Home > Intel Communities > Open Port IT Community > IT@Intel > Blog > Tags > virtualization

IT@Intel Blog

14 Posts tagged with the virtualization tag
0

I was recently involved in a project where Intel IT SMEs from disciplines including Server, Storage, Data Center, Network, and Finance reviewed and updated our Data Center Strategy (Intel IT Data Center Solutions: Strategies to Improve Efficiency) for Intel IT.  The primary focus of the paper was to provide an update on value realized, shifts in strategy, and key execution lessons learned.

 

Our execution highlighted the need for finance to participate as an active partner in the influence planning and internal communications.  At some point, especially in economically challenging environments, cross organization investment decisions boil down to a tradeoff between limited resources and a number of good projects. Being able to clearly articulate the value added by a "portfolio of projects" (like the Data Center Strategy) and how you will track progress doesn’t mean that the project(s) will be funded – but it does increase the likelihood that you will be in the game at the end.  For us, having this coordinated communication strategy for technology solutions,cost efficiency, and operational efficiency was a key consideration for successful execution. 

 

We currently estimate that the cumulative projected financial impact over eight years will be ~$500-650M NPV - this range has changed in upper and lower limits based on updates to forecasts.  Over the first three years, Intel IT has realized ~31% of the projected benefits through execution to the Data Center strategy.  The primary value driver has been the impact of our server strategies (multi-core refresh and virtualization) that enable demand growth within the existing data center footprint and affordability targets.  Moving into 2010, we are evaluating new forecasting and value metrics to enhance customer reporting of data center activities.  This approach will incorporate our activity driver methodology into comprehensive unit costing and forecasting framework, creating a holistic cost forecasting process to improve future decision making.

 

One area currently under review is establishing the right unit of measure for a data center infrastructure housing different compute environments.  Is this something you or your business partners are exploring or looking to explore?

0 Comments Permalink
2

As I started my transition into a new job within Intel IT a few months ago, I discovered that one our internal IT strategic imperatives was “Partnership”.  I have to admit that at first I dismissed this a simply one of many standard business leadership terms that any organization could choose to operate on (I hope Diane Bryant, Intel CIO, is not reading this ).  However, I’m learning how critical partnerships are for a high functioning and value driven IT organization, both within the IT organization and between IT and the business groups they support.

 

With much of the focus these days on the lack of capital budgets limiting IT investment and innovation, I’m learning that a larger underlying barrier for IT organizations to enhance and maximize value inside their businesses, centers around the themes of trust, alignment and ultimately, partnership.  Organizational Silos inside any business create natural barriers to innovation.  Some silos exist naturally and others are self imposed.

 

Let’s look inside a typical IT organization where you are likely to find three functional areas: Architecture, Engineering, Operations.  These functions exist naturally inside most IT organizations.  Recently, I had an opportunity to talk about the inner workings of these functions inside an IT organization with Gregg Wyant, Intel IT CTO and Chief Architect.  These groups are designed to fulfill very unique roles in the IT organization and designed to create an expertise in these functional areas to maximize effectiveness within their chartered goals (chart below). However, if partnership (or at least an understanding of these different roles and goals) doesn’t exist across these groups the credibility of the IT organization can be at risk and the value IT delivers to the business undermined.

IT2ITpartnership.jpg

Imagine if the architecture group creates a vision that can not be implemented by engineering or was is cost prohibitive in the manpower or solutions needed to implement it operationally.  IT’s costs would rise dramatically and/or the architecture design efforts would simply be wasted.  Or imagine if IT never challenged the status quo operational processes and just continued to operate “the way it has always been done”.  If this happens, we would never improve business processes.  Obviously there is a balance required here and partnership across these disciplines can help an organization operate at a higher level of delivered business value and IT efficiency.  After completing a recent job coverage rotation himself, Gregg articulated to me the importance of IT to IT partnership across these disciplines and cross functional job rotations within IT.  The benefits help an IT organization maximize operational cost savings and service levels, react quickly to changing business and technical conditions while balancing and prioritizing investments for the good of the overall business - versus optimizing any one individual discipline or organization.

 

If we look outside the walls of the IT organization, we can also see how silos can negatively affect the business – this brings me to the subject of Server Huggers. 

