depends">virtualization depends</category>
      <category domain="http://securityratty.com/tag/virtualization holds">virtualization holds</category>
      <category domain="http://securityratty.com/tag/network">network</category>
      <category domain="http://securityratty.com/tag/network brings transparency">network brings transparency</category>
      <category domain="http://securityratty.com/tag/cisco">cisco</category>
      <source url="http://blog.sciencelogic.com/interop-ny-keynotes-cisco/09/2008">Interop NY Keynotes: Cisco</source>
    </item>
    <item>
      <title><![CDATA[VMware partners demonstrate VMsafe virtual security prototypes]]></title>
      <link>http://securityratty.com/article/ad0998e2c9e9ddffc63049af4945ceb5</link>
      <guid>http://securityratty.com/article/ad0998e2c9e9ddffc63049af4945ceb5</guid>
      <description><![CDATA[A major VMware security initiative announced more than six months ago has still not resulted in any new products, but VMware and partners this week are demonstrating several prototypes of technology...]]></description>
      <content:encoded><![CDATA[A major VMware security initiative announced more than six months ago has still not resulted in any new products, but VMware and partners this week are demonstrating several prototypes of technology that will better secure virtual machines.]]></content:encoded>
      <pubDate>Mon, 15 Sep 2008 20:00:00 +0000</pubDate>
      <category domain="http://securityratty.com/tag/secure virtual machines">secure virtual machines</category>
      <category domain="http://securityratty.com/tag/vmware">vmware</category>
      <category domain="http://securityratty.com/tag/prototypes">prototypes</category>
      <category domain="http://securityratty.com/tag/months ago">months ago</category>
      <category domain="http://securityratty.com/tag/partners">partners</category>
      <category domain="http://securityratty.com/tag/week">week</category>
      <category domain="http://securityratty.com/tag/technology">technology</category>
      <category domain="http://securityratty.com/tag/products">products</category>
      <source url="http://www.networkworld.com/news/2008/091608-vmware-vmsafe.html?fsrc=rss-security">VMware partners demonstrate VMsafe virtual security prototypes</source>
    </item>
  </channel>
</rss>
