Compliant with security standards

[brettedman]

Hello colleagues,

Are the virtual machines running on ESXi 5.5 considered to be secure from each other?  In this scenario, I have taken 4 physical machines, each running an application server and now run them on 1 physical machine running ESXi5.5.  The machine has a separate NIC for each of the now virtualized application servers.  The previous security model worked because there was physical separation of the application servers - one being breached wouldn't impose immediate threat to the others. Is there is same level of security now, even though the application servers all run on one piece of hardware?  Are there any products can that help configure or report settings to keep auditors happy?

Best Regards.

[vmroyale]

Hello and welcome to the communities.

Note: Discussion successfully moved from VMware ESXi 5 to Security and Compliance

[Texiwill]

Hello,

The short answer, yes they are at the hypervisor layer, at the networking layer, that depends on how you actually have things configured. I think you may have gone a bit overboard with the pNIC to VM ratios but what you have could work depending on how you have the vSwitches configured for the 5 or so networks that are a part of vSphere by default. Check out Security of the VMware vSphere Hypervisor for details on the hypervisor. You can also check out Top Virtualization Security Links | The Virtualization Practice for some general resources on virtualization security. The books in the signature cover security from deployment through virtual and physical firewalls, segregation, and separation, etc. They may also be helpful.

I would suggest, that if your Auditor does not understand virtualization, then get a new auditor who does, or if they are an internal auditor provide them with resources so they can learn about virtualization.

Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009, 2010, 2011,2012,2013,2014

Author of the books 'VMWare ESX and ESXi in the Enterprise: Planning Deployment Virtualization Servers', Copyright 2011 Pearson Education. 'VMware vSphere and Virtual Infrastructure Security: Securing the Virtual Environment', Copyright 2009 Pearson Education.

Virtualization and Cloud Security Analyst: The Virtualization Practice, LLC -- vSphere Upgrade Saga -- Virtualization Security Round Table Podcast

[brettedman]

Hello again,

Let me rephrase my question to be a little more specific:  Is the ESXi hypervisor secure enough on its own for multi-tenancy?  Assume each of the "tenants" has a pNIC configured with an individual virtual switch in ESXi.

From what I see, this should be a secure and compliant configuration, but I think that the mere existence of products like the former vShield has my security manager convinced ESXi must not be secure.

-Brett

[Texiwill]

Hello,

I believe it is as long as you have the proper controls around the management stack. Outside of that the hypervisor really is a black box and does protect itself. All those items I referenced are very good to read and determine this for yourself. Your security folks will need to do some reading as well to understand what is going on under the covers.

Even though you have tenants on their own vSwitch, you do not need to actually use their own pNIC, that is a fallacy but depends on your understanding of virtualization security, how the hypervisor works, how vSwitches work, and how you can use 3 distinct virtual networking control planes to segregate various components. Hypervisors are hybrid devices, they are compute, network, storage devices. as such they have 3-4 built in networks that need to be protected: Management, Storage, vMotion, FT, and workloads. The workloads can be split into tenants.

To determine if multi-tenancy is allowed, you really need to look at the whole picture, it is more important to have a good architecture. However, if your security team does not trust the hypervisor then your security team needs to get educated before you can even start on that architecture.

Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009, 2010, 2011,2012,2013,2014

Author of the books 'VMWare ESX and ESXi in the Enterprise: Planning Deployment Virtualization Servers', Copyright 2011 Pearson Education. 'VMware vSphere and Virtual Infrastructure Security: Securing the Virtual Environment', Copyright 2009 Pearson Education.

Virtualization and Cloud Security Analyst: The Virtualization Practice, LLC -- vSphere Upgrade Saga -- Virtualization Security Round Table Podcast