"Operating systems have security policy and enforcements. The hypervisor is invisible to the operating system, let alone client applications. A modern operating system, properly administrated, can prevent intrusions. No operating system running under an hypervisor can prevent or detect a breach of hypervisor security, particularly if the breach is on the part of a duly authorized employee of the data center."
That statement is true; however, it posits an alternative (a properly administered operating system) that is often, if not typically, non-existent. Many data centers fail to follow best practices with respect to administration, patch management, application update, and so on. And the experience of a number of users with attacks against their properly administered operating system is that vulnerabilities exist nonetheless. From my perspective, I'd rather live with the vulnerabilities potentially present in a small footprint hypervisor than those present in an operating system comprising millions of lines of code and containing hundreds of applications that are poorly maintained and rarely updated.
Therefore, it's understandable that reservations are voiced about cloud computing. It's even understandable that some of the criticisms are stated as absolute and unacceptable. These kind of criticisms are typical of those leveled against nascent technologies like cloud computing. New technologies are often not fully built out. They lack functionality. Key corner use cases are not thought through until encountered in real-world situations, posing operational shortcomings in the immediate present and hurry-up refresh releases to be distributed. By definition, a new technology is not as complete as the existing incumbent alternative.
Over time, however, the innovative technology is improved to address the issues that are present. With respect to hypervisor security, for example, I heard at this week's Xen Summit (the gathering of interested developers and users of the open source Xen hypervisor) that introspection APIs are being introduced to provide just the kind of security monitoring that enables enforcement of a security policy.
What these kind of criticisms fail to understand, though, is there are reasons that people are willing to endure the shortcomings of the technology-and the reasons have to do with the manifest benefits delivered by the new offering. With respect to virtualization, turning back to our example, there has been enormous uptake-despite issues like that outlined in the quote above. And that's because the technology offers undeniable financial payback-higher utilization, lower energy use, and better application availability. The benefits are so large that IT organizations have been willing-eager, even-to tolerate the challenges that accompany the technology.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.