Virtualization changes the rules
Thursday, April 9, 2009 at 9:25PM One of the areas that I have see that has been growing in most of the Datacenters I have had a chance to consult in is the Virtualization. Many companies and government agencies are looking at virtualization to reduce their operational costs and at the same time gain some of the advantages of virtualization, but an area that I have seen that the virtualization vendors and most system integrator is overlooking is how virtualization changes the way networks are designed and how it also changes the processes for the security team. The biggest mistake I have seen is the mixing of environments without doing a proper risk assessment and segmenting your averments appropriately, you can see this in:
- Mixing VDI machines (High Risk users have control!!) with server machines (Here is most of the data you want secured).
- Having DMZ server and Internal server on a same Hypervisor Cluster.
- Having the Lab Environment and production environments mixed on a same group of clusters.
This are only some basic examples. There is currently development and research being done by the bad guys on how to do VM Escapes and gain access to the physical host, all major vendors have released patches for this and still you do not see questions for this in any of the major risk assessment companies and guides out there. Another area that it is grossly overlook is how do you design your network and storage infrastructure, where do you put your IDS/IPS boxes? how do you segment traffic? in fact one of the major buzz words in converged networks where you have FCoE, ISCSI and NFS running on the same network where you are moving Ethernet communication packets so if a box is compromised or a piece of network equipment is compromised and the attacker can sniff or perform a MITM attack he can see not only the network traffic but the storage traffic giving a greater amount of access to the data. Many designs are badly done where they not only do not segregate on witch physical set of server what VM’s will be hosted but they have LUNs in the SAN where they have the machines mixed, so if an attacker gains access to the physical server he can also have access to VM’s of different levels of classification.
Another great area of change many times overlooked is procedures, and in an IT environment there are plenty:
- Backup procedures.
- Change Management and Patch Management.
- Incident Response
and this are only but a few of the procedures that must be modified when moving in to a virtual environment. Management as a whole changes, the admin of the physical servers have the power to change and control the VM’s in that environment, permissions will vary to grant the necessary access to the right people to manage the resources and the management system become one of the biggest area of risk if not secure properly. There must be a separation of the management network just like we separate the network and storage traffic. Also the management host must be hardened and all necessary precautions must me taken like having IPS monitoring the traffic to this systems, having proper logging set up, having HIPS on this boxes and proper change management since a compromise of one of this boxes means that the attacker gained the keys to the kingdom. This is just a rant on some of the main points that I see are not being addressed properly by the major virtualization vendors when they talk about virtualization and consolidation. The bad guys are doing their research and they even have attack code that will detect if the target is a VM we better catch up before it is to late.