All Posts

Does anyone have any thoughts on the impact of virtualization on server security? I was chatting with a security expert (who will be apparently speaking on an Interop panel in May) and he was genuinely concerned with the security impacts of: decoupled software and hardware; VM sprawl; software updates; and complex server stacks. How is VM sprawl any different from physical server sprawl and all of the issues it presents? I don't see virtualization creating any new headaches in this realm, only perhaps the same ones people have in the physical world. He also said that HIPS/NIPS/Firewalls were never designed to protect these kinds of sprawling (hard to manage) environments. Some of their functionality will continue to function, but any features tied to hardware-based signature processing (very common in mature security solutions) would be rendered "virtually irrelevant." How is a virtual environment hard to manage? Treat VMs similar to a physical machine. You still need to patch the OS, maintain the software, update AV definitions etc...

More specifically, what do we do with all of the "moth-balled" servers as software patches/updates are made available? I cannot patch instances; and I'm similarly concerned that the sprawl of virtual machines will expand beyond my partitions....

Please be specific on your security concerns so that the vendors can analyze and address the specific threat due to lack of such protection. For example, if there is a hardware signature requirement, let virtualization vendor know the deficiencies of the product and understand how to implement such security requirements to minimize the threats. I see many security experts express their concerns, but not ready to help the community. I am also looking for security scanning tools so that my security folks can test my environment for any flaws before I go for production.

Well the alternative is they put the COS on the internet...that should be much more secure :O) "Security" teams really tick me off as 9/10 times they are morons that really can't do any of the work themselves and they make people jump through hoops to prove things to them. As a "Security" team it is their job to certify and prove things are safe or unsave in an environment...not to push freaking paper...

Check out the "Compliance and Security Discussion" forum and search for "NSA", there is some stuff in there. On the other hand, how do you know that the firewalls you/I are using are totally secure? I suppose they can get certified via common criteria or FIPS or whatever but it's still software and that software will have bugs just the same as ESX. I think ESX and most firewalls are written so that any bugs that are uncovered are less likely to be exploited due to "fail safe" errors, that is, the code will fail safe when exploited. Ben

Encrypting the VM volume is not really the answer here. What you need to do is seal up the OS (inbound and outbound) within itself. This will give you the self protecting layer you require. Encrypting the vm volume will only stop other volumes/ hosts accessing it, not control the effects you are talking about in your thread. Good luck.