Peter Christy

Virtualization and Security (Redoux)

Up until now, VMware treated security by saying as little as possible about it, knowing that arguing that virtualization didn't open up new security surface area just gave credibility to the thought that maybe it did (let sleeping dogs lie) which could only impede sales. Now that VMware is looking beyond the individual virtual machine, and thinking about the Cloud, they have started to talk (credibly) about how virtualization actually helps security. The issues are ultimately complicated (thank goodness there are bright analysts to think about them J ) but here's the basic story line. (1) If you want to talk seriously about the Cloud or even utility computing you need to talk about entire applications — virtual applications or Vapps — that include all the bits needed to get the job done, not about single virtual machines. (2) In order to deploy a Vapp to the Cloud (or even to a private utility or DR data center) you need to specify how it is to be protected. At first blush, a good answer is "just like you did before" except now the security can be largely provided by virtual appliances rather than the physical appliances used previously. (3)When specified on a Vapp by Vapp basis, and implemented by virtual appliances, the security can be as specific and customized as desired. For example, you can think about offering data leakage protection (DLP) tailored to the function and specifics of the application. You need to bind these security specifications in with the other application details so you know what else needs to be provisioned when the application is provisioned and you know where you can and cannot run the application (e.g., what other applications you can co-mingle with). Where it makes sense, part or all of the security can be specified parametrically (e.g., "PCI protection") so that as the regulations change, the specifics of the protection change automatically. VMW's observation is that binding security to the application and assuring it is provisioned as specified is a lot better than what we have now, where in most cases this is partially a manual process, and often requires coordination between multiple teams, all of which is complex, expensive, and prone to errors. The automation also makes it possible (and reasonable) to be much more specific about each application which is also good. Thus, virtualization makes security easier and better.

Virtualization at 50,000 feet

So here's a view on what's happening (the proverbial "big picture"): (1) MS has successfully queered the virtualization price structure making VMW offer the hypervisor for free. (2) That makes it clear that VMW isn't going to grow just selling the technology -- it's the higher level systems and management tools that you'll get paid for -- so they have repositioned themselves as a data center O/S company. (3) But that means that they are in a sense admitting that MS has been right all along -- virtualization is important but it's only one piece of a puzzle -- it makes VMW's position against MS scarier. (4) The vision is now clearer -- we want services that can be moved flexibly throughout a resource fabric (enterprise data center and cloud service provider) -- and we want an individual to be able to get to his personal (virtual) system from more or less anywhere and anything in the world. This is the attractive future that virtualization promises. The problem is that compared to virtualizing a single server this is really difficult system engineering and is going to take a lot of work to accomplish. Progress is going to start to slow down fairly dramatically as we collectively grind on these really hard problems. Don't get impatient. Sit down, watch a baseball game, smell the roses.

Networks Heat Up

A notable year in high-performance networking has turned a technical conference into a very relevant discussion of important commercial issues. Stanford's 16th Hot Interconnects Symposium (formally an IEEE meeting -- 27/8 August) has what looks like some remarkably interesting discussions including a keynote and two panels on Wall Street networking, a talk by Mendel Rosenblum on Virtualization and Data Center Networking, and a keynote and technical papers on how to deal with all the cores in tomorrow's multicore CPU's (see http://www.hoti.org/hoti16/program/ ). 2008 is the year when 10G networking started to be competitive, virtualization swept the data center, multicore impact started to be felt in earnest, and when the importance of computational intensive finance became all too clear. Even if the technology of on-chip optical interconnect isn't what lights your personal fire, you might very well find something important at this Stanford meeting.

Let the Hypervisor Wars Begin!

