Security has always been a pivotal argument for Internet services but during the past year security concerns surged because of the high number of incidents regarding security breaches, non-authorized data accesses, backdoors and vulnerabilities exploited by hackers and governments and affecting both small businesses and tech giants. That is also affecting legislation of countries and even bigger entities like European Union. That scenario is very important if we consider the progressive transformations started inside both companies and governments that are leading to massive digitalization of data while such data are also being transferred from internal datacenters to worldwide service providers.

Hence responsibilities for service providers are growing as their tasks now also include securing customers data even when they are using third-parties systems that cannot be fully controlled. Just think about operating systems or hardware components like switches and so on.  A recent scandal involving hardware components like firewalls and switches sold by Juniper Networks, used by thousands customers and datacenters worldwide to secure their networks, is only the latest example in a very long row. Service providers have to secure their systems, their networks, their employees and their partners but they also need to account problems arising from bugs and vulnerabilities that are very hard to anticipate because they are affecting components not under their direct control.

Improved security inside service providers infrastructure

Dealing with those problems is not easy because when a customer transfers his/her data to a service providers, a relationship of trust is built between the customer himself and the service provider and such relationship exposes both of them to some risks. Notwithstanding that, there should be a way to improve security even when accounting a possible security breach affecting the service provider and the only possible way to improve that scenario is empowering users to avoid the need to concede a privileged access to users’ data to service provider itself when users are transferring their data in.

We basically need to provide a shield protecting users’ data when the service provider infrastructure suffers a security breach and that involves making the provider itself “blind” to the actual data it is managing. At the same time, service provider should still be able to manage its services the way it needs so such extended protection should not affect normal operations and thus be effectively transparent.

Introducing shielded VMs: a new layer of protection

To solve that problem, VaiSulWeb plans to deliver during the current year a new service whose goal is to provide an additional layer of protection even in circumstances when a security breach might affect a part of our infrastructure, possibly for software bugs or hardware vulnerabilities.

The key is allowing our customers to create a set of secure data that will be used to encrypt virtual machines running inside our infrastructure. Such data will not be available to our technicians thus they won’t be able to access machines data by any mean, effectively creating an extra layer of protection for such encrypted machines. Our technicians will still take care to provide services to run such virtual machines as usual but in case of a security breach, whatever that might be, hackers will not be able to use any vulnerability to gain privileged access to customers’ data. In facts, they would still need that very same secure data that customer used to encrypt the virtual machine.

How it works

Going into more details, the new service will rely on two different components :

  • a small infrastructure that will be managed by our customer and that will store secure information needed to run and encrypt virtual machines on our own clusters;
  • resources reserved on our infrastructure to host encrypted virtual machines.

The first component will only store secure data that allows our company to host encrypted virtual machines on our own virtualization clusters. Our technicians will have no access to such infrastructure but they will be able to implement it for our customers.

Our users will then be able to create new encrypted virtual machines from their own signed templates or from our approved templates, customize security settings and start them on our clusters. When a shielded virtual machine starts, it will check if our customer authorized its execution on our hosts, thus avoiding that machine to even start if it’s running in another environment, and disabling any local access by clusters administrators. That machine will then be shielded and any privileged access by our technicians will not be allowed. That, of course, is not meant to protect such machine from VaiSulWeb technicians, rather to protect it from any security breach that could happen if, for example, credentials to access our infrastructure will leak or be discovered.

Apart from that, shielded VMs will just work side by side with other VMs, with no special limitations or restrictions. That also allows our customers to run a mix of shielded and traditional VMs according to his/her needs and without limitations.

Who will benefit by running shielded VMs

The new service will available to all of our customers but those that will benefit the most by running shielded VMs are those customers that need to manage sensitive data or data for third-parties that have specific security requirements (local or central governments, financial or medical organizations and so on). That might also be useful to gain specific security certifications.

Delivering innovation

VaiSulWeb is always focused on delivering innovation and innovative technologies and the service that has just been described confirms that trend. Our company aims  at solving problems that our customers are facing, especially because of the ongoing digital revolution. We will provide more information about shielded VMs in coming weeks. In the meantime, our technicians are available to discuss with our customers their specific needs regarding that new service.