Cloud Security Alliance (CSA) has announced that the international standard ISO/IEC 21878 – Security Guidelines for Design and Implementation of Virtualized Servers has been published as of November 2018 .
The purpose of this document is to provide security guidelines for the design and implementation of virtual servers (VSs). Design considerations focusing on identifying and mitigating risks, and implementation recommendations with respect to typical VSs are covered in this document. CSA APAC will continue to work closely with APAC countries to demonstrate standardization and technical expertise at the international level.” said Dr. Hing-Yan Lee, Executive Vice President for Asia Pacific, CSA.
In November 2018, ISO approved the publication of ISO21878 “Security Guidelines for Design and Implementation of Virtualized Servers”. The Co-Editors of this international effort include Mr Xiaoyu Ge, IT Security and Cloud Services Standards Director from Huawei as CSA’s representative.
The intended goal of this document is to facilitate informed decisions with respect to architecting VS configurations. Such design and implementation configuration is expected to assure the appropriate protection for all virtual machines (VMs) and the application workloads running in them in the entire virtualized infrastructure of the organization.
Data center infrastructures are rapidly becoming virtualized due to increasing deployment of VSs for cloud computing services and for internal IT services. Since VSs are compute engines hosting many business-critical applications, they are key resources to be protected in virtualized data center infrastructure. As VSs are becoming main stream in typical data center infrastructure setups, the secure design and implementation of VSs forms an important element in the overall security strategy.
The motivation for this document is the global trend in enterprises and government agencies deploying server virtualization technologies within their internal IT infrastructure as well as the use of VSs by cloud service providers. Hence the target audience is any organization using and/or providing VSs.
“IT Security is always an important consideration for customers and the industry. Huawei has been involved in CSA and ISO/IEC JTC1 SC27 standardization activities for a long time, and we look forward to continuing work with CSA and other standards organizations for a better and more secure IT industry” said Yolanda You, Senior Standards Director, Huawei IT Product Line.
The scope of this document specifies security guideline for the design and implementation of VSs. This document is not applicable to Desktop, OS, network, and storage virtualization, and vendor attestation. It will benefit any organization using and/or providing VSs.
(Image Courtesy: www.laserfiche.com)