© 2014 byThe Enterprise Strategy Group, Inc. All Rights Reserved. 
 
Overview 
Over the past few years, enterprise organizations have consolidated data centers, embraced server virtualization and 
cloud computing platforms, and developed new web and analytics applications designed for horizontal scalability. In 
aggregate, these trends have led to massive increases in data center scale and complexity featuring a monumental 
growth in network traffic—especially east/west or server-to-server traffic within the data center itself.   
While these changes tend to be welcomed by business managers, CEOs, and CFOs because they accelerate application 
development, streamline operations, and cut costs, they come with significant risk from a security perspective.  The 
growth in east/west traffic creates new risks and attack surfaces that need to be monitored and protected. Software-
based provisioning and orchestration are antithetical to tried-and-true information security technologies and best 
practices based upon the slow and steady world of physical assets, resulting in a “provisioning gap” of days or weeks. 
Many first generation virtualized security products were simply software appliance versions of traditional physical 
appliances, maintaining the mismatch between the old world and the new. Additionally, massive increases in data 
center scale places a burden on the security team itself as it tries to keep up with these changes using existing security 
tools, processes, and personnel.   
The growing mismatch between data center advances and existing cybersecurity strategies creates a number of data 
center security challenges. For example, ESG research indicates that 46% of security professionals working at enterprise 
organizations (i.e., those with more than 1,000 employees) say their organizations find it difficult to keep up with the 
latest security threat intelligence, 44% struggle to monitor network activities, and 39% are challenged with monitoring 
server activities (see Figure 1).1 
 
                                        
                
1 Source: ESG Research Brief: Top Security Challenges for IT Assets Residing in Data Centers, May 2013. 
ESGBrief 
Virtual and Cloud Security Designed for the Data Center 
Date: August 2014 Author: Jon Oltsik, Senior Principal Analyst 
 
Abstract: Data center security is in a perilous position. Large organizations have been using server virtualization 
technology for nearly 10 years and are currently testing/deploying private cloud platforms like OpenStack and 
VMware vCloud, and using cloud-based infrastructure from Amazon, IBM, Rackspace, and others. In spite of this 
progress, however, many firms continue to rely on perimeter security technologies and architectures based on 
physical security products like network firewalls, IDS/IPS, and other L4-7 technologies to protect physical and virtual 
servers. This creates significant risk to the enterprise, as legacy security tools don’t offer the right levels of agility, 
flexibility, efficacy, and visibility for today’s virtual data centers. CISOs need to address this precarious situation by 
introducing virtual network security services into their data center security strategies. Virtual network security 
services can offer L4-7 security controls and provide network security visibility for virtual workloads regardless of 
network topology, workload mobility, or physical location.  Virtual network security services can also offer cloud-like 
orchestration with central control, software-based provisioning, and a variety of security controls that provide the 
ability to align with workload privacy and security requirements.

ESG Brief: Virtual and Cloud Security Designed for the Data Center                                                                                  2 
© 2014by The Enterprise Strategy Group, Inc. All Rights Reserved. 
Figure 1. Data Center Security Challenges 
Source: Enterprise Strategy Group, 2014. 
When viewed together, these ideas may lead one to the conclusion that data center security is in a perilous position. On 
the one hand, the security team can’t keep up with the scale and automation of server virtualization and cloud 
computing. On the other, they lack the right skills, processes and tools to keep up with threats or monitor the data 
center environment. 
ESG believes that this situation should set off alarm bells in the CISO’s office in light of the fact that enterprise 
organizations face an unprecedented threat landscape featuring targeted attacks, advanced malware, and persistent 
adversaries. Furthermore, most cyber adversaries have a single goal in mind—stealing valuable data that typically 
resides in corporate data centers. These adversaries exploit the lack of visibility and control over east/west traffic in the 
data center to move laterally between servers and VMs from the point of initial compromise to the valuable data that is 
their target. In many cases, these lateral moves can be done without the cyber adversary ever crossing a traditional 
perimeter security device. Given this scary situation, security teams should have adequate resources and tools so they 
can stay on top of everything that goes on in the data center. Alarmingly, however, they remain way behind in data 
center security from an organizational and technology perspective. This creates a risky situation where enterprise 
organizations are engaged in a game of Russian roulette with the cyber underworld. This is a game they are bound to 
lose.   
Data Center Security Demands a New Technology Approach 
Why are so many organizations addressing virtual data centers with the same old security processes and technologies 
designed for the physical servers and networks of yesteryear? ESG research indicates that while only 17% of firms 
27%
27%
30%
30%
31%
36%
37%
37%
38%
39%
44%
46%
0%
10%
20%
30%
40%
50%
Insider threat
A shortage of qualified security skills
Incident response
Security forensics and investigations
Keeping track of  configuration changes
Scanning for vulnerabilities on a regular basis
Keeping up with technology changes
Event detection
Patching systems in a timely manner
Monitoring server activities
Monitoring network activities
Keeping up with the latest security threat intelligence
In your opinion, what are the biggest challenges your organization faces with regard to 
protecting the IT assets residing in its data centers?  (Percent of respondents, N=395, 
multiple responses accepted)

