Virtualization, which reduces expenses and provides IT flexibility to organizations, also has security risks. These risks can be broken down into three categories: attacks on virtualization infrastructure, attacks on virtualization features, and compliance and management challenges, according to the ISACA white paper Virtualization Benefits and Challenges.
There are two primary types of attacks on virtualization infrastructure: hyperjacking and virtual machine jumping. Hyperjacking is still a theoretical attack scenario, but it has earned significant media attention because of the damage it could cause. One example of hyperjacking is inserting rootkits into the virtualization system.
“The rootkits could inject themselves underneath the existing virtualization infrastructure and implement rogue services or be able to steal or monitor all the communications from the virtual machines….In order to implement these types of attacks, you have to have compromised the environment heavily to get a rootkit onto the system”, explained Steve Orrin, director of security solutions at Intel and one of the authors of the white paper.
There are also two types of attacks on virtualization features: virtual machine (VM) migration and virtual networking functions. In addition, the white paper noted that VM sprawl and dormant VMs make it a challenge to get accurate results from vulnerability assessments, patching/updates and auditing, which are compliance and management challenges.
“Organizations need to realize that virtualization does change things. You need to add the virtualization-aware versions of your management and compliance infrastructure. You need to buy specific products and implement specific processes that take into account the new architecture you have deployed”, he stressed.
Orrin said that the security problems with virtualization are exacerbated when cloud computing is involved. “These infrastructures are no longer in your control, so these attacks that we see on internal systems become even worse in the cloud because you don’t control who is running next to you. So security steps you could take to control provisioning on a system within an enterprise you lose when you move to a cloud”, he said.
ISACA offers the following recommendations to improve security in a virtual environment: patch and harden the hypervisor and the guest it supports; use physical, network, and virtualization-based separation to segment VMs and systems; use transport encryption to secure VM migration; and implement virtualization-aware management products and services.
“There are security challenges and risks in dealing with virtualization, but there are great benefits to doing virtualization. The key to realizing those benefits, the efficiency, cost reduction, and the savings, is taking security into account as part of the process; bolting it on after the fact will only increase the pain and costs of virtualization. But if you plan accordingly….then virtualizations will be able to realize those benefits”, Orrin concluded.