From firewall to 'firebox' for the data center

In the US, Mercy Medical Center's security wish list is far from atypical and The Baltimore healthcare provider wants to make sure that users access only the services and servers they require and that its data-center servers remain secure and problem free. Nevertheless, it hasn't yet found quite the right technology combination.

Network access control (NAC) gear from ConSentry Networks handles the user-access-control piece, but the technology doesn't give Mercy Medical a way to address the additional, server-level security it would like. "We want to segregate the servers in the data center from one another," says Mark Rein, the center's senior IT director. The organization needs this separation because it opens its data-center servers to third-party vendors handling certain management and maintenance duties. "We want them to access just that one server or application, and not be able to see or talk to any of the other servers. It's like we need NAC, but at the server level."

This is not an extravagance. "The server is the primary attack-point nowadays, which means that the server is also a great jumping-off point," says Joel Snyder, a senior partner with Opus One and a Network World product tester. "As organizations have heterogeneous data centers -- mixes of Unix flavors, Windows, old mainframes -- there are going to be issues with older systems that might not be patched or closely protected becoming infected and turning into attack vectors for other servers."

That can be an especially brutal problem for enterprises whose security defenses line up at the edge of the data center. If an attack gets through to a server and rides over unprotected high-speed, server-to-server connections, the enterprise quickly gets compromised. Never mind the problems encountered when these servers exist in a virtualized environment.

"Most of our servers are virtual servers sitting in blade chassis. When you start looking at how these virtual servers are potentially talking or co-mingling over the hypervisor to one another, that's a tough problem. At this point, available tool sets are not really great," Rein says.

• Bookmark this page
• Share this article
  •  
  • facebook
  • slashdot
  • digg
  • Reddit
  • stumbleupon
  • linkedin
  • twitter
• Got more on this story? Email Computerworld
• Follow Computerworld on twitter

• Share
  Share this article

  •  google+
  • facebookfacebook
  • slashdotslashdot
  • diggdigg
  • RedditReddit
  • stumbleuponstumbleupon
  • linkedinlinkedin
  • twittertwitter
• print
• email
• Bookmark