 

A Server Hugger is someone who currently has or is demanding to IT that they have a physical server (or many servers) dedicated to their business function or department --> they want to touch it, know it is theirs and know that they don’t have to share it with anyone else (either in IT or another business unit).  Server Huggers can be individuals or business groups.  And in a world where most servers still run an average of 5-10% utilization, it is easy to see how these silo-oriented “server huggers” can create inefficiency in the business. To deploy virtualization (or accelerate the rate of virtualization adoption) inside any business, the business teams and IT often need to breakdown this silo’d approach and find ways to delivered required or higher service levels while running on shared, virtualized hardware resources. 

 

This was at the heart of a discussion I recently had around Intel IT’s strategy to accelerate virtualization inside our Office and Enterprise computing environments.  The first step in executing this strategy is to identify the target servers, document who owns them (if IT doesn’t – in many cases we don’t), size the new environment and convince the business owners that virtualizing is OK.  With demonstrated proof of concept virtualization ratios at up to 20:1 using the latest Intel Xeon 5500 based servers, our opportunity for savings is dramatic if we can rid our organization of server hugger behavior.  With tops down support from IT management and an environment of partnership already established with our business customers, I believe we have a clear path to success.

 

Partnerships inside Intel IT can be seen in how we create and measure business value with our business partners, how our own IT organization encourages IT rotation and how we strategically align our IT planning efforts with our business plans. 

 

It is clear to me that our Intel IT Strategic Imperative of Partnership is much more than management lip-service … it is at the heart of our IT operational philosophy … and for good reason.

 

Good bye Silos!  Good bye Server Huggers!  … we have no use for you any more.

 

Chris Peters, Intel IT

Engage Intel experts in IT to IT discussions inside the IT@Intel community

Follow me on Twitter

2 Comments Permalink
0

Watch Diane Bryant, Intel CIO, talks about the cash machines in data centers in this press breifing. Haven't heard about the amazing cash machines for your data centers yet?! Better check it out now: Installing Cash Machines in your Data Center

0 Comments Permalink
0

At a recent event our CIO, Diane Bryant, talked about our continued plan to replace old servers in our Data Centers (http://www.tgdaily.com/content/view/44213/135/). Here is a summary of her key points:

  • Not replaceing servers could have costed Intel $19 million due to high maintenance and cooling cost
  • Our plan of refreshing old servers with Nehalem servers will save Intel $250 million over 8 years

 

If you are an IT manager looking at where you can find extra dollar in your IT budget to invest in new technology, new innovation and new competitive capability for your organization, this must be good news for you! Moreover, if you do nothing, you are opening a hole in your IT budget.

 

Here is a recent white paper and a video we published to discuss our server refresh strategy and how we are getting the cost benefit Diane Bryant shared:

Realizing Data Center Savings with an Accelerated Server Refresh Strategy

 

We have also developed a Server Refresh ROI estimator so you can calculater the amount of savings you can get from these cash machines:

http://www.intel.com/go/xeonestimator

 

If you ain't satisfied, here is a video showing you how to use the estimator!

 

Go and install those cash machines into your data centers now! 8-)

0 Comments Permalink
0

After spending the last 6 months researching emerging technologies around the IT Client platform, I have identified two must have technologies when considering your client refresh.  The first is Solid State Hard disks.  While the cost is a concern at initial glance, the benefit you receive from this technology is incredible.  We have seen benefits such as no more hard drive failures do to failures from moving parts.  Increased performance from faster machine startup and resume times.  Increased application responsiveness from quicker access on a SSD versus traditional platform.  Fragmented hard drives become an issue of the past and you can now save costs on 3rd party defrag tools and/or custom solutions you develop in house.  These are just some of the many benefits we have seen, for more in depth review check out our recently released whitepaper - http://communities.intel.com/docs/DOC-2524. But beyond all of these benefits are the ones you may need in the future.  As IT moves to more and more of a Virtualized Client environment, technologies like these help make adoption much easier.  When testing the Solid State Disks, we noticed that our Virtualized IT environment running in a traditional Type-2 Client Hypervisor actually ran 27% faster than the same virtual environment on a traditional platter based drive.  This brings me to the next technology, VT-d.  This is the next evolution in client support of virtualization.  While todays more common systems have VT-x, VT-d is now available on many newer systems today.  VT-s offers what we refer to as "direct pass through" interface for virtual machines to communicate with the system hardware.  What this means for you is that you can have a virtualized OS that can talk directly to certain parts of your systems hardware without having to go through a virtualization layer in a Host OS.  This will also enable better use of Type-1 Hypervisors or "Native Client" hypervisors that will allow side by side, on at the same time OS operation on a single platform.  Imagine being able to support a corporate and personal build on the same machine but keeping them isolated from each other.  This opens the door to a host of possibilities for future IT shops.  Not all of these technologies are ready to run full speed today, but with most shops carrying a 2-3 year refresh cycle, it is important to buy the right technologies at the right time so when you want to deploy these, you have systems that support them.  So make sure you check these two technologies out and get them into your client roadmap as soon as possible.

