Joanna Rutkowska highlights the value of "security by isolation" (hat tip: Hoff) after her recent research on SMM bugs. The isolation she is advocating relates to the virtualization capabilities being added to Intel and AMD chips. Clearly, there is a benefit to isolating programs that are currently being run in the same processing space. This isolation is risk reducing, primarily because the consequences of a compromise are lower (presumably lower value of information, data, and/or access available).

Conversely, and importantly, the opposite is true as well – when we aggregate resources that were previously isolated – like when we combine two physical endpoints into logical units on a single physical endpoint or move from a physical DMZ to a virtual DMZ – then our "security" (I would use the term risk) is increased (all other things being equal).

It is not uncommon for folks to mistakenly infer from discussions about the isolation benefits of virtualization to believe it always makes virtualization "more secure" than physical systems. That is why it is important to point out this is not always true – in fact, at this stage of development it is probably more popular to migrate physical DMZs to virtual DMZs (risk increasing) than it is to separate (or isolate) applications that are currently sharing processing space.

I refer to these two scenarios in virtualization as Immutable Laws number 3 and 4.