HyTrust ^has released HyTrust Appliance version 3.0. It includes—among numerous advancements—a Secondary Approval feature that enforces the “two-person rule” -- which has been a pivotal development in other mission-critical operations as well -- and automates workflow. Secondary Approval is designed to prevent risk, whether caused by unintended or malicious actions, to virtual machines (VMs), critical applications and data, and, ultimately, business operations. With HyTrust Appliance 3.0, enterprises can confidently, with even greater control, virtualize more while safely realizing the vast benefits of virtualization (financial reward, business efficiency, operational flexibility, etc.) and ensuring compliance with industry and regulatory mandates.

Eric Chiu, founder and president, HyTrust, explains: “According to US Air Force Instruction (AFI) 91-104, the two-person rule was designed to prevent the accidental or malicious launch of nuclear weapons by a single individual. Similarly, HyTrust’s new Secondary Approval feature mandates designated approvers authorize high-impact operations prior to users with administration privileges being able to execute actions that can impact the business or even bring down the entire data center.”

Chiu continued: “Without proper controls in place, the expansion of virtualization will continue to grow, but we’ll see, in parallel, security and compliance concerns increase correspondingly.”

McKesson’s Senior Director of Security Operations, Patrick Enyart, said: “Proactive control of user permissions is a ‘must have’ for a secure next-generation data center. It’s equally important that access controls for the virtualized environment be transparent to, and efficient for, the general user— which HyTrust delivers.”

VMware and other virtualization platforms do not provide adequate control, including viable methods of requiring additional level(s) of approval for actions that can result in negative consequences. So-called “privileged users” of an organization’s virtualization platform typically have much greater administrative power than counterparts who manage physical data center infrastructure. They can copy, power off or delete a business-critical VM – accidentally or intentionally – with a few clicks from any location in the world, or any device. If it results in financial hits, where operational downtime costs organizations tens of thousands per hour, compliance violations or an internal security breach, the cost is too high. Recent publicized incidents of privileged users taking down virtual data center operations attest to the large financial hits that enterprises can—and have—taken when adequate virtualization controls were not in place. For the most part, however, such events go unreported.

According to Senior Analyst Steve Coplan at 451 Research, “Both organizations that have implemented virtualization extensively across their infrastructure and those embarking on an initial virtualization project face the critical problem of ensuring that administrators and other privileged users with access to the hypervisor are appropriately constrained and monitored on an ongoing basis. Equally, however, these constraints should not stand in the way of operational efficiency and should be enforced in conjunction with a set of best practices for the configuration and management of virtualized environments. HyTrust's approach involving a set of workflows for Secondary Approval based on role and virtualized workload profile supports a process that serves both security and operational efficiency requirements.”

Secondary Approval increases the power and flexibility of the role- and object-based access controls provided in HyTrust Appliance 3.0. Enterprises can now define policy rules that trigger the approval workflow when specified users attempt to execute selected operations. For example, an attempt to snapshot or delete a VM containing an enterprise email server can be automatically put on hold while an approval request is delivered to authorized approvers. If an email software upgrade has been scheduled, an approver can easily authorize the operation and the requester will receive a notification of the approval. If no upgrade or other legitimate reason for copying or deleting the virtualized email server exists, however, an approver can deny the request and optionally send a message to the requestor asking for justification. Application of the “two-person rule” via Secondary Approval makes it easy and efficient to achieve separation of duties and least privilege access to critical applications and sensitive data, two essential elements of sound I.T. governance.

HyTrust Appliance 3.0 also features:

n  Advancements for secure multi-tenant private clouds, including enhanced virtual network segmentation.

n  Labels for VMs and other virtual resources for greater policy enforcement and prevention of a cloud tenant’s privileged users from gaining access to another’s applications or data.

n  Security and compliance usability, as well as availability, performance and scalability enhancements.

ShareThis

Tags: Security

Read more White Papers»

More DCS TV»

More Audio»

Read more Web Exclusives»

Read more Magazine Articles»

Read more Supplements »

Keep up to date with the latest industry products, services and technologies from the world's leading IT companies.

• Virtualization Success Depends on Network Automation by Infoblox

• The Infoblox VMware vCenter Orchestrator Plug-in by Infoblox

• Automated Storage Tiering on Infortrend’s ESVA Solution by Infortrend

• Why Cloud Backup: Top 10 Reasons by Autonomy

• How to Measure the ROI of Cloud Data Protection by Autonomy

Latest IT jobs from leading companies.

Click here for full listings»