|Vikas Desai, lead technology consultant, RSA India.|
Server virtualization effectively reduces infrastructural and management costs for organizations – a bonus in today's difficult economic times. However, the scary part is that while many companies jump onto the virtualization bandwagon to save costs, they ignore the security aspects.
Virtual server infrastructure consists of three pieces: physical machine, virtualization software and virtual machine. These three components of the virtual environment should be protected from potential threats and attacks. An attack or a threat to any component may result in an attack on the entire virtual infrastructure.
The concept of server virtualization on a physical server enables you to create several virtual machines that can be transferred from one physical server to another as per need. This inherent flexibility and mobility offered by virtual machines has significantly increased the associated security risk. If an attacker gets access to a particular physical server, he has access to 10 or 15 virtual machines running on that server. Thus, it becomes important to have a single security console that lets you check your complete virtual infrastructure's health.
Lock down your virtual machines
Due to the virtual infrastructure's flexibility, organizations can commission and decommission virtual machines at will. The organization's security policy should be flexible enough to account for the risks posed by these changes.
An organization can identify its most critical virtual assets keeping in mind the business aspect. Then it can define policies for access and data control of these virtual assets. Today, most organizations have separate management consoles for antivirus, firewalls, intrusion prevention systems, etc. Going forward, companies will require a single console that provides the health of their entire virtual infrastructure, as the number of virtual machines will increase significantly.
Checklists can be used for creating, copying and destroying virtual machines. Organizations need policies to define aspects such as who can create virtual machines, the virtual networks on which it can be created, and the operating system to be installed on the virtual machines.
Access and data control are critical for securing virtual environments. As mentioned earlier, unregulated access to a single physical machine may damage the entire virtual infrastructure. So the enterprise should define granular access control for each virtual infrastructure component. It needs to not only manage access control for host and guest systems, but also the server virtualization software. A strong form of authentication is required to make sure that only certain people have access to the virtual infrastructure.
A virtual machine can be easily copied on CD or DVD. So a virtual machine's image is nothing but data. Thus, data in various machines should be protected with strict security practices. Encryption and other data leakage prevention tools can be used for this purpose.
With the click of a mouse, a virtual machine can be transferred to a physical server at another location. Since mobility is enabled though the network, such operations can affect other virtual machines and vice versa if someone is eavesdropping on the network. Therefore, it is recommended that you do not put virtual networks directly on the internet. A best practice on this front is to keep virtual network and infrastructure deep inside the data center, so that it's far from the periphery (which is protected by intrusion prevention and detection systems).
Protect the host
Patch management becomes complex in a virtualized server environment. The organization needs to patch guest as well as host operating systems (OS), as any vulnerability in the host may affect the guest OS.
In server virtualization, the hypervisor provides software layers on a physical server, which enable the creation of virtualized environments. The hypervisor is mainly of two types. For example, you can use a hypervisor approach that runs directly from physical machines (like VMware, which emulates physical machines). Then you have open source versions like the XenSource hypervisor. These are basically fully blown OSs that run a piece of software within to enable virtualization.
Irrespective of the hypervisor that your company decides to buy, always pay attention to the hypervisor's inherent security and stability attributes. This information is available from the vendor or from third-party security organizations like the SANS Institute, which maintains public lists of software vulnerabilities. After buying the hypervisor, you can monitor it with log management or security information and event management tools.
About the author: Vikas Desai is the lead technology consultant for India & SAARC at RSA Inc.
(As told to Dhwani Pandya.)