0 Comments Permalink
0

I'm sure you've already seen press on the new 7400 series of processes. It is a really exciting time to see 6 core procs coming out. Being an engineer that supports enterprise applications and technologies this should provide a lot of extra power to apps that were CPU bound to 4 procs. One such technology is virtualization and Microsoft's Hyper-V. Previously the limit of Hyper-V was 128 physical procs and 16 logical procs. Microsoft just released an update that will increase those previous limits to support up to 192 physical procs and 24 logical procs! WOW, I can't wait to see that in action. This should definitely help organizations that need to limit their physical footprint of servers with their consolidation efforts.

 

This is a great example of two companies combining their technology in ways that really benefit the customer. Very exciting times...I can't wait for even more cores!!!

0 Comments Permalink
0

For the past year I have been working with several client technologies that revolve around the area of Client Virtualization. As I looked into these technologies and benchmarked them, I began to realize several key things.

 

  • These technologies are finally mature enough to start using mainstream. True they may not all fit your current IT model, security rules or management framework, but that is another discussion. The pure fact is with hardware virtualization now enabled in chipsets, we can expect virtualized environments that perform faster than yesterday's systems and almost as fast as the host OS. Moving forward, technologies will be released that will support side by side OS or multiple instance virtual machines. Imagine a world where IT can manage something as simple as a virtual environment and get out of the platform support and enterprise OS business. There are tools there today that allow this to happen and we have done some work in this area and released a white paper recently with our results, it is called Client Computing with a VUE and can be found at (IT@Intel Client Computing with VUE (Virtual User Environment)). The key is to make sure you start planning around these technologies now, versus scrambling to support them later.

 

 

  • Some of these technologies are flexible enough, they can be used to enable our users in ways we never could before - Imagine going home at night and not having to carry a laptop. Simply carrying a USB stick that has your IT build on it and being able to plug it into your home system to check email, review documents etc. Imagine users having a choice in the platforms they use. No longer is getting a system in IT like picking the first Model T, do you want black or black? We could enable our users today to be able to simply go to any computer access a website, log in and authenticate, and a few moments later, they can have corporate apps streamed to the system they are on and access their data from cloud storage.

 

 

  • IT can sometimes be more than a cost center - After reviewing some of these technologies, I realized we as IT could use some of these to provide more than standard services to the corporate environments we support. Imagine a corporate environment with thousands of desktops that users use day to day but don't fully utilize. Using some of these technologies, we can take processor and memory slices off these machines and add them to a grid computing environment. Allowing our corporation several thousand more process cycles without having to expand their server or data center space.

 

Again, not all of these can drop right into your environment today. Some things may need to change on the technology or your IT side. But the key is this area is changing fast. Let's stop thinking about how we have always done it and instead ask how we should do this tomorrow.

 

 

 

 

Feel free to comment and leave your thoughts!

 

 

0 Comments Permalink
3

Wouldn't it be great if we could buy an application and not have to worry about whether it was designed to run on Windows XP, Windows Vista, MAC OS X or some flavor of linux?

 

How about when you buy a personal computer you don't have to make a decison on whether it should come with Windows XP, Windows Vista, MAC OS X (don't you wish that was a choice today) or some flavor of linux - or nothing and you figure it out later?

 

 

What if every computer you bought came with a smal, highly efficient operating system that basically only acted similar to a virtual machine hypervisor, managing the allocation of resources to virtual machines (or applications). And by the way it was built into the "platform" supplied by the chip vendor and OEM's only aggregated components and added value where it counts - tools to better manage the virtual enviornments, as a peer process not as a "host" operating system.

 

 

This is the world that I would like to see evolve over the next couple of years (okay maybe 5).

 

 

Applications are compiled with the operating system extensions (purchased from today or tomorrow's operating system vendors) and sold as one package that runs on top of the thin/efficient operating system mentioned above. This way we as the consumers can worry about selecting applications and functionality and get out of the business of worrying about which operating system to buy - or worrying about which operating sytem the application will run on. We just buy the application!!! What a concept!!!

