VMware VMsafe™ is a new security technology for virtualized environments that can help to protect your virtual infrastructure in ways previously not possible with physical machines. VMsafe provides a unique capability for virtualized environments through an application program interface (API)-sharing program that enables select partners to develop security products for VMware environments. The result is an open approach to security that provides customers with the most secure platform on which they can virtualize their business-critical applications.
What is VMsafe?
VMsafe is a new program that leverages the properties of VMware vSphere to protect machines in ways previously not possible with physical machines. VMsafe provides a new security architecture for virtualized environments and an application program interface (API)-sharing program to enable partners to develop security products for virtualized environments.
The VMsafe Security Architecture provides an open approach that gives security vendors the ability to leverage the inherent properties of virtualization in their security offerings. Customers running their businesses on VMware vSphere will be assured that they are getting the best protection available – even better than what they have on physical infrastructure.
VMsafe adds a new layer of defense that complements existing physical security solutions such as network and host protection, shielding virtual machines from a variety of network, host and applications threats. This additional layer of protection can help enterprise organizations to dramatically increase the security posture of their IT environments.
How does VMsafe work?
VMsafe utilizes the unique properties of VMware vSphere, the rich platform that has enabled ground-breaking functionality such as VMware VMotion™ and VMware Distributed Resource Scheduler (DRS), to provide a clearer view of data center security than is possible with physical systems.
VMware vSphere inserts a thin layer of software directly on server hardware to create virtual machines. It contains a virtual machine monitor or “hypervisor” that allocates hardware resources dynamically and transparently to run multiple systems concurrently. VMsafe enables third-party security products to gain the same visibility as the hypervisor into the operation of a virtual machine to identify and eliminate malware, such as viruses, trojans and key-loggers. For instance, security vendors can leverage VMsafe to detect and eliminate malware that is undetectable on physical machines. This advanced protection is achieved through fine-grained visibility into the virtual hardware resources of memory, CPU, disk and I/O systems of the virtual machine that can be used to monitor every aspect of the execution of the system and stop malware before it can execute on a machine to steal data.
How do I install/activate VMsafe protection?
VMsafe is a capability inherent within VMware vSphere and specifically within VMware ESX. Once utilized and integrated with security partner solutions, customers need only purchase integrated solutions that will be available from partners. Solutions that integrate with VMsafe will be installed as virtual machines.
When Will VMsafe be available?
VMsafe technology will be delivered in future versions of VMware vSphere products, as well as in products by security vendors that are built, using APIs, specifically for the VMware environment.
What does VMsafe protect?
VMsafe enables partners to build a virtualization-aware security solution in the form of a security virtual machine that can access, correlate and modify information based on the following virtual hardware:
- Memory and CPU: VMsafe provides introspection of guest VM memory pages and cpu states.
- Networking: Network packet-filtering for both in-hypervisor and within a Security VM.
- Process execution (guest handling): in-guest, in-process APIs that enable complete monitoring and control of process execution.
- Storage: Virtual machine disk files (VMDK) can be mounted, manipulated and modified as they persist on storage devices.
What are the benefits of solutions that integrate with VMsafe?
- Better Security—Memory, CPU, and guest-handling provide new monitoring capabilities and have no equivalent in physical infrastructure. VMsafe solutions using these capabilities will protect organizations from new security threats more easily, preventing malware from ever infecting a virtual machine.
- Better enforcement across the infrastructure—security solutions that integrate with VMsafe can be deployed easily and consistently across the infrastructure to achieve greater visibility, manageability, and enforcement of standard security policies.
- Better isolation—one of the major issues with in-guest security solutions today is that these solutions run at the same privilege level as the malware they are protecting against. The VMsafe approach isolates the security engines so they are not accessible to the malware, guaranteeing that the security solution as a whole is protected and isolated.
- Better correlation—security solutions today have very limited correlation between various approaches, such as network behavior analysis and host intrusion protection. Network security appliances today lack in-guest information, such as operating system utilization and application version, patch or current activity. Using VMsafe, security solutions can obtain deeper visibility into the virtual machines and correlate this information for greater accuracy and performance of network scanners. VMsafe provides the capability to understand in-guest context much like a Host Intrusion Prevention System (HIPS). In addition, virtualization-aware security solutions will be able to protect virtual machines even when they are in motion, suspended or offline.
- Better scalability—With integrated security solutions for VMsafe, customers can provision security virtual appliances as they grow their infrastructure. This also means that during peak times or attacks, SLAs can be enforced simply by enabling hardware resource scheduling to ensure critical workloads continue running.
What is the VMsafe Partner Program?
The VMsafe technology program for partners includes sharing an open, interoperable and cross-platform set of technologies with partners so they can provide innovative security solutions for VMware vSphere customers. Security solutions built for VMsafe will provide customers better security, granularity, visibility, correlation and scalability in virtual machine deployments.
