Survey data from Gartner conferences in late 2009 indicated that about 40% of virtualization deployment projects were undertaken without involving the information security team in the initial architecture and planning stages — an improvement from the same survey a year earlier where 50% indicated that they didn't proactively involve information security. Typically, the operations teams will argue that nothing has really changed — they already have skills and processes to secure workloads, OSs and the hardware underneath. While true, this argument ignores the new layer of software in the form of a hypervisor and virtual machine monitor (VMM) that is introduced when workloads are virtualized.

The argument also ignores other concerns, such as the potential loss of separation of duties (SOD) and workload segregation that may be undermined in a virtualized environment. In many cases, additional tools aren't necessary, and simply updating existing processes is all that is needed. In other cases, additional tools or training may be required. Ideally, all of these needs would be identified proactively, so that, where changes to processes or training or additional or updated tools are needed, funding from the server consolidation project is still available.

»  Click to find out how to address Security Risks in Data Center Virtualization Projects