Intro

Virtualization is the foundation of efficient on-premise and cloud information service provisioning. While most of what we know about traditional security applies, securing virtualized systems has additional requirements. In this video, I explain how virtualization works for implementing production servers, common vulnerabilities, associated threats, and how we maintain a safe virtualized operational environment. You can download the script for this video, which is formatted as a study guide, from the link above or at the end of the video.

What is Virtualization?

Virtualization technology is a simulation, a simulation of hardware and software in what is known as a virtual machine or VM. These virtual machines run on top of a hypervisor that manages how the VMs operate, how they interact with each other, and how they interact with the outside world. The VMs and the hypervisor run on a host hardware platform.

Hypervisor Types

There are two types of hypervisors: Type 1 and Type 2. This is an example of a Type 1 hypervisor, also known as a bare metal hypervisor. The hypervisor runs directly on the server with no underlying operating system. This is a Type 2 hypervisor. It runs as an application dependent upon an operating system, an OS that provides an interface between the hardware host and the hypervisor. The introduction of an OS increases the attack surface of the host system. Let's focus on Type 1 implementations. Again, a hardware server serves as the host providing shared resources to the hosted VMs, resources including network interface cards and storage. Each host runs one hypervisor, managed via a management portal, that initiates VM instances and coordinates sharing of hardware and virtual resources. The hypervisor abstracts the host's hardware from the software, translating communications between virtual and physical elements. The VMs are known as guests. They run the same or different OS, as shown here. The hypervisor can also be used to implement and manage virtual switches, firewalls, and other virtual network appliances. Each VM can be stored as a file that can be used to create or instantiate more servers needed for the same purpose. Before moving on, it's important to understand that the virtualization we are discussing in this video is different from the use of containers. A VM managed by a hypervisor is not a container. I cover containers in a future video.

Virtualization Benefits

Virtualization has benefits beyond forming the foundation for cloud computing; it provides for more efficient use of infrastructure resources. Applications and services running on a traditional hardware server do not usually use all of the available processing, storage, and I/O resources, and that leaves CPU, memory, and other capabilities unused but paid for. When additional servers are needed to implement additional applications and services, more hardware is purchased, resulting in additional unused resources. Virtualization enables the creation and use of VM servers residing on a single hardware platform, allowing for maximum use of resources through sharing in traditional data centers. Bringing up a new server to meet additional demand can take days or weeks, following an approval request, purchase approval, purchase, receipt of hardware, setup, testing, and implementation, not to mention the additional costs. Bringing up a virtual server only requires instantiation of an existing VM file, a file containing a fully tested and configured server.

Attacks against virtualization

According to the CISSP common body of knowledge, there are two common attacks against virtual environments. The first is trojan virtual appliances. Trojan virtual appliances are malicious VMs created by threat actors, distributed via commonly trusted channels, and implemented by IT teams without proper safeguards, providing threat actors with entry points into either cloud or on-premise environments. Another attack is VM jumping. VM jumping usually occurs because of misconfiguration of the virtualization environment, allowing traffic between VMs on the same host, traffic that enables a threat actor's payload to pivot from one compromised system to others. Risks associated with these and other attack vectors can be mitigated with the right controls.

VM Security

Organizations must harden VMs just as they would any other network-connected device, including killing unneeded services, closing all unneeded ports, implementation of anti-malware, use of each VM for a single purpose, running only the applications needed to achieve that purpose, patching, including the patching of VM files that are stored on disk, authentication, and authorization for access at a level needed for associated risk. Each VM should be isolated from communicating with other VMs on the same host. This is easily done with virtual solutions like layer 3 switches and firewalls that enforce microsegmentation. For a deeper look at microsegmentation, read the article above. ...and separation of duties that include only allowing admin access to each VM based on business need ,and hypervisor admins do not need VM admin access and VM admins do not need hypervisor admin access.

Hypervisor Security

Hypervisor compromise can give a threat actor full access to the host and all VMs it hosts. Hardening the hypervisor requires establishing a separate management segment separate from general business access to the host. Authentication is always a high-risk situation for hypervisors, requiring more than one factor, two or more of something the admin has, knows, or is. A hypervisor admin should have no admin access to any business VM server. Management of the hypervisor, as with any software security, must understand emerging hypervisor vulnerabilities and apply patches when available. All unused virtual hardware should be disabled, and all unused services such as the clipboard and intra-VM file sharing should be disabled. The clipboard allows the movement of information from one VM to another. Sharing of files or drives on the host can lead to movement of malicious payloads and stolen information, bypassing other attempts to prevent malicious communication between VMs.

Host device security

The first consideration for host security is moving to Type 1 hypervisor implementations, eliminating the need for an operating system. If Type 2 hypervisors are used, organizations must harden the OSs, following the same steps already described for VM hardening. Again, access to the OS should be highly controlled and admin duties segregated as needed to separate OS maintenance from hypervisor and VM maintenance. And of course, physical access to host systems must be tightly controlled using appropriate physical security safeguards as described in the video playlist above.

Software Defined Networking (SDN)

Software-defined networking, or SDN, is a way to centrally manage routers, switches, and other network management devices that control where, how, and when to allow specific traffic. SDN solutions use software and controllers to make a central change, which is then automatically applied to all relevant devices, enabling fast and consistent management of virtualized and traditional infrastructure. SDN provides significant advantages to security, as shown. SDN consists of three layers: the application layer consists of the portal used by network or security engineers to manage network devices; the control layer is the intermediary, receiving instructions from the app layer, and communicating them to the relevant data devices located at the data layer. In this example, a detected attack is quickly managed by applying pre-configured settings to block the threat actor or a malicious payload from moving past the affected network device. Changes are quickly made because a security or network engineer does not need to visit each device needing a change. This is especially helpful during an incident or after identifying changes needed to protect against zero-day attacks. In addition, SDN enables better configuration consistency. Changes are made where needed, and an SDN portal can help inspect what we expect. For more information about SDN, watch the video above. And that's it for this video. If you have questions, please ask. ...and until next time be careful what you click.