Virtualization Security Risks | Machine Virtualization Security White Paper | Computer Network Security Consulting Portland, Oregon

The "No Network is 100% Secure" series
- Machine Virtualization Security Risks -
A White Paper

Question: Are there any additional, or special considerations, when securing virtual systems that use VMware, Hyper V and others?

Answer: The short answer is "yes".

Virtual machine technology has become increasingly popular as IT Managers seek to do more with less. The good news, for the moment, is that attacks against VMware and similar products are rare. But since the Hypervisor runs as priviliged code, it certainly presents a juicy target for ne're do well Hackers. In addition, once one virtual machine has been compromised, it would be a lot easier for a virus to spead to other VMs and even to other servers in the data center. As virtualization technology becomes increasingly accepted and deployed by IT organizations, we can reasonably expect to see serious exploit attack attempts in the future.

Why does virtualization create additional security risks?: Security threats can originate internally as well as externally in a virtualized environment. Intra-host threats, unlike the old model, can elude any existing security protection schemes. And since virtualized security threats can be hard to pin down, this can result in the spread of computer viruses, theft of data, and denial of service, regulatory compliance conflicts, or other consequences within the virtualized environment and beyond.

Moreover, hypervisors introduce a new layer of privileged software that can be attacked. The hypervisor operates like an operating system and will require patching as the inevitable security holes are discovered. If a hypervisor needed to be patched all virtual machines would likely have to be brought down, thus effecting SLAs.

If a hacker compromises the hypervisor, they now control all data traversing it and would be able to view, redirect, or spoof anything. Guest operating systems would have no way of knowing they are running on a compromised platform. This "hyperjacking" scenario is a particularly serious risk in large virtualization platforms that offer 10, 50, or even hundreds of hosted servers running on a single piece of hardware. The potential risk for loss of control and revenue is considerable and most likely unacceptable.

At this point in time, I doubt that much thought has been given to what would be involved in patching an extensive virtual environment.

Communications between virtual machines are likely to be popular attack targets. Virtual machines have to communicate and share data with each other.

There is certainly significant interest in virtualization security. Some companies involved in these efforts include Blue Lane, Reflex Security and Catbird Networks. BlueLane's product, VirtualShield, finds virtual machines and updates and patches them. Reflex Security's approach creates a virtualized security appliance and infrastructure. Catbird has a VMware certified virtual appliance named V-Agent. VMware has a technology called VMsafe that integrates security software with the hypervisor. VMsafe VMware provides APIs to allow security application vendors to develop products to fend off malware.

It's probably just a matter of time before a major vulnerability threat in virtualized environments emerges. Today, the virtualization security risks are fairly low. But that that could certainly change in a hurry.

Next in the security white paper series:

How Cyber Criminals will mature over the next ten years
Are you vulnerable to drive-by exploits?
High value sites recent hacks
IT employment challenges of the 21st century
Employment reference checking white paper
Competency Certifications White Paper
Firewall White Paper
Virus White Paper
GhostNet White Paper
Password White Paper
Digital Identification Certificates White Paper
Cryptography White Paper
OpenID White Paper
Intrusion Detection Systems IDS White Paper
Rootkit White Paper
Unnecessary Windows XP Services White Paper
Scareware White Paper
Exaflood Internet Brownout White Paper
Cloud Computing White Paper
Proxy Server White Paper
Personal Computer PC Security White Paper
Conficker White Paper
Phishing White Paper
DNS Poisoning White Paper
SPAM White Paper
Best Practices White Paper
Denial of Service DoS White Paper
Trojan Virus Attacks White Paper
Port Scanning White Paper
Monitoring Basics 101 White Paper
Monitoring Basics 102 White Paper
Monitoring Basics 103 White Paper
Aurora vulnerability White Paper
Shelfware White Paper
Outsourced IT White Paper

Easyrider LAN Pro Consulting services:

Network Security Audit and PC Tune-up service

- Proxy server installation and configuration
- Enterprise security consultations
- Disaster recovery planning
- Disaster recovery services
- Capacity, migration and upgrade planning
- Build and deploy central syslog server
- Build trouble ticket systems
- Design and build monitoring environments
- Design and build Network Operations Centers (NOC)
- HP Openview, BMC Patrol consulting