The advent ofvirtualisationis changing the way we
think about datacentres, servers and networks. Not only does
virtualisation shrink the footprint of the server population, it
also simplifies the physical network. However, there is a knock-on
effect - the original hardware server was probably protected, but
the virtual server is not.
When a server is virtualised, it is layered on top of an
operating system called the
hypervisor.
This is the master supervisor of the inputs and outputs for the
server. When another virtual machine (VM) is added to the server,
the hypervisor manages all the network linkages and any connections
between the two VMs. One advantage is that there are no physical
cables, but the downside is that any security gateways that may
have existed between the original servers are now absent.
As far as has been made public, there have been no instances of
VM hacks. That does not mean that these are more secure, it just
means that hackers have either not cracked the techniques yet or
that virtualisation is not yet commonplace enough to attract their
attention while there are easier pickings elsewhere in the physical
server world. In a recent report from analyst firm Quocirca, only
17% of its 301 respondents had consolidated their servers to any
degree. Clive Longbottom, service director for business process
analysis at Quocirca, admits that some of these deployments may
only be test sites. In addition, the survey shows that 14% of these
consolidations did not involve virtualisation.
There are two ways in which an attack might be mounted. One is
to hit the VM, but the jackpot would be to find some way to
compromise the hypervisor because all of the data passes through
this point. The hypervisor is only an operating system in the same
sense that DOS was an operating system in the past. It has minimal
functionality and therefore far less code than Windows or Linux -
fewer than 50,000 lines compared to more than 50 million in Windows
Server 2003. This leaves less room for the hacker and makes the job
of initially hardening the hypervisor much easier.
Last September, VMware patched 20 flaws in its software and on
March 18 this year it patched seven low-grade but potential
security bugs in the free version of its server software, so there
is no guarantee that vulnerabilities do not exist. Tamar Newberger,
vice-president of marketing at Catbird, a fledgling company in the
virtual security market, said, "There have not been any
well-publicised attacks and a couple of vulnerabilities have been
caught and fixed by the suppliers. There have been a few reports of
proof-of-concept attacks which could mean a big one will come along
soon. Our problem is to try to pursuade people who are not doing
anything to protect themselves to act. It is like it was in the
early 90s trying to sell a firewall."
The number of companies springing up to protect or embrace
virtual security continues to increase. Hezi Moore, CTO at virtual
security supplier Reflex Security, said, "If you have not had a
break-in recently, why do you still lock your door? If somebody
gets access to the hypervisor, the theory is that they will also be
able to access the VMs. Having gained access to one machine it may
be possible that they could attack others."
Graham Titterington, principal analyst at Ovum, is not so
pessimistic, "We are in uncharted territory, but I think
virtualisation is generally a good thing, but there is always the
danger that we might get taken by surprise by something we have not
fully appreciated. Virtualisation environments are pretty well
designed and the boundaries between the VMs seem fairly rigid. I
think the most likely point of attack is the hypervisor with
something like a denial-of-service attack or possibly to put
something in one of the VMs that will hog the CPU cycles.
Virtual security software mirrors the physical world by
providing intrusion detection, triggers for unusual traffic and
anomalous behaviour, and firewalls. Reflex Security's Virtual
Security Appliance, for example, does this by loading itself as a
virtual environment within each physical server to protect the VMs
housed there.
"Most datacentres are not well protected," Moore said. "They
concentrate their security on the gateway and there is very little
security beyond that. Putting a security device within the
datacentre is expensive, disruptive and takes up bandwidth. The
main argument is the expense, which may be £1m, and people do not
want to spend that. With virtual security, this comes down to
around £10,000 and no-one is going to say no to that."
Another route of attack in the virtual world mirrors the Trojan
horses that attack users today. VMs are portable as long as the
underlying hypervisor is from the correct manufacturer. This is
opening up the possibility of a different kind of distribution,
whereby a complete server can be downloaded in its virtual form
either as an appliance or as a test server. It is quite possible
that malware could be intentionally or accidentally included within
the VM.
The number of offerings at the moment are few and probably
harmless but if this is a future trend, it will be exploited at
some point. Detection of rogue applications tends to rely on
irregular behaviour based on observed behaviour, but if the malware
is present from the first day it could be considered to be normal
activity. The only protection is to treat all externally produced
VMs with extreme caution until they prove to be benign.
Anything with an IP address is potentially vulnerable, and
patching has become an everyday chore. Physical servers are well
catered for and can be checked easily, but virtual servers may not
always be online.
The great thing from a security angle is that an infected or
malfunctioning VM can be instantly replaced by a clean back-up VM
within minutes or even seconds. This is one of the selling points
of virtualisation, but can anyone be sure that the new instance is
fully patched? If the virtual server has been dormant for a while
it may not be fully patched and there is no software on the market
that can guarantee to patch all operating systems and applications
on all VMs.
The virtual environment suppliers and a clutch of third parties
are tackling the problem, but they cannot pretend that they can
cover every distribution of every operating system. Longbottom
advises that adopters should take care in choosing their hosted
operating systems. The more varied the environment, the greater the
headache.
"One of the biggest areas that has to be looked at is that you
work against images, you do not work against physical
implementations," Longbottom said. "If you have 17 instances of an
image running, you only have one physical image. That physical
image is the one to patch and in order you take down each physical
image and replace it with an image of the updated physical image.
That should ensure that everything is up to the latest level of
patching. Because you are working in a virtualised environment, you
minimise the amount of downtime involved."
Where mission-critical systems are concerned, the environment
has its own answer to the downtime problem. Longbottom went on to
explain that virtualisation means that a lot more is being made of
the utilisation rate of the hardware and some of that can be
affordably lost in making the system failsafe. So even for less
critical servers, it is affordable to run two images in
load-balanced pair. When one is taken down to be refreshed from the
updated physical image, the other will pick up the load. There will
be a slight hit on performance, but only slight and not for
long.
In the mobile computing world, virtualisation has a lot to
recommend it. It can be heavily defended much more easily and at
lower cost, so the security holes that are being punched in current
systems, by allowing employees to work away from the office or by
allowing partners to access the corporate network, can be fixed
more easily. They can even be effectively quarantined on a single
server or two and yet still have a great deal of functionality.
The virtual world is a fascinating enigma. Systems are possibly
just as vulnerable as before but in new and undefined ways. Until
some weakness is discovered and exploited the best anyone can do is
to treat the VM world as a mirror of the physical world on a
better-the-devil-you-know basis.
The upside is that virtualisation is enforcing certain best
practices that make securing the environment easier. Each server
becomes a tight little farm of VMs which can be treated relatively
inexpensively as a ring-fenced community. If anything goes wrong it
can be quickly recovered, especially if it is a system such as a
web server with static content. Where data-intensive activity is
occurring, some transactions may be lost in the process but if that
is critical there are ways to minimise and even eliminate that
eventuality.
Virtualisation is catching on. Quocirca's survey suggests that
87% of their sample are at least thinking about introducing
virtualisation. This means that the deployments may reach that
critical mass that will make the hackers take virtualised
environments as serious targets. Until that time, if it ever
arrives, all any manager can do is to build the barricades and post
watchmen to scan the horizon.