How To Manage Virtualization

Transcription

1 An ISACA Emerging Technology White Paper Virtualization: Benefits and Challenges Abstract Virtualization is a high-tech buzzword in broad use today, but its increasing importance is based on more than just the passing fancy of the crowd. With its potential to reduce capital expenses and energy costs, virtualization presents an attractive solution for enterprises looking to save money and generate value from their IT investments. Virtualization can indeed offer many benefits to enterprises, but the benefits must be weighed against the potential threats to information assets and the business itself. This white paper examines some of the business benefits that accrue to virtualized solutions, identifies security concerns and suggests possible solutions, investigates some change considerations that should be considered before moving to a virtualized environment, and provides practical guidance on auditing a virtualized system.

2 ISACA With 95,000 constituents in 160 countries, ISACA ( is a leading global provider of knowledge, certifications, community, advocacy and education on information systems (IS) assurance and security, enterprise governance and management of IT, and IT-related risk and compliance. Founded in 1969, the nonprofit, independent ISACA hosts international conferences, publishes the ISACA Journal, and develops international IS auditing and control standards, which help its constituents ensure trust in, and value from, information systems. It also advances and attests IT skills and knowledge through the globally respected Certified Information Systems Auditor (CISA ), Certified Information Security Manager (CISM ), Certified in the Governance of Enterprise IT (CGEIT ) and Certified in Risk and Information Systems Control TM (CRISC TM ) designations. ISACA continually updates COBIT, which helps IT professionals and enterprise leaders fulfill their IT governance and management responsibilities, particularly in the areas of assurance, security, risk and control, and deliver value to the business. Disclaimer ISACA has designed and created Virtualization: Benefits and Challenges (the Work ), primarily as an educational resource for security, governance and assurance professionals. ISACA makes no claim that use of any of the Work will assure a successful outcome. The Work should not be considered inclusive of all proper information, procedures and tests or exclusive of other information, procedures and tests that are reasonably directed to obtaining the same results. In determining the propriety of any specific information, procedure or test, security, governance and assurance professionals should apply their own professional judgment to the specific control circumstances presented by the particular systems or information technology environment. Reservation of Rights 2010 ISACA. All rights reserved. No part of this publication may be used, copied, reproduced, modified, distributed, displayed, stored in a retrieval system or transmitted in any form by any means (electronic, mechanical, photocopying, recording or otherwise) without the prior written authorization of ISACA. Reproduction and use of all or portions of this publication are permitted solely for academic, internal and noncommercial use and for consulting/advisory engagements, and must include full attribution of the material s source. No other right or permission is granted with respect to this work. ISACA 3701 Algonquin Road, Suite 1010 Rolling Meadows, IL USA Phone: Fax: info@isaca.org Web site: Virtualization: Benefits and Challenges CRISC is a trademark/service mark of ISACA. The mark has been applied for or registered in countries throughout the world. 2

3 ISACA wishes to recognize: Project Development Team Ramses Gallego, CISM, CGEIT, CISSP, SCPM, ITIL, Six Sigma Black Belt, Entel IT Consulting, Spain, Chair Jason Chan, VMWare, USA Michael Hoesing, CISA, CPA, CISSP, CIA, University of Nebraska at Omaha, USA Steve Orrin, Intel Corporation, USA Expert Reviewers David Finnis, CISA, CGEIT, CISSP, Ekko Consulting, USA Roger Gallego, Entel IT Consulting, Spain Edward Haletky AstroArch Consulting, Inc., USA Florian Murillo, Cloud Consulting, Spain ISACA Board of Directors Emil D Angelo, CISA, CISM, Bank of Tokyo-Mitsubishi UFJ Ltd., USA, International President Christos K. Dimitriadis, Ph.D., CISA, CISM, INTRALOT S.A., Greece, Vice President Ria Lucas, CISA, CGEIT, Telstra Corp. Ltd., Australia, Vice President Hitoshi Ota, CISA, CISM, CGEIT, CIA, Mizuho Corporate Bank Ltd., Japan, Vice President Jose Angel Pena Ibarra, CGEIT, Alintec S.A., Mexico, Vice President Robert E. Stroud, CGEIT, CA Technologies, USA, Vice President Kenneth L. Vander Wal, CISA, CPA, Ernst & Young LLP (retired), USA, Vice President Rolf M. von Roessing, CISA, CISM, CGEIT, Forfa AG, Germany, Vice President Lynn C. Lawton, CISA, FBCS CITP, FCA, FIIA, KPMG Ltd., Russian Federation, Past International President Everett C. Johnson Jr., CPA, Deloitte & Touche LLP (retired), USA, Past International President Gregory T. Grocholski, CISA, The Dow Chemical Co., USA, Director Tony Hayes, CGEIT, AFCHSE, CHE, FACS, FCPA, FIIA, Queensland Government, Australia, Director Howard Nicholson, CISA, CGEIT, CRISC, City of Salisbury, Australia, Director Jeff Spivey, CPP, PSP, Security Risk Management, USA, ITGI Trustee Guidance and Practices Committee Kenneth L. Vander Wal, CISA, CPA, Ernst & Young LLP (retired), USA, Chair Kamal N. Dave, CISA, CISM, CGEIT, Hewlett-Packard, USA Urs Fischer, CISA, CRISC, CIA, CPA (Swiss), Switzerland Ramses Gallego, CISM, CGEIT, CISSP, Entel IT Consulting, Spain Phillip J. Lageschulte, CGEIT, CPA, KPMG LLP, USA Ravi Muthukrishnan, CISA, CISM, FCA, ISCA, Capco IT Service India Pvt. Ltd., India Anthony P. Noble, CISA, CCP, Viacom Inc., USA Salomon Rico, CISA, CISM, CGEIT, Deloitte, Mexico Frank Van Der Zwaag, CISA, Westpac New Zealand, New Zealand 3

