|
Virtualization Security Is Taking Longer Than Expected |
|
|
|
Source: TMC Net - Posted by Alex
|
A few years ago I wrote a paper for SANS titled “Security Implications of the Virtualized Data Center.” I had been working in system and network security for almost 10 years and, like many IT professionals, had been relying on virtualization as a system tool for many years. While using virtualization as a sandbox for security research I was drawn to virtualization security, now called virtsec, once I realized how great the security threat was in x86 virtual computing environments.
The original intent for that paper was to serve as the first in a series that dug into all facets of virtsec. Starting with the basic threat analysis of moving systems from hardware to software, that paper dealt with security risks like attacking the host platform, attacking individual guests, and using a shared filesystem. These attacks were all examples of exploiting the nature of running virtual machines in a shared environment with shared resources on the virtual platform; they specifically did not delve into security of the hypervisor.
We’re still working on bringing virtual platform security up to the strict level of physical security, a level that’s been well understood and in place for many, many years. Virtual platform security isn’t that different than securing standard data center systems, it’s just an extra layer in security planning and monitoring. Where virtual systems differ, however, is in visibility: there are certain virtualized components that can’t be monitored or secured in the same manner as their physical counterparts. Virtual networking is the classic example of such hidden components. Unlike physical switches, there’s no easy way to place a tap on a virtual software switch port, for example, and trust that the mirrored data you’re monitoring is legitimate. This concept holds true for any virtualized hardware including RAM (News - Alert), bus, and CPUs.
Read this full article at TMC Net
Only registered users can write comments.
Please login or register. Powered by AkoComment! |