ESG Brief: Virtual and Cloud Security Designed for the Data Center                                                                                  3 
© 2014by The Enterprise Strategy Group, Inc. All Rights Reserved. 
believe their existing security physical technologies are adequate, many firms remain uncomfortable with virtual security 
appliances and don’t have the right skills, knowledge, or organizational structure for modern virtual security controls 
(see Figure 2).2 
Figure 2. Reasons why Enterprise Organizations Aren’t Using Virtual Security More Extensively 
Source: Enterprise Strategy Group, 2014. 
What’s Needed? 
As Indian activist Vinayak Narahari "Vinoba" Bhave stated, “You can’t fight a new war with old weapons.” Regrettably, 
this is exactly what many organizations do, relying on status quo physical security appliances or first generation virtual 
appliances that replicate the physical architecture to protect virtual and/or cloud-based technology assets. Based on the 
many public security breaches that have occurred recently, this strategy obviously isn’t working very well. 
It’s clear that CISOs need to adjust their security technology strategies but many remain confused about exactly what 
they should do. ESG suggests that large organizations alter their historical perspective, and think of data center security 
                                        
                
2 Source: ESG Research Report, Network Security Trends in the Era of Mobile and Cloud Computing, August 2014. 
9%
17%
27%
28%
32%
32%
34%
37%
0%
10%
20%
30%
40%
Nothing is holding us back from more extensive usage of
virtual security appliances
No need, our existing physical security technologies are
adequate
The use of virtual security appliances involves too many
disparate IT groups with their own agendas and processes,
so we find it best to avoid using them
Lack of knowledge/understanding about virtual security
appliances/technology
Virtual security appliances require additional management
which is too much of a burden for our IT operations
staff/processes
Lack of trust in virtual security appliances/technology
We prefer to use our existing security
technologies/controls, even if this is not the most efficient
method for virtual server security
IT/compliance auditors are uncomfortable with virtual
security appliances/technology
Which of the following factors, if any, have held your organization back from more 
extensive use of virtual security appliances for filtering traffic between virtual 
servers?(Percent of respondents, N=294, multiple responses accepted)

ESG Brief: Virtual and Cloud Security Designed for the Data Center                                                                                  4 
© 2014by The Enterprise Strategy Group, Inc. All Rights Reserved. 
as a series of virtual network services rather than specific hardware devices or software packages. In this context, virtual 
network security services should: 
 
Conform to any form factor in any location. Virtual network security services should be available in 
physical, virtual, or cloud-based form factors. In this way, CISOs can surround workloads with tailored 
protection and change form factors over time as needed. Furthermore, virtual network security services 
must account for the fact that today’s data center workloads are dynamic and mobile so they can change or 
move across servers, data centers, and geographies. When a workload is replicated across data centers in 
New York, Paris, and Hong Kong, virtual network security services must have the ability to recognize and 
audit replication activities, and then apply the prescribed security controls across each workload regardless 
of physical or virtual location. 
 
Provide for easy orchestration of granular control of disparate workloads. Cloud computing is based upon 
foundational principles like user self-service, instant workload provisioning, and easy orchestration.  Virtual 
network security services must support this model by integrating with cloud provisioning and orchestration 
tools to enable on-demand security control provisioning at the same time as the servers and applications 
themselves are provisioned. They must also align security services with the characteristics of specific 
workloads. For example, web servers may require access control and DDoS protection services, while 
database servers may need specific security controls for firewalling, IDS/IPS, and network segmentation to 
meet corporate governance standards. Granular controls should include a host of services across Layers 3 up 
to the application layer. 
 
