"Section 3.7 of the PCI DSS Virtualization Guidelines specifically calls out securing dormant Virtual Machines and we must comply with that regulation or face fines and/or penalties."

CFO, Major US Retailer

Increase Security and Reduce Costs of Virtualized Environments

Every day, a growing number of companies adopt virtualization strategies. New demands in data center space consolidation, development requirements, and personalized work environments are driving the shift to virtualized infrastructures. By definition, virtualization multiplies the amount of data across several non-physical server instances. This in turn, multiplies the inherent costs of storing those Virtual Machines (VMs) and heightens security concerns. Gartner cautions that virtualization security issues are becoming more critical and complex. VMs that are powered down (dormant) are more vulnerable and leave sensitive data exposed, resulting in security and compliance risks.

Organizations looking to capitalize on the benefits of virtualization must also consider the costly factors of security, compliance regulations, increased storage requirements, and IT complexity.

Section 3.7 of the PCI DSS Virtualization Guidelines states that “though dormant, inactive VMs represent a viable security threat and therefore must be identified and tracked so appropriate security controls can be applied”.

PKWARE vZIP™ encrypts and compresses virtual machines prior to them being archived; enhancing security, achieving compliance, lowering storage costs, and decreasing transfer times.

  • Secure virtualized environments: Secure dormant VMs with strong encryption while protecting them as they are transferred and archived
  • Meet compliance: Securely archive dormant VMs in accordance with industry regulations; helps meet FIPS 140-2 compliance
  • Reduce costs: Reduce Virtual Infrastructure storage requirements and defer storage capacity acquisition
  • Simplify IT infrastructure and increase productivity: Minimize mistakes and training needs by leveraging VMware® centralized management capabilities to streamline the workflow of archiving dormant VMs

 

Success Story: US-based Retailer

Based on our research, unsecured dormant VMs are causing problems for enterprises around the world. One such company, a US-based retailer, recently virtualized their entire IT infrastructure.

The Company has realized it has an excess of “stale Virtual Machines”. Due to regulations, the Company is required to keep these VMs for seven years. Some of the VMs contain sensitive data, but the retailer can’t identify which ones. They are putting themselves at risk of non-compliance or worse yet, a security breach. In addition, storage infrastructure and data center space costs are on the rise and the proliferation of dormant Virtual Machines is driving up their monthly IT spending.

The retailer believes that using PKWARE vZIP will allow them to compress all of their dormant VMs. With vZIP, they expect to compress VMs by up to 80% prior to them being archived or copied, thereby dramatically reducing storage and transmission costs. At the same time, vZIP will allow them to secure dormant VMs using strong encryption, making it impossible to gain access without the right credentials and minimizing the risk of a security breach while maintaining compliance with PCI regulations.