 

 

A nice extension to this would be to allow the ability to still have a more traditional "container" of applications for secure, managed interaction between applications and for providing a policy managed environment. But the applications should still be the same apps I buy to run independently - So how about an install option - standalone or in a "container" or ???

 

 

Now that would be cool.

 

 

3 Comments Permalink
1

For decades there had been a simple model in place when it came to consuming software within large companies. It had only two branches, one involved creating something new while the other installation and configuration. Simply stated: "Make versus Buy."

 

Make decisions involved the custom development of an application to fill the requirements of the consumers. This means that the

software development tools, development resources as well as migration, testing and hosting capabilities all had to be maintained internally.

 

Buy decisions analyze the funcationality versus consumer requirements as well as the costs of purchasing, licensing, supporting and the installation, migration, testing and hosting capabilities necessary. Additionally the company providing the product is considered. They are usually a company who specializes in a product or product grouping and can deliver it

at a lower cost than what it would take to build it internally. Oftentimes they can also provide the upgrades and support at a cheaper cost assuming the product meets all your needs out of the box.

 

As the applicaiton portfolios of companies became larger, analysis began to include another branch. Instead of building something new or buying a product to install, you would expand upon the capabilities of an existing tool through merging and/or simply enhancement. This means our simply model is now: "Make versus Buy versus Enhance."

 

Enhance (or merge) decisions brought together the consumers of the current application and those wishing to have additional funcationality. The amount of regressive testing would increase andt the overall architecture of the application had to be considered to prevent the creation of a Frankenstein application; not adhering to your internal guidelines.

 

Much of what I read today seems to be leaning towards a trend in large companies to consume software produced and hosted by someone else. You would think this is the "Buy" branch discussed above, however, the method for both consumption and installation is different. This increases our decision tree to now include "Make versus Buy versus Enhance versus Rent."

 

Rent is a paradigm shift from conventional close-to-chest business practices most companies have used in order to keep competition at bay. Now imagine a time when all you do is start your computer and load a web browser. Inside the browser you have access to all document creation and management, business tools, messaging and any other functionality you need to perform your job. Tthe difference here is that none of these applications are inside your company and you only pay as you use.

 

So where does this leave us as software developers? Are our days numbered?

 

I think not -- yet. The movement to a rent-based consumption model takes time. Time for the company to get over their fears or releasing some control to someone else. The problem is and what most people do not realize is that we do it daily. Think about the electricity that runs your factories and offices and ask yourself where that comes from. Do you create it yourself or do you consume

it as a utility in a renting fashion?

 

For a while software developers will be performing the following:

  1. Building what does not exist

  2. Enhancing

  3. Merging

  4. Configuring

We eventually will be doing less and less coding and more and more configuring. As the industry providing us software (and the infrastructure) matures and the reliability increases you will see a switch.

 

It will take time. Time to settle concerns, time to change opinions and time to move over data and consumers.

 

I imagine that this switch will allow those companies to focus more on their key products and less on the outlying functionality necessary to run the business.

 

What are your thoughts?

1 Comments 0 References Permalink
1

With the old year grinding to a close and opportunities of a new year opening before us, it is a good time to take a moment and make some new year's information security resolutions. Some are good holdovers from last year and a few are new to the list. I think all are good practices to promote security and hopefully will keep a smile on my face throughout the year (no matter what cyber meltdown may occur).

 

  1. Vigilance. Maintaining effective legacy security programs is critical. Loss of such capabilities opens the door to old, known, and well refined attacks

  2. Embrace/Beware of disruptive technology. Double edged bleeding technology can be a blessing and a curse. It can reduce costs, increase efficiency, open markets, and change your way of thinking, but is also like walking into a darkened room in a horror movie. You never know what may jump out at you and in hindsight you may think "well that was painful". On the hot-list:

    • Virtualization technology in all its glory

    • Smart-phones and other PC OS/application based portable devices

    • Social media sites, tools, and accompanying behaviors

  3. Careful with my PII. Our Personally Identifiable Information (PII) is more important than anyone can measure. I will handle mine with care, insure others do the same, and simply say ‘no' more often than not, when asked.

  4. Don't be a fish. Just say no to phishing and spam. Filters are wonderful but a few will creep through. If it looks suspicious, it probably is. Don't be shy, even with the weird stuff sent by people you trust. Just pick up the phone and call them: "Hey Ralph, did you send me this executable attachment via email?" Is it not that tough.