Remain network-topology-agnostic. While network topologies are rather static, server virtualization and 
cloud computing are highly dynamic since changes are dependent upon software options rather than 
physical device configurations. To keep up with rapid application and business changes, virtual network 
security services must be freed from topology restrictions and be more aligned with software-defined 
networking flexibility. This type of model means that virtual network security services can live on virtual or 
physical networks, travel across WAN links, or hop from one IP subnet to another as workloads move from 
corporate data centers to cloud service providers.   
 
Facilitate detection and remediation of laterally moving threats.  Modern data breaches can typically be 
broken down into a series of small steps; starting with the establishment of an initial beachhead, followed 
by an escalating series of attacks that ultimately result in the compromise of a critical asset. Rapidly and 
accurately identifying attackers moving across the data center requires an awareness of east/west 
application semantics and traffic patterns. Virtual network security services must facilitate the use of 
multiple detection methologies to detect the different stages of an attack, and tie the disparate alarms and 
alerts they generate into a cohesive picture of the lateral progression of an attacker. Once detected, virtual 
network security services must also enable the remediation of a threat through blocking or other policy 
controls. 
 
Connect to form a security architecture. Virtual network security services must form a scalable enterprise 
architecture featuring central command-and-control (i.e., provisioning, policy management, change 
management, orchestration, etc.) and distributed security controls for policy enforcement. To be consistent 
with other requirements, distributed support must be topology-agnostic with the ability to follow workloads 
as they move across servers and data centers. Finally, virtual network security services must also 
interoperate with existing security tools like SIEM systems as well as server virtualization/cloud 
management and orchestration tools like vCenter, MS System Center, Puppet, Chef, AWS, etc.   
 
Deliver comprehensive visibility. Virtual network security services must have the ability to collect real-time 
data and feed analytics engines so that security analysts can assess risk, modify security controls, and 
detect/respond to security incidents. These services should provide visibility into all data center traffic, 
including intra-hypervisor communications. Given the sophistication of the advanced adversaries facing 
most enterprises, visibility and control systems should include OSI layers 2 through 7 details.    
To ease deployment and operations, virtual network security services will complement legacy perimeter-based network 
technologies like firewalls, IDS/IPS, load balancers, etc. Finally, virtual network security services must also be positioned

ESG Brief: Virtual and Cloud Security Designed for the Data Center                                                                                  5 
© 2014by The Enterprise Strategy Group, Inc. All Rights Reserved. 
for the future by supporting forward-leaning technologies like network function virtualization (NFV), OpenStack, 
software-defined networking (SDN), and VMware NSX. 
The Bigger Truth 
Albert Einstein is quoted as saying that the definition of insanity is doing the same thing over and over again and 
expecting different results. Unfortunately, this is exactly what many enterprises are doing with data center security as 
they continue to use physical security technologies to protect virtual workloads running in cloud computing platforms 
across multiple data centers. This strategy doesn’t work and will only grow less effective as cloud computing and server 
virtualization infrastructure usage expands. 
CISOs must not only recognize this mismatch but also do something about it. To do so, they must assess burgeoning 
requirements, research virtual security innovation, add virtual security skills to the infosec team, and begin with virtual 
network security services testing and POC projects. As with all security projects, there is no substitute for seeing the 
effectiveness of a solution in the real world. CISOs should ensure that their POC strategies involve testing at least the 
visibility capabilities of virtual network security services in a production environment. 
 It’s clear that server virtualization, mobile applications, and cloud computing will continue to proliferate at enterprise 
organizations. Given this fact, CISOs don’t have the luxury of time on their side. The sooner they research, test, and 
deploy virtual network security services, the better.   
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
All trademark names are property of their respective companies. Information contained in this publication has been obtained by sources The Enterprise Strategy 
Group (ESG) considers to be reliable but is not warranted by ESG. This publication may contain opinions of ESG, which are subject to change from time to time. This
publication is copyrighted by The Enterprise Strategy Group, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy 
format, electronically, or otherwise to persons not authorized to receive it, without the express consent of The Enterprise Strategy Group, Inc., is in violation of 
U.S. copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact ESG 
Client Relations at 508.482.0188.