Microsoft seems to be feeling reasonably good about Hyper-V. Microsoft VP Bob Muglia reports it is functionally complete and performance complete and what remains is ringing out the bugs (as far as I can tell the stability is pretty good already). Mu said it was very surprising to him when they did their first performance testing against VMware ESX last fall and found the HV performance to be in the ballpark. When I first met Bob he was a Windows NT product manager. A key workload for NT was File Server and the competition was Drew Major's NetWare (as regular readers will now, Drew is in my pantheon of software gods). It took Microsoft until NT 4 to be performance comparable with NetWare so you can imagine Mu's surprise and pleasure to find HV Alpha code in the ballpark. The comparison between HV and ESX is complex. Microsoft knows it will take some time to catch up with the full VMW functionality. On the other hand, out of the box HV is supported by System Center, a much more comprehensive management system than virtual center. And just make things interesting and weird, MS announced and demonstrated System Center managing ESX, and MS support for management of key UNIX variants (along with OpenSourcing the integration technology). So this time MS is the heterogeneous, embracing vendor (that clearly tickles Mu too). How this all plays out is yet to be seen. MS points out that they know how to coordinate virtualization with Windows and key MS applications better than anyone and that should be quite valuable (e.g., to make virtual infrastructure memory management more efficient). In any case, MS is cranking up all the MS sales and competitive engines so things should get lively. When I pressed Mu at the MMS analyst meeting to say how we should observe competitive progress he said that after 18 months in the market if they weren't shipping more hypervisors than VMW he would be very disappointed. "Microsoft is very good at high-volume, low-cost software you know" (Hyper-V is priced at $28 if you missed that). Game very much about to be on.

System Center -- Front and Center

I've been attending the Microsoft Management Summit for three years now and the evolution is worth watching. The management effort began in earnest five years ago when Bob Muglia faced the fact that manageability was a liability for Windows server and hired Kirill Tatarinov from BMC to fix the problem. Kirill and his team developed a 10 year vision around the "dynamic systems initiative." The initial reasoning for the effort was that with good systems management Windows Server could have superior overall cost-of-ownership compared to alternatives like LINUX. The management systems team developed a pretty good plan and Muglia put his money where his mouth was. I think it's fair to say that five years into this ten year plan systems management is now a Windows Server asset rather than a liability. A little over a year ago the discussion started to move to focus on System Center (the Microsoft branding for the whole product line) as a profitable line of business rather than just a Windows Server asset. From what we heard at MMS we're estimating that the product line will close this year just south of $1B certainly a credible number even within MS. Perhaps more interesting, System Center (in turn built on SQL Server) is becoming a focal point for the virtualization strategy (virtualization management integrated with hardware, operating system and application management in contrast to VMware's "virtualization is everything" strategy) and also now at the core of Microsoft's Forefront Security as well. Muglia still describes it as five years into a ten year vision, and speaks to more sophisticated model-based applications (I'm expecting that some of these ideas will become clearer in the forthcoming Oslo release). The analyst meetings at MMS are getting a lot more popular (they used to be intimate little events).

Virtualization (and financial jitters)

The frothiness in VMW and GOOG stock has to make you wonder if we learned anything during the dot com bubble or not (seems not). RVBD recently got an unpleasant Wall Street haircut for no apparently good reason other than a partial return to investment fundamentals. VMW and GOOG float above all that. Since VMW is now valued at roughly $40B and parent EMC at $47B if you do the math since EMC owns 90% of VMW, the market doesn't value the rest of EMC very much (to be fair the market knows that EMC can't just go and liquidate the position). The froth in virtualization places an intense and not very pleasant light on Microsoft and exactly where Viridian is (or isn't). There is no shortage of grim stories if they are to be believed. Microsoft should (in my opinion at least) get the Nobel Prize in Software for having collapsed all their operating systems down to a single code base, but now if you reflect on the consequences, there is high pressure to get Windows Server 2008 (the operating system previous known as "Longhorn") out, and pressure to release Vista SP1 (the likely trigger for real enterprise uptake) and in the middle of that you have the Viridian team trying to ram intimate hypervisor code right into the middle of the code base. Thank goodness I don't manage software development anymore! Anyway, if you talk to customers they all will look at Viridian when it finally shows up (a) because (remember) virtualization is all about Windows primarily and (b) it will be free and free is a lot cheaper than what VMW charges today. Or maybe VMW will conspire with private equity and do a hostile leveraged buyout of EMC, or even Microsoft J.