  5. Give an effort for disaster preparedness. Regular backups and encryption are my friends. Nothing huge mind you, but at least apply where it makes sense

  6. Choose not to be a victim and let common sense prevail. Two types of victims exist: those with something of value, and those who are easy targets. Therefore, don't be an easy target and protect your valuables

  7. Talk and share security. We are stronger as a team striving for security, than alone. The bad guys are working together; it is about time we do the same. Talk about security and share what works or doesn't. Don't be shy.

Not rocket science, but most of the great ideas rarely are. Feel free to chime in and be heard. What are your security resolutions for 2008?

1 Comments Permalink
3

 

After over 10 years of engineering enterprise application hosting systems, my current assignment is as Product Manager of Platform Reference Designs (PRDs). PRDs define the technology, capability, and service standards blueprint for hosting platforms. Essentially, PRDs are the standard technology blueprints used to build hosting service(s). While the statement may appear to be a simple endeavor, the reality of successfully defining and managing hosting standards that support a large developer community is a daunting proposition. (I use the term developer community to mean a diverse set of developers who use a diverse set of tools and technologies to meet business objectives.) As with many areas where standards add value, balance must be maintained between the value of standardization and the value of flexibility that embraces innovation. I intend this blog to provide a vehicle to debate hosting standardization and solicit opinions to achieve the necessary balance.

 

 

Yesterday, standards could be effectively managed at the component level technology roadmaps, however as the availability and cost of new tools and technologies (components) has improved, server computing environments are not sufficiently homogeneous to achieve the efficiencies business demands. Hence, we have technologies such as virtualization that allow great flexibility while still achieving economies of consolidation. Virtualization however, does not necessarily improve the operational management costs of supporting disparate systems. It is still clear that a healthy level of standardization is required if operational costs are to remain in check. Standards must begin to be managed at the "packaged" PRD platform level vs. the component technology level to improve the operational efficiency of hosting services. Is this possible/realistic? Does standardization to achieve efficiency, at some point, sacrifice too much flexibility resulting in a loss in competitive advantage? My belief is that PRD platform level standardization is not only realistic, but necessary to ensure a supportable environment and that standards governance is key in ensuring flexibility and standardization remain balanced so that competitive advantage is realized.

 

 

3 Comments Permalink
7

As the industry moves towards the next big leap, virtualization, I can't help wondering will this be a security professionals dream or nightmare?

 

Disruptive technology:

I generalize virtualization as the necessary separation and compartmentalization of resources so things can be moved, consolidated, and managed better, across a wide swath of hardware platforms, users, and networks. It is a "disruptive technology" (not a bad term) which represents a fundamental change in how computer systems will operate, communicate, and be designed. It is a leap forward and represents greater agility, more functionality, and lower costs. The interesting security question is, what are we leaping into?

 

In the virtualization world you can name your poison....er, pleasure: Server, Client, Hardware, Operating System, Software, even data portability virtualization exists or is in development. I am not going to differentiate or explain the differences. Instead I am taking the strategic point of view. All these areas will be developed and instituted in some fashion. The details are far from being worked out. From a security perspective, it is the big picture that is important at the moment.

 

History has shown that the attackers have the advantage of ‘initiative' in technology, over the defenders. Basically, the attackers innovate and security then responds. But will this hold true for virtualization?

 

The Security Dream:

Virtualization holds the promise of security paradise by making systems more robust, hardened, simpler, and enabling new capabilities to make security more effective and cost efficient.

  • Virtualization allows a much greater consolidation of hardware resources. Multiple OS, applications, and databases on a platform equate to less platforms to protect. Consolidation and portability for efficiency sake, may result in less network traffic to monitor, scan, and secure

  • Virtualization allows for effective security sandboxes to be employed for un-trusted or questionable applications and processes

  • Segregation of resources for applications, processes, OS's, and users means a compromise in one will be easier to contain due to compartmentalization. This makes it tougher for an attacker to break a weak link and begin to elevate their control over a system

  • Application restoration is a snap and full systems restoration becomes easier when a client does bite-the-dust

  • Systems and applications can be designed to operate with multiple environments of trust: very secure, secure, marginally secure, and not-so-trusting secure, all on one box (or the informal version: I trust you with my sister secure, I trust you with my wallet secure, I trust you as far as I can throw you secure, and I trust you will steal from me the first chance you get secure)

