IBM's 'Phantom' to Study Virtual Security

SAN FRANCISCO -- RSA Conference 2008 -- IBM has begun a new research project designed to find and fix security vulnerabilities in virtual computing environments.

The project, a joint initiative between IBM's X-Force security research team and IBM Research, is code named Phantom. It will help identify potential vulnerabilities in virtualized environments and use network and host intrusion prevention technology to guard them.

"There's a lot of momentum behind virtualization out there, but not everyone has thought through the security implications," says Joe Anthony of IBM's Tivoli unit. "Phantom is taking a deeper look at those."

Under Phantom, IBM will develop technology to monitor and disrupt malicious communications between virtual machines. Phantom will also seek out ways to monitor the security state of virtual machines to protect them against known and unknown threats before they occur. "We'll analyze behavioral patterns, not just signatures," Anthony says.

IBM is also looking for ways to secure the hypervisor, which is a central point of control for all machines running on a virtualized platform. "We'll be looking not only at our own platform, but at different hypervisors from different vendors," Anthony says.

Anthony could not say how long the research would take or when IBM might be able to deliver a product from the Phantom research. He did say that the company will likely offer both a stand-alone product and a security service.

— Tim Wilson, Site Editor, Dark Reading