Multiple Personalities vs. Multiple Tenancy: One Bromide’s take on VDI & Security

Author: 5 Comments Share:

Is dissociative identity disorder the prescription for bridging the gap between IT protection and user empowerment? Imagine that I gave myself the task of separating my work and personal identities in this post, according to the currently advocated principles of desktop virtualization espoused by vendors. Just as they would advocate that users separate their activities for work into their corporate desktop VM, and their personal activities into some other context (iPad/personal device) then I would need to separate the components of my blog that are personal from those that are work related. The personal parts would go on my personal blog, and the work related could go on blogs.bromium.com. Would that make it easier to write or to read? No, quite the opposite. It would be indecipherable (trust me, I tried to post this blog exactly in such a fashion and got lost). Would it achieve a sufficient degree of separation between my different thoughts to satisfy IT? Maybe, but why bother if the separation is so artificial that the flow is meaningless? What’s the point of forcing a user to divide their brain into two halves, to attempt to separate personal and work, if the result is a subpar user experience that still ultimately fails to implement a practical boundary between the “me at work” and the “me in my own opinion”?

Further, if IT does successfully define and implement an artificial boundary between my work and personal metaspace, do you think an attacker will be inclined to abide by it? Will the malware masquerading as an email from my wife, my boss, my bank, HR, etc. arrive in my personal email account, or my corporate one? Right.

In the past I have been accused of taking a harder stance on VDI than is appropriate given its increasing attention in the market. When I was at Citrix I evangelized TS-based desktops over VDI (“heretic!”), and now at Bromium I’m focused on securing physical endpoints rather than delivering virtual desktops (“flip-flopper!”). Therein lays the same quintessential problem we at Bromium are trying to solve manifesting itself through my position vs. the position of my company. As difficult as it may be for some readers to separate my opinion from the Bromium stance, the same notion of persona plays out on corporate desktops: How can IT tell the difference between what I do for work and what I do for me?

In lieu of a good solution to this quandary, IT predominantly turns to restricting or disabling functionality (e.g. DLP), erecting barriers around the desktop (e.g. VDI), and putting resource devouring protection tools on the desktop to catch bad things when they do get in (e.g. AV).

Two weeks ago Simon Crosby and I presented at the BriForum event in Chicago. We spent much of our time there butting heads with the giants of the app/desktops virtualization scene, asserting that neither application nor desktop virtualization should be sold or bought under the guise of providing security benefits. I’ll attempt to condense what I believe much of the debate boils down to, and spell out both my own and Bromium’s perspectives (they are slightly different). Allow me to begin with my own conclusion:

Any security solution that doesn’t put productivity ahead of protection will have failed prior to implementation.

I believe the biggest security threat to enterprise IT is Shadow IT.  Shadow IT (or BYOD, CoIT, FUIT.. as I’ve come to call it, BYOIT) exponentially increases the enterprise attack surface beyond anything that we can measure, because we can’t know what we don’t know.

Implementing solutions that force end-users, us humans who for the most part don’t have multiple personalities to develop dissociative identity disorder in order to remain in compliance is neither pragmatic nor holistic, and forces us to work and play in different contexts because IT said so with no added productivity benefit. It’s contrary to how we interact with our world, ourselves, our computing devices, and thus destined to fail.

Policy vs. Humanity

Users will find ways around barriers to productivity. This applies to desktop virtualization, mobile hypervisors, client hypervisors, anti-virus software, proxies, and locked down work PCs. Thus, a “security” challenge to IT leaders out there is: proactively deploy what’s in the best interest of users rather than what best serves IT.  Else, what is the user’s incentive for adopting enterprise tools in lieu of working around barriers using existing apps available for free/cheap on the web/AppStore without jumping through hoops?

Security - Enablement Venn Diagram

The above image is a slide I see in a lot of IT strategy decks. Two spheres that define IT’s stakeholds, essentially boiling down to Security and Enablement, with some magic solution that brings these two together in a Venn diagram. The last point I’ll make before transitioning to my Bromium voice (an octave lower with a British accent, say) is that these two circles need to be one sphere, not a Venn diagram – because everything that falls outside the intersection of Security and Enablement represents lost productivity on one side, and security gaps on the other.

Bromium’s position is more succinct:

Users have to enter domains of unfathomable trust in order to do their job. Attackers target trusted applications with advanced, undetectable malware. Humans click on bad links and open infected attachments. Humans write imperfect code, other humans exploit these imperfections. Dividing the workspace between the datacenter and the end-point does not mitigate these threats nor reduce the attack surface of the operating system and applications.

We see our micro-virtualization technology as complementary to both VDI and application virtualization, by protecting the end-points that access hosted desktops and applications we extend IT’s ability to protect sensitive data and infrastructure while empowering the end-user to remain productive at all times in all places.

Back to me.

Brian Madden, the founder of BriForum, refers to the Consumerization of IT as a sort of IT Arab Spring. Perhaps that’s an overly dramatic metaphor, but it does cut to the heart of the matter: although likely not a conscious struggle of me “the user” vs. you “the authority” – there’s just this stuff out there that I need in order to get my job done. Maybe it’s some web site with data I need, or an app on my phone or tablet, or a file created at home on my personal laptop – so I browse, I download, I e-mail, I produce and get my job done. IT can try to slow or stop me by “restricting” or “disabling”, but I’ll circumvent policy in search of productivity. It’s not a protest; it’s just the way things are.

Previous Article

Announcing Bromium vSentry

Next Article

Toward “Trustworthy By Design”

You may also like

5 Comments

  1. Lots of good off-blog chatter of this on Twitter and LinkedIn.. I wanted to make one minor correction based on some of these discussions. My challenge to IT should have read:

    Proactively deploy what’s in the best interest of users rather than what’s easiest for IT.

    1. Great blogs and follow up. Lots of respect for you instead of being portrayed as vdi bashers, but Simon started it! :p

      The easiest route for IT is what’s best for the users. Risk mitigation, security, and management is unique to the business case. SHVD, CHVD, RDS, Traditional PC. All of these solutions tackle the desktop management problem differently. Some have inherent positives out of the box, while others can be configured to have the same benefits. All I can say is that the most secure technology is now dependent on Bromiums Microvisor compatibility.

  2. I am 15, my knowledge in IT far surpasses any teacher and my dad who is also good in IT. This post sure does spell out everything I have done in school, the administrator has done exactly what this post describes yet I circumnavigate most of it, find loop holes in policy and potential data leaks, I am not a hacker. I am just curious.

    the day Bromium is released I will be sure to keep up top date with it all, it is a shame that i have not enough knowledge to keep up with you guys, if i did i would follow this link.

    http://www.bromium.com/careers.html

    1. Kyle – At 15 you write better than I do at 35, so kudos to you, young man. When I was your age I had Ferris Bueller’d our school library system by convincing a fellow student to type some commands into the library terminal. Not sure I did that for the sake of productivity, but uh – I was young and innocent! 🙂

      The thing is – these systems are built wrong. They are focused on keeping you out rather than keeping sensitive information in. Silly when you think about it. Hopefully as you progress through your education and thereafter you will continue to ask these questions. Don’t kowtow to the status quo.

  3. That post sounds like a day in my life as a IT consultant. Disclaimer: I work for a Citrix partner and normally build a few SBC/Terminal Server thingies here and there. 🙂

Leave a Reply

Your email address will not be published. Required fields are marked *