I appreciate the question and I get this a lot. I think your instincts are sound and I am pleased to see you elevating to risk. I'll answer this in two parts.

In most cases, you won't have a choice. The cost reduction benefits of virtualization are tremendous. As you know, risk-based decisions are about cost/benefit. With virtualization, we have unclear and unidentified costs, but very compelling and measurable benefits. The benefits are so compelling, organizations are going to adopt virtualization regardless. This is especially true in this down economy. Our burden is to take on a role that assures we leverage sound security thinking to safely embrace the benefits of virtualization while maintaining acceptable risk.

In regard to who's done assessments... I've seen several partial sources. This video tutorial represents a subset of a greater amount of analysis that my colleagues and I have done as part of IBM's Project Phantom. We've done a tremendous amount of work on this subject with research, security, the virtualization platform vendors themselves, and our clients in real-world deployments. Additionally, there is a great deal of analysis done by a blogger, Chris Hoff. His "The Four Horsemen of the Virtualization Security Apocalypse” does a great job exploring several risks (link below). Additionally, Chris tells me he is a week or so from posting an anonymized case study, which may address a lot of your concern.

It is an interesting question. I will attempt to answer it this way: I have not seen anyone map the new attacks surfaces to the OSI model. Instead, you'll see on the links to the right, "Virtual Points of Exposure," in which there's a "box and wire" diagram of the new components and new attack surfaces of virtualization. In our presentations, we do explore each in detail.

Your traditional OS and application stack and corresponding risks remain. In addition, you will note that there are new attack surfaces in the form of VMs; hypervisor or virtual machine manager (VMM); specialized hardware used for virtualization assist; management functionality, and even the non-traditional "virtual" network access paradigm.

You still have the risks you do on a physical server. There are additional risks based on the additional components and functionality. There are several new risks to availability. And further, the impact of a successful compromise is now magnified -- as a single compromise threatens the rest of the collocated resources.

Compliance is lagging behind. By their nature, most compliance and regulatory standards target mature best-practices. Therefore, they will always lag behind evolution in IT and the threat landscape. This is one of the reasons you'll often hear security professionals say "Compliance does not equal security," or "Compliance is necessary, but insufficient," or even "Compliance threatens security."

Let's take PCI as an example. PCI DSS 2.2.1 states: "Implement only one primary function per server." By strict interpretation, you can't virtualize -- period. In reality, auditors have de facto rules of thumb such as "You can mix applications with applications, but not databases with databases." Late last year, many hoped that PCI 1.2 would get more specific about virtualization, but it did not. Although, since then, a special interest group has been launched to look more closely at virtualization.

At this point, the best advice I can give is to consult with your auditors early and often. A lot is this is open to interpretation and negotiation. It is better to know how they plan to audit you -- before you get off course. Measure twice, cut once. Regulators are working on this issue.

The short answer is a qualified "yes." The functionality will vary by vendor. In fact, the virtualization platform vendors are trying to differentiate amongst themselves, in part, based on management and auditing functionality. Some are further along than others on this front.

One thing to keep in mind: These controls will in no way displace your existing frameworks -- as real-world networks will have a heterogeneous mix of platforms (both physical and virtual). The native functionality will contribute to your overall management. Ask your platform vendors about their current and future plans here. Also, be vocal about your requirements -- and you are more likely to get what you need.