I get asked all the time whether it is “safe enough” to run different levels of security on the same physical hardware if you have a hypervisor separating the load. The answer is, of course, it depends. We have complex control models and detailed explanations that prove hypervisors can reach even the highest (e.g. FISMA High) level of measurement. But the issue is really not about controls available, it is about management decisions and configuration.
To put co-tenancy in a broader context, consider the latest decision by the Obama administration regarding the obvious plight of Polar Bears. The U.S. Fish and Wildlife Service today published in the Federal Register a proposed rule and draft environmental study. This new draft is meant to replace a Bush administration 2008 attempt at a rule that was voided in 2011 by federal court. The public has two months to comment and already there is a clear backlash based on broad risks of co-tenancy.
A proposed rule aimed at protecting endangered polar bears doesn’t even mention how the federal government will address global warming, which is seen as the primary threat to the Arctic predators.
[…]
Both the current proposal and the previous Bush rule exclude activities occurring outside the range of polar bears — such as the greenhouse gas emissions of industrial polluters like coal plants — from regulations that could help stop the bear’s extinction.
Unfortunately, it seems bears have no service level agreement with their provider that they can use for leverage against the harm that is coming from their neighbours. The administration also presents an interesting argument against controls that seems completely upside-down.
In the new environmental assessment, Fish and Wildlife managers argued that not issuing an exemption for harm to polar bears outside the Arctic would lead to a plethora of citizens’ lawsuits which, the agency said, had little chance of prevailing. Such suits would take up agency staffers’ time that could better be spent helping polar bears, they said.