4 ISACA and IT Governance Institute (ITGI) Affiliates and Sponsors American Institute of Certified Public Accountants ASIS International The Center for Internet Security Commonwealth Association for Corporate Governance Inc. FIDA Inform Information Security Forum Information Systems Security Association Institut de la Gouvernance des Systèmes d Information Institute of Management Accountants Inc. ISACA chapters ITGI Japan Norwich University Solvay Brussels School of Economics and Management University of Antwerp Management School Analytix Holdings Pty. Ltd. BWise B.V. Hewlett-Packard IBM Project Rx Inc. SOAProjects Inc. Symantec Corp. TruArx Inc. 4

5 Impacts of Virtualization By definition, virtualization is rendering something in virtual (rather than actual) form. In enterprise information technology (IT), virtualization alters the technical architecture because it allows different resources to be executed in a single (or multilayer) environment. In general, it turns one piece of hardware into the host for many other pieces and, consequently, over time, has the potential to reduce enterprise capital expenses, costs of administration and other financial costs. Virtualization, as a term and a concept, has broad utility and can be applied to several areas: virtualized servers, virtualized storage, virtualized processors, virtual memory, virtual desktops, virtualized network, etc. Because of its extensive applications and cost savings, it is being evaluated by chief information officers (CIOs) worldwide as they strategize how to provide agility and computing power to meet their enterprise needs. In addition, because organizations today require a quick and reliable way to provision technical resources that enable a faster time to market, virtualization is on the C-level agenda and is already enhancing the effectiveness of many enterprises around the globe. Originally virtualization was used mostly to facilitate server consolidation, but now many other approaches present themselves. Virtualization starts during the design phase of the technical environment, when the design team considers how to support the business processes and identifies assets needed to convert the plan to reality. It is during this phase that enterprises often realize that the life cycle of provisioning the right hardware and other equipment can go on longer than expected and that there is a faster way to deploy them: by building in some abstraction from the physical world and hosting different virtual resources within the boundaries of a unique physical resource. Virtual is the opposite of physical, not of real. Virtualization is very real; it is here to stay and some new technologies such as cloud and grid computing rely on it to deliver their promise. Business Benefits of Virtualization Virtualization is here to stay and some new technologies rely on it to deliver their promise. There are many benefits of implementing virtualization within enterprise IT. Among them are: Cost reduction By consolidating many instances of (virtualized) servers onto a physical one, enterprises lower their hardware expenditures. In addition to lower capital expenditures, virtualized environments enable enterprises to save on maintenance and energy, often resulting in a reduced total cost of ownership (TCO). Automation Technology allows some virtualized environments to be provisioned as needed and on the fly, thus facilitating automation of business processes and eliminating the need to continually resource and manage portions of the technical environment that support sporadic business needs. Some virtualization technology facilitates the automatic allocation of a process for its optimal performance within a pool of virtualized environments. Responsiveness Since the virtual environment has the ability to provision itself to get the best out of available resources, response times are faster and downtimes can be reduced to near zero, improving agility and performance. Decoupling Processes that once needed to exist within the same physical machine can now be easily separated while still maintaining the robustness and security required. The different virtualized worlds (network, operating system [OS], database, application, etc.) can be decoupled (even distributed in different geographic locations) without threatening integrity within the process. Flexibility The relatively easy creation or preparation of the right environment for the right application enables enterprises to provide flexibility to the infrastructure, not only in the test or preproduction phases but also in the production area. When a new procedure or technical/business requirement arises, virtualization s ability to enable rapid creation of the environment allows the business to test the environment without having to wait for the regular provisioning process to be executed and delivered. 5

