[That is 'phat' as in fat (thick), not cool...]

Interesting news this week with Phoenix Technologies announcing their Hyperspace / Hypercore technologies. Joanna Rutkowska of blue pill fame has been working with them so they get some immediate virtualization security street cred, but what does this mean for the long haul?

I can see immediate security benefits of separation of resources, but over the long haul this initiative seems sort of underwhelming to me unless they plan on competing with the major hypervisor-as-next-gen-OS players. Granted, they have a pole position during boot up, but with booting getting less and less frequent, and all sorts of code injection techniques becoming popular, I don’t think this is as important as it may have once been, unless there really will be separate physical resources as well (maybe that is the benefit that I am not getting – perhaps memory is physically isolated as well).

In any case, updateable BIOS software having hyperspace apps added to the mix doesn’t give me warm fuzzies. While I agree with the general assertion that fewer people will understand the technology in the short-term (where is Homer’s "D’oh!" when I need it?) and therefore there will be fewer attackers, I would rather folks take that benefit with a grain of salt. The fact is, to whatever extent this architecture ends up popular, this benefit will decrease significantly.

Virtualization is hot, no doubt, and all of these announcements by chip manufacturers, OS vendors, and application vendors doesn’t strike me as obviously good… in fact, I tend to worry quite a bit about how this complexity and flexibility will quickly erase security benefits that aren’t necessarily going to be realized in the first place. (This is especially true when I hear terms like "side-to-side" and "nested" being used.)

Expect lots of competition for local and network I/O resources along with the need for persistence (config and storage) and open architectures (e.g. plug-ins and utilities) to really put a dent in long-term security benefits. (And the job of the security professional to get that much harder ).

[Btw, I am finishing up my "five immutable laws of virtualization security" for publication in the near-term - send me a note if you want an advance copy.]

See Chris Hoff’s coverage of this topic on Rational Survivability (choke) .