Introduction to Virtualization: Concepts and Issues 2008 NSAA IT Conference Joe Moore Stella Arredondo Joaquin Fuentes

Virtualization What is virtualization? What is virtualization? Why & how is it being used? Why & how is it being used? Elements Elements Who are the major players? Who are the major players? Peer Discussion Peer Discussion Audit Considerations Audit Considerations

What is virtualization? Definition: Definition: Virtualization is a system or a method of dividing computer resources into multiple isolated environments. Types of virtualization Types of virtualization ServerServer StorageStorage DesktopDesktop ApplicationApplication

Who are the major players?

Why and how? Why does virtualization make sense? Cost of a sprawling physical infrastructure Cost of a sprawling physical infrastructure Utilization Utilization Maintenance Maintenance Disaster recovery Disaster recovery Open Discussion What ways have you seen it being used? What ways have you seen it being used? How are you leveraging it? How are you leveraging it? Does it always make sense? Does it always make sense?

Elements of a virtualized architecture Elements HostHost HypervisorHypervisor Virtual MachinesVirtual Machines “Guests” made up “Guests” made up of containerized files Hosted Bare Metal Resource allocations are configured at time of installation

Elements of a virtualized architecture

Files You Should Know*.vmx- Configuration (e.g. network settings).vmx- Configuration (e.g. network settings) Nvram- State of the VM’s BIOS Nvram- State of the VM’s BIOS.vmdk- hard drive image(s).vmdk- hard drive image(s).vmss - suspended state file for paused VM.vmss - suspended state file for paused VM.vmsn- snapshot file.vmsn- snapshot file Virtualized Machine *VMware specific example

Discussion: Uses & Challenges Scope Creep Security Supportability Licensing Training Scalability Buy-In Auditing ROI Planning Initial Co$t DR & BCP Compatibility

Virtualization - Risks and Issues Management Buy-In Management Buy-In Skills and Training Skills and Training Scope Creep Scope Creep Disk StorageDisk Storage SupportabilitySupportability LicensingLicensing Inappropriate implementations Inappropriate implementations Resource intensive appsResource intensive apps

Risks & Issues (Cont’d) Single point of failure Single point of failure Lessons learned – Test DR & BCPLessons learned – Test DR & BCP Management Tools Management Tools Single point of entrySingle point of entry Strong controls are necessaryStrong controls are necessary VM Escape VM Escape Guest:GuestGuest:Guest Host:GuestHost:Guest

Audit Considerations A documented full risk assessment A documented full risk assessment Controls over the process of Controls over the process of creating, deploying, manages and making changes to new virtual machines Adequate controls over patching and updates and secure configuration Adequate controls over patching and updates and secure configuration DR & BCP DR & BCP

Questions?