Guest Post: What You Need to Know about Virtualization Security

by Lisa Hoover - Dec. 08, 2010Comments (1)

One of the most important responsibilities of today's sysadmins and IT managers is to make sure any virtualized servers they're responsible for are locked down and protected from malicious or accidental mischief. Yvo Van Doorn, sales engineer at open source audit and authentication vendor Likewise, takes a look at what you need to know about keeping developing an effective game plan for virtualization security.

What You Need to Know about Virtualization Security

By Yvo Van Doorn, sales engineer, Likewise

As the use of virtualization spreads in IT environments, the security challenges IT administrators face are no less real than the challenges of physical security. In fact, they may be more complex. The lure of virtualization is something that many IT staffers find hard to resist After all, when you need a new machine to perform a certain job or service, the capability to just make a virtual machine as needed is a very attractive tool. However, it's this very ease of creation that can create significant security risks for your company: a proliferation of virtual machines will increase the potential for security holes in your environment almost exponentially.

Perhaps the best way to plan for virtualization security is to do just that: plan. Often the assumption is that just because a virtual machine is sitting on a "secure" host system, that's all that needed to keep virtual machines safe and sound. That is simply not the case. A virtual machine will talk to the network just like any physical machine, and without proper patch and security procedures in place, it can be owned just as fast as a physical machine.

Planning for virtual machines in your environment is critical to any security policy in your organization. Enforcing those policies is the second half of the equation. Be sure that all virtual machines are monitored by the policies you have in place, and watch out for virtual machines that connect solely to other virtual machines. It's easy to have those systems get lost in the shuffle.

As much as possible, when it comes to security, you will want to treat virtual machines just like physical devices. You wouldn't stick the mail service on the same server as the company's personnel database, so why put the virtual machine running the mail server on the same physical server that was running the virtual machine with the personnel database? Mixing virtual machines with different levels of importance and trust is a practice to be avoided. Get the high-priority virtual machines onto the same server or group of servers, away from the lower-priority (and perhaps easier to crack) virtual machines.

It's also critical that you play attention to access points, especially at the hypervisor/virtualization layer. If that layer gets compromised, then you've pretty much lost all the virtual machines in the entire layer. Make sure the access to this layer is tightly controlled, and hardened as much as possible. This cannot be emphasized enough: get the right tools to ensure that access to this layer is properly managed.

Another way to control access is to make sure the systems people manage systems access and the network people manage network access. This may seem a bit obvious to say, since that's what most physical-system administrators worth their salt will do anyway. You'd be surprised, though, how many virtual machine admins will happily mix these responsibilities and unintentionally create gaping holes in their networks or systems.

Since it's so easy to create virtual machines admins may be resistant to this kind of policy enforcement, viewing it as an unnecessary burden in the face of "just doing it" themselves. Make sure you drill into them (or yourself, if that's the case) that enforcement of planned security policies for virtual machines is just as critical as physical systems.

Remember, too, that security isn't just about preventing malicious intent. The ease in which virtual machines can be manipulated around your environment can also create problems, even from well-intentioned users and managers. Picking up and moving a virtual machine to another physical server, for instance, may seem innocuous but try telling that to the owners virtual machines that have been moved and aren't where they're supposed to be. Build your plan to include larger administrative polices like this, so virtual machines don't go missing when they're moved or reconfigured.

Virtual machines bring great advantages to organizations, but care must be taken to ensure that their security is managed at least as well as that of physical systems -- if not more so.