VMworld Rocks

This was my fourth VMworld and the biggest and the best by a goodly margin. The attendee count was up to over 10,000 (the first was 1,400), the exhibition huge, and the buzz bigger than ever (nothing like a successful IPO and $30B market cap to create quite a party atmosphere).  The interesting news was the announcement of ESX-3i which is just the hypervisor.  It's been slimmed down and it's being bundled as integrated flash memory with a new generation of virtualization optimized servers (to steal Dell's term). These diskless machines just have to be racked and cabled and powered on, and the VMware management system automatically discovers them and adds them into the hardware mix (so simple that even a CEO can do it as Diane Green gamely demonstrated). Having the hypervisor a cleanly separated layer (previously it was shipped with an attached Linux based controller) makes it easier to visualize some of the ways in which it might be exploited. In Mendel Rosenblum's closing keynote they used hypervisor-to-hypervisor communications to implement an experimental high-availability system, and Mendel gamely demonstrated pulling power on the primary Exchange server and in fact the backup took over mid stride (showing I guess that even a CEO's husband could do it although he's also a Stanford CS Professor so the test might be rigged). Mendel suggested an interesting strategy of taking some more of the nastiest system problems (HA in this case) and looking to see whether the virtualization abstraction could be used to greatly simplify them as was the case in data center consolidation.  The future of virtualization is clearly in front of it. The only dark cloud is that it is also becoming quite clear that it is getting to be really complex stuff so the simplicity is somewhat skin deep. It's clearly going to be another exciting year for virtualization!

First Mover Advantage

The energy that was around at VMworld was electric -- the type of energy that comes from being around an exciting market disruption.  Things are moving fast in the virtualization world -- customers are racking and stacking VMware systems at breakneck speed.  Vendors want to partner with VMware in the hopes that some of its magic will rub off in the process.  Channel players are moving to get a piece of the action.  For you business school majors, VMworld was a hands-on look at First Mover Advantage.  Since most of the server virtualization taking place is around Windows servers, you'd expect Microsoft to chime in pretty soon which, from the looks of things, won't happen until Microsoft's new hypervisor ships which will be about six months after Windows 2008 ships.  In the meantime, VMware is moving quickly to consolidate its first mover advantage.  Unlike what's happened with emerging markets in the past, Microsoft has no margin of error -- they've got to "get it right the first time" just to remain in the game.  There are those legendary stories about how Bill Gates had to personally intervene to get Microsoft to take the Internet seriously.  From the looks of the virtualization world, Microsoft is going to need a similar monumental course correction or else this market slips away without even a fight.

Chambers at his best

We're shameless John Chambers keynote groupies and from that perspective have watched his current theme evolve over the last 6-9 months. It starts with the issues of productivity and GNP growth and discussions with Alan Greenspan, and evolves into organizations based on collaboration rather than command and control and the contribution of network-enabled collaboration. He really got it together for VMworld (or maybe he doubled his Coke input for the event). We highly recommend watching (especially the last third or so). It was one of the best discussions on the business value of virtualization that we heard all week because he went beyond the ROI value propositions to make a strong case for business improvement -- he really nailed it.  You can find it from the front page of www.vmware.com following the VMworld keynote pointers (John was on the second day).

Jagadeesh Surfaces

Our old friend B.V. Jagadeesh emerged as CEO of 3Leaf, a server virtualization company.  3Leaf, like Xsigo -- a similar company that came out of stealth this week -- develops intelligent I/O fabrics built today on Infiniband interconnect (although all claim to be interconnect agnostic and will go with what makes most sense over time). These fabrics simplify and optimize I/O in virtualized data centers by helping consolidate the dense LAN and SAN server connections onto Infiniband as well as by adding significantly to the management of these subsystems under virtualization. Interestingly, at the same time Cisco is moving away from this direction having taken the Infiniband-based TopSpin system and moved it back to a control appliance that is no longer in the data path. If all that weren't complicated enough, Ed Bugnion -- Vmware founder and CTO -- is now CTO at Nuova, a Cisco-funded startup. Nuova is working to make Ethernet safe for SAN (which requires some changes to the Ethernet standards). With these changes Cisco will use Ethernet for the consolidated virtualization fabric.  3Leaf's founding CEO and now CTO -- Bob Quinn -- had what might be the clarifying perspective as to these different approaches. Quinn argued that virtualization isn't going to quickly break down the functional stovepipes in the data center, and you can't build products that are for the storage guys, the network guys and the server guys. 3Leaf is very explicit about building products for the server guys and making its use transparent to the network and storage teams. Cisco is obviously going to build for the network team. Cisco can evolve Ethernet but startups can't.  Having turned NetScaler around and arranged the marriage with Citrix we were wondering what BV would do next. Now we know and we're excited to watch it unfold.