6 Agility Agility facilitates quick adaptation to business needs, such as when orders peak and additional computing power is needed. An enterprise may even choose to overcommit the resources of a physical machine since virtualization facilitates rapid movement of the different resources that live in one physical machine to other virtual machines. In this way, virtualization supports alignment with business needs. Workload balancing Deploying several virtual environments guarantees the good practices of high availability, redundancy and failover since workloads can go where they are more efficient. Thus, virtualization focuses not only on effectiveness (doing the right things) but also efficiency (doing things in a faster, cheaper and more reliable way). Simplification Virtual IT is still IT, so some of the typical IT difficulties exist even within a virtual environment. However, reducing the number of physical servers significantly reduces the probability of failure and the cost of management and results in simplification one of the promises of virtualization. Space utilization Server consolidation saves space in the data center and facilitates scalability since many servers exist within one server. Sustainability Virtualized environments use less environmental resources. Energy consumption in data centers is often wasted on machines that are consistently underutilized. Since virtualization allows for many virtual machines to run on one physical machine, less energy is needed to power and cool devices. In summary, the business benefits of virtualization can be expressed as shown in figure 1. Figure 1 Five Reasons to Virtualize Outcome How it is Achieved 1. Reduce IT complexity. Applications and their operations systems are encapsulated in virtual machines that are defined in software, making them easy to provision and manage. 2. Enable standardization. Since applications are decoupled from hardware, the data center may converge on a narrower range of hardware devices. 3. Improve agility. Applications and virtual machines can be copied and moved in real time and in the cloud in response to changing business conditions. 4. Improve cost-efficiency. Virtual machines can easily be moved to consume spare capacity wherever it exists, thus generating more work from less hardware. 5. Facilitate automation. Virtual infrastructure is easily provisioned and orchestrated by software-driven processes, especially when the underlying hardware is standardized. Risks and Security Concerns With Virtualization As with any technology, there are risks associated with virtualization. Those risks can be categorized into three groups: Attacks on virtualization infrastructure There are two primary types of attacks on virtualization infrastructure: hyperjacking and virtual machine (VM) jumping (or guest-hopping). Hyperjacking is a method of injecting a rogue hypervisor (also called virtual machine monitor [VMM]) under the legitimate infrastructure (VMM or OS) with control over all interactions between the target system and the hardware. Some examples of hyperjacking-style threats include Blue Pill, 1 SubVirt 2 and Vitriol. 3 These proofs of concept and their associated documentation illustrate various ways of attacking a system to inject rogue hypervisors under existing OSs or virtualization systems. Regular security measures are ineffective against these threats because the OS, running above the rogue hypervisor, is unaware that the machine has been compromised. To date, hyperjacking is still only a theoretical attack scenario, but it has garnered considerable press attention due to the potential damage it could cause. 1 Rutkowska, Joanna; Introducing Blue Pill, The Invisible Things Lab blog, 22 June 2006, theinvisiblethings.blogspot.com/2006/06/introducing-blue-pill.html 2 King, Samuel T.; Peter M. Chen; Yi-Min Wang; Chad Verbowski; Helen J. Wang; Jacob R. Lorch; SubVirt: Implementing Malware With Virtual Machines, 3 Dai Zovi, Dino A.; Hardware Virtualization Rootkits, 6

