New Security Issues Raised by Server Virtualization

Many organizations are relying on the IT policies, processes and toolsets established in the “pre-virtual” datacenter to manage and protect virtual servers, which makes sense. However, virtualized environments do face the same operational threats and risks as traditional servers. But, there are also some specific server security implications that must be considered.

New Operating System

The virtualization layer, is effectively another operating system in the data center – the first in a long time that brings configuration and patching issues.

The good news is that hypervisors tend to carry a much smaller footprint than a traditional operating system with a correspondingly lower potential for security holes. And you will not find a hypervisor surfing the Internet and downloading code. But at the same time it is still relatively immature product, and vulnerabilities are continually found. These vulnerabilities are usually quickly fixed, but should be monitored and tracked.

The maturity of hypervisor technology also shows in its vetting and certificating infrastructure. Plug-ins and add-ons, for the most part, do not go through the testing and certification processes that we see on standard OS’s which can be problematic.

New Target in the Datacenter

Given its access to multiple Virtual Machines (VMs), the hypervisor is an obvious target for attackers, which if compromised could potentially provide access to a range of servers rather than a single “physical” server. And, you only have to look at the buzz coming out of the Black Hat conferences to understand how much of a target the hypervisor represents.

Intrahost threats

A successful guest breakout, would result in an attacker gain access to all traffic from the virtual machines. This was an attack in a lab, but you can bet these researchers are not the only ones in this race.

Referred to as “Hyperjacking”, an attack like this would lead to a compromised platform, allowing full access to all hosted guests. Malicious software could also disguise its presence from traditional security tools that reside in software layers above the hypervisor.

While from a pragmatic point of view, we have not yet heard of a working prototype or found a virus in the wild that attacks the hypervisor yet; - the writing is on the wall and it is only a matter of time before we do.

Existing Security Tools

The traffic inside the host effectively occurs on a “private LAN”, meaning that traditional network server security tools cannot see it, making it impossible to inspect or protect traffic inside this “dead zone.”

Also, many types of security and monitoring tools need to know what they are protecting and where it is in order to be effective - the mobility of VMS can be problematic here.

Other security technologies like IDS, IPS, Data Leak Prevention and Malware Prevention also can be impacted. The constant change enabled by virtualization can place dynamic demands on any “static” types of security solutions, in even small virtualized infrastructures.

Increased Risk of Sprawl

With virtualization we are now dealing with environments where traditional control systems and processes does not work very well, where IT staff is having to plug the gaps with manual process and tracking, and where new VMs can be deployed in minutes. This means a much higher risk of sprawl in the virtual world than in the physical.

In working with customers we have found that most organizations with reasonable control systems will still have around 30 percent of the VMs in their environment that are unnecessary or obsolete, but it takes an audit to figure out which ones and where they are.

Sprawl also increases complexity. Running more VMs in the environment than you need make it

* More difficult to spot the dangers
* More difficult to maintain configurations, and
* More difficult to troubleshoot

Source: itworld.com/virtualization/59445/new-security-issues-raised-server-virtualization