  • Virtualization will drive standardization of application design and data types making them easier to secure

  • Failover systems become less painful to design and implement at many different levels

  • System upgrades become seamless as jobs can be moved temporarily to other systems and then returned without disruption

  • Virtualization and other supporting technologies will drive advances in real-time security state monitoring, potentially across the enterprise and deeply into applications, OS's, data, and users

  • My personal favorite is that eventually we will have the ability to monitor for suspicious activities from a trusted person, versus just looking at applications or data. Think insider threats. This will be the first significant advance in a long time for this problem

 

The Security Nightmare:

Virtualization may be the very bane of security for decades to come by circumventing every type of security technology and enabling new capabilities for attackers to do real damage, thus forcing an entire redesign and reinvestment of security.

  • At the highest level, virtualization offers pure stealth to an attacker. Currently, malware must hide, lay dormant, or be very quiet in order not to be detected. This limits what the bad guys can do. They must trade capabilities and impact for stealth. Not so with virtualization. Malware could have the best of both worlds

  • Total Control - it's mine, you can't find me, and if you do, you can't make me leave! I can see everything, I can control everything, and I can do anything! Mine, mine, mine! Control can extend well beyond a single system and permeate across the virtual domains, with the persistence requiring an entire group of machines be burned down and rebuilt with great care

  • Now for the sledgehammer effect. Virtualization technology will undermine every current type of security control (the short list):

    • Anti-Virus, HIPS/HIDS, and Host Firewalls - Cannot detect or monitor an attackers activities in a higher plane of control, making them ineffective while still giving the illusion of security

    • Patching - Controlling virtual instances, more importantly creating false ones, will have patches installed on fake instances, leaving the real one vulnerable and under the intruders control

    • Security scanning, used to check the system's state-of-security, can be fooled. Reporting back that all is fine when it is not

    • Encryption - At the right level, an attacker will be able to see before encryption, after decryption, and have your keys to decrypt at their whim

    • Security monitoring devices and agents can also be deceived, by showing them what they expect to see and nothing else

    • User Privacy will be compromised at many different levels and open the risks of aggregation across multiple data sources

    • Adware/Spam filters can be subverted

    • Secure channels can be monitored by attackers and setup between compromised systems

    • Security forensics may become a nightmare for many years due to the complexities inherent to virtualization and the fact that a high level compromise invalidates the integrity of logs

    • Even NIDS/NIPS & Network Firewalls become less effective. Hardware consolidation translates to less traffic on the backbone network and more in-between systems on a platform and within a local subnet. This gives less information to these network monitoring devices and lowers the chances they will detect malicious activity

  • The very same ‘sandbox' which can be used to isolate risky activities can be employed against security applications and processes, limiting their ability to control and protect the system

  • Virtualization adds more complexity and therefore risking more confusion when it comes to system management. Especially for patching and system scanning. Keeping track of who owns what is bad enough today. But at least if you track down a server owner, you can normally have a quick decision on when to patch and reboot. In the future, the server owner, may not know who owns the virtual instances running on their machine. So how does one coordinate downtime, patching, or other change control issues? These delays may extend the window of vulnerability giving attackers more options and targets

  • Less systems but more diversity and ambiguity gives places to hide and more opportunity to find a vulnerability

  • Virtualization portability will drive the standardization of application design and data types, making them predictable and easier to locate and compromise

  • Very complex designs which continually change are extremely difficult to restore and recover. Additionally, cascading failures can occur bringing down multiple systems whereas in a stovepipe environment they would be more insulated

 

Take the High Ground - Sun Tsu "Art of War"

The ultimate sweet spot for any computer attacker is to gain the deepest level of control, which in turn can control all other virtual instances. This is the proverbial high ground which can see and control everything, yet not be seen if it does not want to. Attackers are already making great advances and shown the initial ability to take the high ground. Defenders are quick on their heals, finding ways of detecting and defending this vital area.

 

Who can make the final determination in this battle? Intel and other hardware designers, of course! You can't get any deeper than the hardware. Imbedded security controls will be the key to victory. But here is the twist. You may have assumed I meant the victory to the glorious and honorable path of security. You are wrong. It is just the key to victory, period. Security and administrative controls are just functions with great power. Whoever controls those functions will be the victor.