7 VM jumping or guest-hopping is a more realistic 4 possibility and poses just as serious a threat. This attack method typically exploits vulnerabilities in hypervisors that allow malware or remote attacks to compromise VM separation protections and gain access to other VMs, hosts or even the hypervisor itself. These attacks are often accomplished once an attacker has gained access to a low-value, thus less secure, VM on the host, which is then used as a launch point for further attacks on the system. Some examples have used two or more compromised VMs in collusion to enable a successful attack against secured VMs or the hypervisor itself. Attacks on virtualization features Although there are multiple features of virtualization that can be targeted for exploitation, the more common targets include VM migration and virtual networking functions. VM migration, if done insecurely, can expose all aspects of a given VM to both passive sniffing and active manipulation attacks. Empirical Exploitation of Live Virtual Machine Migration, by Oberheide, Cooke and Jahanian, 5 shows examples of sniffing passwords and keys from memory as well as methods of manipulating system configuration while VMs are migrated across the network. Also described is an example of injecting malware into a VM s memory on the fly. Virtualization: Enough Holes to Work Vegas, a presentation by D.J. Capelis, 6 illustrates security issues with the networking features and support typically used by virtualization infrastructures. Other networking examples include differing ways in which media access control (MAC) address assignment, local routing and layer 2 traffic may be exploited. It is important to note that the local virtualized network plane on the system works differently from the external real world network, and many of the controls and security mechanisms available on the external network do not readily apply to local traffic on the system between VMs. Compliance and management challenges Compliance auditing and enforcement, as well as day-to-day system management, are challenging issues when dealing with virtualized systems. VM sprawl introduces a challenge to the enterprise. Because VMs are much easier to provision and deploy than physical systems, the number and types of VMs can easily get out of hand. Further, VM provisioning is often administered by different groups within an organization, making it difficult for the IT function to control what applications, OSs and data are deployed to them. VM sprawl and even dormant VMs will make it a challenge to get accurate results from vulnerability assessments, patching/updates and auditing. Strategies for Addressing Virtualization Risks Currently, the best method for mitigating the threat of hyperjacking is to use hardware-rooted trust and secure launch of the hypervisor. Technologies in the processor and chipsets, along with Trusted Execution Technology (TXT) and a Trusted Platform Module (TPM), provide the ingredients necessary to execute a secure or measured launch of the system from hardware through the hypervisor (sometimes referred to as the measured launch environment, or MLE). The Trusted Computing Group (TCG) 7 has defined a set of standards for performing a hardware-based measured launch and for creating the chain of trust from Currently, the best method for mitigating the threat of hyperjacking is to use hardware-rooted trust and secure launch of the hypervisor. hardware to the MLE. Manufacturers and original equipment manufacturers (OEMs), as well as many virtualization software vendors, have adopted TCG-compliant implementations of measured launch and roots of trust. 8 Enabling and utilizing these features will help manage the risks associated with hyperjacking. Addressing risks associated with VM jumping and virtual machine migration attacks begins with remembering that the hypervisor and the guests it supports are software and, as such, need to be patched and hardened. 4 Higgins, Kelly Jackson; VMs Create Potential Risk, 21 February 2007, 5 Oberheide, Jon; Evan Cooke; Farnam Jahanian; Empirical Exploitation of Live Virtual Machine Migration, migration.pdf 6 Capelis, D.J.: Virtualization: Enough Holes to Work Vegas, Defcon 15, 7 The Trusted Computing Group, 8 Intel, Intel Trusted Execution Technology, 7

8 The use of isolation and segmentation will also greatly reduce the risks. It is effective to use physical, network and virtualization-based separation to segment VMs and systems, and to couple the separation with leveraging policy or security levels to cluster like VMs/applications together such that a low-value (and, therefore, less scrutinized) application cannot have a negative impact on high-value VMs/applications. VM segmentation can be implemented through the virtualization management infrastructure or can be accomplished manually, depending on the tools and products used. Segmentation is also an important tool in dealing with the networking risks associated with virtualization. As noted previously, separating VMs of differing security postures reduces the risk for the higher-value VMs. Additionally, the use of transport encryption is recommended for securing VM migration. Virtual private network (VPN) tunnels can be deployed system to system or, in some cases, it is possible to leverage features available from virtualization vendors or security software solutions that provide for encrypted VM migration. Solving the management and compliance challenges requires implementing virtualization-aware management products and services, as well as virtualization-aware security products. This enables the existing management infrastructure to recognize and track VMs just as it does systems and applications in the data center. There are products specifically developed for virtualization security management, and add-ons or upgrades to existing infrastructure products that provide virtualization awareness and the necessary compliance and management features. Governance and Change Issues With Virtualization The governance of enterprise IT can be defined as the process that ensures that IT aligns with business strategy and effectively furthers organizational objectives. At a simplified level, the governance of enterprise IT can be defined as the process that ensures that IT aligns with business strategy and effectively furthers organizational objectives. Just as server virtualization impacts the overall technology landscape, its increasing use impacts the governance of enterprise IT in a number of critical areas as well. That impact can be best understood by considering the various characteristics of virtualization and their potential positive or negative impacts. A common goal of efforts to govern an enterprise s IT is to ensure that IT can quickly and flexibly deliver technology solutions that support achievement of the enterprise s overall business goals. Server virtualization assists in this area because virtualization can lead to faster build and deploy times through the use of tools and technology that obviate the need to physically rack and stack when new systems are provisioned. Cost control is also central to IT governance, and virtualization can deliver in this area as well, reducing the enterprise s hardware, power and facility costs. Another common IT governance goal is to ensure business continuity through robust technology solutions that can handle and adapt to increased load and disaster scenarios. Server virtualization enables significant capabilities in these areas, providing the IT organization with previously unavailable options for flexibly scaling for load and dynamically shifting and aligning resources to respond to business continuity and disaster events. On the negative side, increased virtualization does pose some risks to the goals of IT governance. One primary risk is related to the skill sets and organizational experience available to support the use of server virtualization in missioncritical environments. While virtualization has become quite common, it is still a relatively new technology and organizations may have difficulty securing the experienced workers needed to ensure that IT is able to deliver on its goals. A related risk is associated with the roles and responsibilities involved with managing a virtualized infrastructure. Traditionally, technology has been managed by IT within various functional and technical areas, such as storage, networking, security and computers/servers. With virtualization, these lines are significantly blurred, so enterprises that embrace virtualization need to mature their support models to reap all of the benefits that virtualization can provide. 8

