Up until now, VMware treated security by saying as little as possible about it, knowing that arguing that virtualization didn't open up new security surface area just gave credibility to the thought that maybe it did (let sleeping dogs lie) which could only impede sales. Now that VMware is looking beyond the individual virtual machine, and thinking about the Cloud, they have started to talk (credibly) about how virtualization actually helps security. The issues are ultimately complicated (thank goodness there are bright analysts to think about them J ) but here's the basic story line. (1) If you want to talk seriously about the Cloud or even utility computing you need to talk about entire applications — virtual applications or Vapps — that include all the bits needed to get the job done, not about single virtual machines. (2) In order to deploy a Vapp to the Cloud (or even to a private utility or DR data center) you need to specify how it is to be protected. At first blush, a good answer is "just like you did before" except now the security can be largely provided by virtual appliances rather than the physical appliances used previously. (3)When specified on a Vapp by Vapp basis, and implemented by virtual appliances, the security can be as specific and customized as desired. For example, you can think about offering data leakage protection (DLP) tailored to the function and specifics of the application. You need to bind these security specifications in with the other application details so you know what else needs to be provisioned when the application is provisioned and you know where you can and cannot run the application (e.g., what other applications you can co-mingle with). Where it makes sense, part or all of the security can be specified parametrically (e.g., "PCI protection") so that as the regulations change, the specifics of the protection change automatically. VMW's observation is that binding security to the application and assuring it is provisioned as specified is a lot better than what we have now, where in most cases this is partially a manual process, and often requires coordination between multiple teams, all of which is complex, expensive, and prone to errors. The automation also makes it possible (and reasonable) to be much more specific about each application which is also good. Thus, virtualization makes security easier and better.
As always, this is one of the high energy user group meetings, with 12,000 attendees this year, not quite matching last year's attendance, but not showing the drops of other big shows. There were lots of free goodies from the exhibitors and even some scantily dressed show babes. The underlying business proposition was less clear: a lot of the vendors seemed to be selling features that VMware was strongly hinting were coming in future releases (hope springs eternal). The non-aligned parties were a visible part of the event, not quite up to RSA standards but clearly heading that way. Microsoft was visibly absent. We're told that at the MS Partner Meeting earlier in the summer nasty things were said by Microsoft about partners playing with VMware and the potential consequences if you did, and this was the quid pro quo. VMware clearly isn't ignoring Microsoft anymore. A lot of the new management team has been hired out of the software industry and its top leadership combined has nearly 50 years of Microsoft experience — CEO Paul Moritz (14 years at Microsoft), COO Todd Nielsen (12 years at Microsoft) came from Borland most recently, as did CMO Rick Jackson; CDO Richard McAniff (directly from 21 years at Microsoft).