 

Sometimes, the computer industry itself is its own worst enemy. Infighting on standards, rushing products to market, designing security as bolt-on afterthoughts, ill designed security solutions, etc may cause temporary self destruction. Even when a security function is developed, there is no guarantee it will be embraced by the industry or the consumer. It will take a small army of very smart people across the hardware, OS, application, and security services to design robust controls which present a value proposition necessary for widespread adoption.

 

In the end, the age old battle will continue to rage on between the attackers and defenders. Virtualization is simply the next battlefield. A new landscape to which these players will innovate, respond, jockey for position, and struggle for dominance. The rules and possibilities have yet to be defined. All we know about computer security will be thrown on its side and everything we do now will need to be rebuilt from the ground up. Virtualization is a brave new world, sure to bring both dreams and nightmares.

7 Comments Permalink
43

Recently, a colleague and I spoke to a group of IT administrators in Washington, DC. We left our car in a self-park parking lot in which the attendants had everyone leave their keys in their car, in lieu of keeping them on a valet "key board". They seemed to be depending on reasonably honest customers (we were in a secure area past a government checkpoint) and their own memories to ensure no cars were "lost". We returned to find that the parking lot attendants had completely rearranged the vehicles. Since it was a rental car, it was hard to describe the car and therefore hard to find. (By this point you're probably thinking that I've posted to the wrong board or that Intel pays me by the word, but bear with me)

 

It took a rather lengthy iterative search, but we eventually found the car. As we walked, my colleague and I joked about this as "parking lot virtualization". Our vehicle was moved from one slot to another to better fulfill the changing needs of the parking environment over time. This struck a chord with us, having just been discussing some of the challenges with virtualization.

 

In the data center, most virtualization suites allow an administrator to manually move a workload from one host to another. This is a very powerful concept - instead of having to negotiate for a 3:00am Sunday morning maintenance window to do preventative hardware maintenance, we can move all of the workloads to another physical machine, perform maintenance during normal working hours, and eventually move the workload back to its original location. We can also migrate workloads from a less powerful machine to a newer machine for performance or in order to retire hardware.

 

Combining this capability with the ability to host multiple workloads on a single piece of hardware, the data center can quickly become very complex. Without a robust database to map workload to physical machine (and vice-versa) or an automated update mechanism to adjust these mappings after a move, we can easily lose track of our services. These mappings are needed in order to answer questions like "host/rack/row/room x went down - what services need to be restarted?"

 

My colleague noted that ITIL has mature, well-defined mechanisms to deal with many of these types of events. Change orders, maintenance escalations, and configuration databases were all designed with these business processes in mind, albeit at a much slower (and more manual) pace. It would defeat much of the benefit of virtualization if one had to get a signed piece of paper, email approval, or file a trouble ticket in order to offload a workload in response to a failed CPU fan. Instead, we should use policy to anticipate and enact these types of responses. The discipline and rigor of change management is critical within the virtualized data center, but it must be directly encapsulated by our tools in order to be effective. In essence, the CMDB needs to be dynamically updated in order to maintain fidelity to the Data Center's logical state at any given instant.

 

For those of you who have deployed virtual machines in large-scale production, what techniques have been most successful for managing the chaos of moving services and images? Are you using a glue layer for your legacy CMDB and other management tools, or are you finding it easier to throw them out and depend on the tools provided by your virtualization stack?

43 Comments Permalink
1

As this is my first post in this forum, let me start by introducing myself. My name is John Dunlop and I am an IT Enterprise Service Architect responsible for Intel's IT client solution architecture. I've had this role for less than a year, having previously been responsible for some of our identity & access management services, as well as other backend core services. What an exciting time to have made the shift to the client side of IT! To say that there have been considerable and accelerating advancements in client usage models and application delivery models is truly an understatement.

 

Historically the most interesting and divisive discussions of client architecture have revolved around the debate over thin versus thick clients. Both models have their advantages and disadvantages, of course, but ultimately (as all IT architects know) it's all about enabling the business to have their cake and eat it too. We need to provide a client that is robust enough to survive network connectivity or performance issues, enable an increasingly mobile workforce, support data center consolidation, and satisfy the consumerization and personalization trends that are forcing IT to make more and more compromises to keep customers happy. On the other hand, competitive pressures drive IT budgets ever lower, keeping manageability center stage for providing TCO reduction and making IT managers crave more and more control over the client. Neither thin nor thick clients ultimately deliver on all of their promises, partly because the world has never been that black and white and one size rarely fits all.