9 Organizational Change As with overall governance of IT, server virtualization raises a number of important questions related to IT organizational change. The first, and likely most significant, change relates to technology management and the associated support model for the virtualization layer. Virtualization introduces a new layer of technology and, with it, a new requirement for administration and management. To integrate virtualization successfully and ensure that the associated organizational change is implemented, enterprises must consider where responsibility for virtualization architecture and management will reside. Another key area of IT organizational change is the system management life cycle, from procurement and deployment to retirement and decommissioning. Historically, the deployment process has been gated by hardware ordering and procurement processes, which were predecessors to physically installing a server and releasing it into production. In some sense, this helped facilitate a controlled life cycle that was driven by checklists and processes for purchasing, physical installation, build and configuration, and production release. With virtualization, a server (or cluster of servers) can be deployed into production with a single mouse click, potentially bypassing the controls associated with traditional system life cycle management. On the positive side, the virtual system life cycle is lightweight, flexible, and entirely contained and visible in a single management infrastructure, which provides the IT organization with a cradle-to-grave view of the life cycle. IT organizations that modify operating processes to take full advantage of this agility and visibility are best equipped to maximize their investment in virtualization. When transitioning to a virtualized environment it is important for IT professionals to work with those within IT and with professionals outside of IT. When transitioning to a virtualized environment it is important for IT professionals to work with those within IT, such as security, system developers and support, and with professionals outside of IT, such as the project management office and audit. It is critical for all parties involved to understand the business process changes that occur as a result of migrating to a virtualized environment. Assurance Considerations for Virtualization The assessment process compares current-state metrics to the enterprise s standards. Recommendations for control and security standards for virtualization have been created by independent security and control professional organizations (such as ISACA and the Center for Internet Security), vendors (hypervisor vendors and those in the industry selling related goods and services), and government agencies (e.g., the US Defense Information Systems Agency Security Technical Implementation Guide [DISA STIG] for virtualization). These documents have produced a variety of benchmarks that can be used to help ensure that the enterprise s standard has appropriately addressed particular risks and no risk has been overlooked. Assessing Infrastructure Risks A mix of high- and low-tech assessment techniques can serve the auditor well in the virtualized world. Those leading virtualization deployment should have a documented strategy for ensuring that hypervisor software and hardware are compatible with the chosen hypervisor(s) requirements. The auditor should review the supporting documentation for these components to confirm the components ability to fulfill deployment agility, continuity and other items congruent with the business strategy of the enterprise. Observation of host start processes can ensure appropriate technical checks and invocation of TPM before the OS startup. It can also determine whether other pre-hypervisor (BIOS, boot-loader, etc.) steps and configurations are invoked according the enterprise s standards. Physical security may not be the newest of risk mitigation techniques, but the auditor s virtualization assessment should ensure that all related hardware is appropriately restricted regarding physical access, thereby reducing the chance of alteration of CPU boot processes. In addition, auditors should review any remote methodology that gives access to the host motherboard for remote startup to ensure that the configuration allows only authorized use. 9

