Up and down the stack: Secure Multi-Tenancy

Many infrastructure technologies are aligning beyond simple network, storage and server technologies. If you haven't given attention to Secure Multi-Tenancy, it may be time to do so.

Recently, a partnership between Cisco, VMware, and NetApp to deliver Secure Multi-Tenancy (SMT) is causing quite the stir in today’s infrastructure circles. SMT is a multi-tiered collection of abstraction layers for servers, storage, and networking infrastructure components. Basically speaking, SMT is a consolidated set of infrastructures based on VLANs, virtualized networking with Cisco Nexus technologies, and NetApp’s Multistore storage separation technology. Figure A below shows this representation: Figure A

Figure A

This week, I had an opportunity to have this technology explained to me and learn how it applies to the needs of most organizations. My quick reaction is that I like the idea, but there are a number of issues that need to be addressed.

While I am not a security expert, it is pretty clear that the security aspect of SMT is a developing pillar of the solution. This is made most clearly evident by the presentation of SMT to a group of bloggers at the recent Gestalt IT Tech Field Day event in Boston. One of my colleagues in the blogosphere, Devang Panchigar of StorageNerve.com, has recorded the video of this session, which can be viewed here. There, Cisco presented on SMT but the attendees were less than enamored with the security aspect of the solution. One of them, Edward Haletky, is the foremost systems and infrastructure security resource I know, and he was vocal to that effect.

To be fair, SMT is a version 1.0 manifestation of this next-generation infrastructure architecture. A natural conclusion can be drawn that this area will be improved to meet the needs of provider-class infrastructures, private clouds as well as other infrastructure tiers that need separation up and down the stacks.

There are number of resources to check out to see if this technology works for a specific multi-tenancy application. Here is a good post by ZDNet’s Phil Wainewright on generic risks of multi-tenancy. Specifically for the Cisco, NetApp, and VMware SMT solution this overview and this validated design document can give an idea of where the solution would fit.

I am all about abstracting services from infrastructure; I do it already with VLANs, security zones, virtualized storage, and virtualized servers. My issues start to mount up when the entire stack is virtualized to a single solution, potentially removing the ability of an infrastructure team to fine-tune the inner workings of network, servers, or storage.

Assuming the general opinion of the security aspect of the VMware, Cisco and NetApp SMT solution improves, do you see multi-tenancy as a viable infrastructure solution? If so, share your comment below.