While virtualization has undoubtedly already found its footing in larger businesses and data centers, the technology is still in the process of catching on in the middle market. But a recent study conducted by a group of Cisco Partner Firms, titled "Virtualization on the Rise," indicates just that: the prevalence of virtualization is continuing to expand and has so far proven to be a success for many small- and medium-sized businesses.
With firms where virtualization has yet to catch on, however, security is often the point of contention.
[Security practices wanting in virtual machine world, survey finds]
Cisco's study found that adoption rates for virtualization are already quite high at small- to medium-sized businesses, with 77 percent of respondents indicating that they already had some type of virtualization in place around their office. These types of solutions included server virtualization, a virtual desktop infrastructure, storage virtualization, network virtualization, and remote desktop access, among others. Server virtualization was the most commonly used, with 59 percent of respondents (that said they had adopted virtualization in some form) stating that it was their solution of choice.
That all being said, there are obviously some businesses who still have yet to adopt virtualization, and a healthy chunk of respondents -- 51 percent -- cited security as a reason. It appeared that the larger companies with over 100 employees were more concerned about the security of virtualization, with 60 percent of that particular demographic qualifying it as their barrier to entry (while only 33 percent of smaller firms shared the same concern).
But with Cisco's study lacking any other specificity in terms of why exactly the respondents were concerned about the security of virtualization, one can't help but wonder: is this necessarily sound reasoning? Craig Jeske, the business development manager for virtualization and cloud at Global Technology Resources, shed some light on the subject.
"I think [virtualization] gives a much easier, more efficient, and agile response to changing demands, and that includes responding to security threats," said Jeske. "It allow for a faster response than if you had to deploy new physical tools."
[Seven essentials for VM management and security]
He went on to explain that given how virtualization enhances portability and makes it easier to back up data, it subsequently makes it easier for companies to get back to a known state in the event of some sort of compromise. This kind of flexibility limits attackers' options.
"Thanks to the agility provided by virtualization, it changes the attack vectors that people can come at us from," he said.
As for the 33 percent of smaller firms that cited security as a barrier to entry -- thereby suggesting that the smaller companies were more willing to take the perceived "risk" of adopting the technology -- Jeske said that was simply because virtualization makes more sense for businesses of that size.
[3 key issues for secure virtualization]
"When you have a small budget, the cost savings [from virtualization] are more dramatic, since it saves space and calls for a lower upfront investment," he said. On the flip side, the upfront cost for any new IT direction is higher for a larger business. It's easier to make a shift when a company has 20 servers versus 20 million servers; while the return on virtualization is higher for a larger company, so is the upfront investment.
Of course, there is also the obvious fact that with smaller firms, the potential loss as a result of taking such a risk isn't as great.
"With any type of change, the risk is lower for a smaller business than for a multimillion dollar firm," he said. "With bigger businesses, any change needs to be looked at carefully. Because if something goes wrong, regardless of what the cause was, someone's losing their job."
Jeske also addressed the fact that some of the security concerns indicated by the study results may have stemmed from some teams recognizing that they weren't familiar with the technology. That lack of comfort with virtualization -- for example, not knowing how to properly implement or deploy it -- could make virtualization less secure, but it's not inherently insecure. Security officers, he stressed, are always most comfortable with what they know.
"When you know how to handle virtualization, it's not a security detriment," he said. "I'm hesitant to make a change until I see the validity and justification behind that change. You can understand peoples' aversion from a security standpoint and first just from the standpoint of needing to understand it before jumping in."
But the technology itself, Jeske reiterated, has plenty of security benefits.
"Since everything is virtualized, it's easier to respond to a threat because it's all available from everywhere. You don't have to have the box," he said. "The more we're tied to these servers and our offices, the easier it is to respond."
[Best practices for safely moving data in and out of the cloud]
And with every element being all-encompassed in a software package, he said, businesses might be able to do more to each virtual server than they could in the physical world. Virtual firewalls, intrusion detection, etc. can all be put in as an application and put closer to the machine itself so firms don't have to bring things back out into the physical environment.
This also allows for easier, faster changes in security environments. One change can be propagated across the entire virtual environment automatically, rather than having to push it out to each physical device individually that's protecting a company's systems.
Jeske noted that there are benefits from a physical security standpoint, as well, namely because somebody else takes care of it for you. The servers hosting the virtualized solutions are somewhere far away, and the protection of those servers is somebody else's responsibility.
But what with the rapid proliferation of virtualization, Jeske warned that security teams need to try to stay ahead of the game. Otherwise, it's going to be harder to properly adopt the technology when they no longer have a choice.
"With virtualization, speed of deployment and speed of reaction are the biggest things," said Jeske. "The servers and desktops are going to continue to get virtualized whether officers like it or not. So they need to be proactive and stay in front of it, otherwise they can find themselves in a bad position further on down the road."