But it's questions such as these that demand to be addressed to find out what options exist to tackle virtualization and cloud security. In MacDonald's view, there needs to be a wide range of security controls in the VM, such as virtual firewalls, intrusion-prevention systems and antivirus, in addition to load balancers and traffic shapers.

Increasingly, vendors such as Altor, , Juniper, IBM, Hytrust, HP, Enterasys, McAfee, Catbird, StillSecure, Sourcefire, Reflex Systems and StoneSoft are offering virtual-appliance options for firewalling, monitoring and intrusion-prevention, for example. For the VMware platform, "Check Point has gotten furthest along," said MacDonald. "After a slow start, finally the big security vendors are making progress on their virtual-security controls."

VMware has provided VMSafe APIs to facilitate hypervisor-based "introspection" so that multiple software agents are no longer required. The need to deploy and run agent software has traditionally "been the bane of our existence," MacDonald acknowledged. But there are still a lot of questions about exactly how this works.

Trend Micro, seen as the No. 3 player in antivirus behind Symantec and McAfee, has been the fastest to embrace some of VMware's ideas on this, including support for VMware's latest security APIs, in its Deep Security product that can perform A/V scanning for vSphere. Trend Micro has been charging less for VM-based A/V software, perhaps figuring "it has nothing to lose," MacDonald said.

The downside of the Trend Micro Deep Security approach with vShield, though, is that "stub code" for VMware is still needed to make it work and a hypervisor extension, plus it's for only and it quarantines but does not remove malware infection; it only does anti-malware scanning, MacDonald said. And the possible drawback with vShield, which has the software taking on the role of firewall, is that it's so specific to VMware vSphere, customers will end up with "another silo."