10 The guest virtual machine must communicate with the host to receive and use resources. However, the host should make the final determination regarding the communication channels used and the results of requests. Assessment procedures should ensure that the hypervisor and related management tools are kept current with vendor patches so that communication and related actions take place as designed. The auditor also needs to check the configuration of the host and related management tools in accordance with the enterprise s standard (which has been compared to the industry standards mentioned previously). There are many ways to gather configuration metrics from hypervisors and other vendor management tools. Low-cost metrics gathering may include the commands at the console of the host console, vendor-developed free tools that collect metrics (although they may be limited to the number of hosts or the number of features assessed), and free application programming interfaces (APIs) and scripting tools offered by hypervisor vendors to pull information from their hosts in an automated and scheduled fashion. Marginal cost alternatives for host metrics gathering also include vendor management tools and thirdparty management or security tools, if already purchased by the enterprise. Finally, there are commercial tools of varying price ranges to discover and footprint the virtual environment. Assessing Features Risks Virtual guests move their information around the enterprise s network for production, optimization, continuity or other reasons. All network paths used should be used only by those authorized; the auditor can usually review segmentation of networks via the management console. The auditor should verify that: (1) the hosts in similar clusters and guests serviced by the same host are similarly grouped and on the correct network, (2) host management networks are separate from production networks, and (3) the virtual networks used to transfer guest resource provisioning to a different host are on yet another network segment. Furthermore, the auditor can review via the management console the segregation of guests on different hosts and networks. The auditor can review the networking configuration via the management console or by gathering host configuration data with tools mentioned previously. The auditor should review virtual switches and other virtual networking components, particularly noting whether MAC configuration and addressing; virtual local area network (VLAN) assignment, routing, protocols and encryption; and other networking information align with the enterprise s standard. Assessing Management Risks The auditor should first determine the existence and accuracy of the enterprise s IT asset inventory, including virtual items. An assumption implied in the assessment steps described previously is that the enterprise maintains an accurate inventory of known authorized components comprising its environment. To assess guest sprawl, the auditor should first determine the existence and accuracy of the enterprise s IT asset inventory, including virtual items. Once the known inventory is validated, the auditor can review management s process to detect unauthorized guests. The auditor may use commercial management or assessment tools to poll the environment and compare what is found to the authorized inventory. Since most hypervisor vendors provide APIs and scripting tools, the auditor may be able to develop his/her own discovery tools at minimal or no cost (other than time). Also, many commercial security products covering virtualization have a discovery module since they cannot protect what they do not know. If the auditor s enterprise has already purchased these types of tools, the auditor should inquire whether the discovery results may be reviewed for comparison with the authorized documented asset inventory. Tools have emerged to detect dormant guests, wake them up and correct deficiencies found before the dormant guest is reactivated. The auditor should inquire about the use of these tools, the frequency with which they are run, and their success in locating and correcting dormant guests. 10

11 Assessing Governance Risks The auditor should review management s policies, procedures and practices for: Board or executive review and approval of the virtualization strategy Postimplementation comparisons of cost savings actually achieved to amounts expected Gathering evidence that the key components of the change management process remain in place authorization, testing (including security certification to the organization standard), back-out plans and notification to affected parties and that only the time line (not functionality) for each step has been reduced by virtualization Training for staff with new virtualization responsibilities and ongoing training for existing virtualization staff when architecture changes are made or major vendor updates occur Knowledge transfer from third parties assisting with deployment Revision of role descriptions for staff whose prior technical boundary has been made less clear due to virtualization Revision of accountability for communication between previously more independent teams prior to virtualization (host, networking, storage) Inventory procedures that produce accurate documented results that facilitate licensing compliance, correct maintenance fee payments, insurance and other administrative support functions Conclusion Mitigating threats and having well-documented business processes and strong audit capabilities will help ensure that enterprises generate the highest possible value from their IT environments. Virtualization has affected the way enterprises run their IT operations. While virtualization has only recently left emergent technology status and become a more common practice, enterprises have already seen benefits to moving to virtualized environments. Those benefits include lower TCO, increased efficiency, positive impacts to sustainable IT plans and increased agility. However, enterprises must also consider the potential security risks and change implications that accompany moving to a virtualized environment. Mitigating many of these threats and having well-documented business processes and strong audit capabilities will help ensure that enterprises generate the highest possible value from their IT environments. Additional resources related to virtualization are available at 11