Adaptive defense measures against the security hazards induced by systems virtualisation

The explosive proliferation of systems virtualisation supports a more adaptive delivery of IT services. In the area of security management, however, virtualisation carries beneficial as well as detrimental implications. Fig. 1 shows the sources of requirements on security management: they originate either from technical sources, in a bottom-up view, or from high-level goals. As the business management is held liable for financial damage caused by IT security incidents, e. g. due to the BASEL II and SOX regulations [1,2,3], security measures are no longer a task which is exclusively handled by the IT staff. Governance, Risk, and Compliance (GRC) frameworks focus the support of these three business critical management areas on the strategic level.