 

 

Enter virtualization. Now, some will point out that we've had "presentation layer" virtualization solutions for decades, but again, this shifts us squarely into the realm of thin clients which simply don't serve our mobility needs and shift costs to the infrastructure. The benefits of true, on-board virtualization capabilities were immediately apparent on the server, but client virtualization wasn't taken seriously (as scalable) by many until fairly recently. Sure, you could run a guest OS on a client host OS for training purposes, or to do some specific task that wasn't supported on the host OS, but there was substantial overhead from a performance standpoint, and let's face it, the average user was never going to be satisfied with all the complexity and effort of moving between host and guest. Ever notice how it always seemed to be IT people using a virtualized guest OS for some constructive end? Improvements in technology (e.g. dual core, Intel VT) have meant substantial mitigation of the performance concerns, and the competition to deliver more and more capabilities and transparency in software hypervisors is creating a virtual arms race for the virtual desktop. It is amazing to see how far we've come when when you can run apps in two different operating systems simultaneously as they float side by side on the same desktop, allow cross-registration of applications, and share file systems, task bars, paste buffers, etc., etc.

 

 

Here's where you get that cake. Rather than continuing to evolve that tightly-coupled fat client architecture you've built a career around (so when are you planning to upgrade to Vista?) or continuing to tell your users that mobility is overrated while you shift client support costs to the network and data center with your antiquated thin client strategy, let's think outside the box for a minute.

 

 

Virtualization is about abstraction, and there are several layers where you can exploit abstraction using existing virtualization technologies and products. The most obvious one is between the guest OS and the host OS or hypervisor. This abstraction layer may, for example, allow you to change your client hardware procurement or provisioning model. Even a decision made to leave those business processes alone can be made confident in the knowledge that changing that decision later doesn't require a complete redesign of your client solutions. Some companies are even thinking about discontinuing the practice of providing laptops to mobile workers, opting instead to give them an annual stipend to purchase their own systems with their own OEM support contracts and a host OS they can do with as they please.

 

 

Virtualizing the workspace, even if that remains a tightly-coupled OS and application solution stack for the time being, makes that workspace transportable across devices, easier to recover, even potentially resident on a thumb drive. Because the user has a host OS to horse around with, you can finally lock down that work environment like you've always wanted. And, now you can provide a variety of workspaces through virtualization, including productivity and collaboration, engineering, manufacturing/shop floor control, etc. Making the framework of your client more modular means greater agility for your business, and you can finally begin looking at the workspaces you provide as true services.

 

 

And what about the tight integration of those applications? Another abstraction layer is between the applications and the guest OS. New and old capabilities and techniques can be employed to virtualize those applications, albeit not without some elbow grease within the greater IT organization to stop developing and/or deplolying proprietary or OS-dependent apps to the client. New IT policies that promote standards and provide guidance about the most appropriate forms of application virtualization and application delivery would be an excellent start. Writing applications on Java VM for example, or at least not using proprietary browser extentions in web apps would go a long way toward making applications available across workspaces and operating systems. Even for natively installed applications, adherence to standard data object types and document formats will provide at least the look and feel of virtualization which may be good enough in some cases. I don't have time or space here to get into the merits of Software as a Service (SaaS), but there is a clear paradigm shift occurring in the application delivery space that can support cross-platform "virtualization" of applications, and new technologies are even allowing for the caching of streamed applications that can run even when disconnected from the network!

 

 

Finally, and this may be the hardest abstraction layer of all, there is the holy grail of data virtualization. Imagine thinking about data as being associated with users rather than devices. Why are we still thinking in terms of client backups? I want my data to be available no matter what device I use to run my workspace. If I have a problem with my device or workspace, and a new workspace is provisioned, streamed, or otherwise made available to me, my data should be there as well, protected by some network service responsible for managing my data and serving it up to me no matter what device or workspace I may be using. I must admit that I haven't looked into the options in this area much yet, but I fear this is an area that lacks maturity from a client mobility perspective.

 

 

Naturally, there are significant manageability and security implications for this type of architecture. Hey, I never said this was easy! Many products are coming to market, however, to complement virtualization products to fill these needs. Figuring out how to solve these challenges is worth some time and effort. Client virtualization is not a fad; rather it is an evolutionary step forward that will provide IT and the businesses they support with newfound agility and competitive advantage in terms of lower integration costs, faster turnaround time, and improved user experience.

 

 

1 Comments Permalink