Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

2/21/2007
07:30 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

VMs Create Potential Risks

Convenient and efficient, virtual machines can also increase your security exposure

Those tens of thousands of virtual servers spawned from your thousands of physical ones offer no guarantee your security policies will carry over, and can leave you with a security time bomb ticking away in your data center, according to vendors and some experts.

"Virtualization is both an opportunity and a threat," says Patrick Lin, senior director of product management for VMWare. "But one of the key things about hypervisors is their design is simpler than the modern operating system. As a result, they are simpler to harden and lock down, and there are not as many vulnerabilities."

"On the flip side, it's a new layer that's another opportunity for attack," he says.

Hypervisors are programs that allow multiple operating systems to use the same hardware. But these programs can also breed complexity, and with complexity comes security problems.

Virtualization security solutions so far have been focused mostly on the hypervisor: IBM, for instance, recently unveiled SHype, a new secure hypervisor technology that ties security policies to virtual machines. IBM won't give specifics on its internal plans for the technology, but it has provided some elements of SHype to the Xen Open Source Project. (See Vendors Push Virtual Security.)

And VMWare's desktop Ace software lets you lock down virtual machines, even when they are moved around. Lin says it works like a network access control (NAC) for virtual machines.

Thomas Ptacek, a security researcher with Matasano Security, says the move to virtualization is the biggest thing happening in IT today. "And every application running in a modern IT organization is on a path to being moved to one big iron [machine] running multiple VMs," he says. "And its impact on security touches everything."

That has prompted some security vendors to step up. Allwyn Sequeira, senior vice president of product operations for Blue Lane Technologies, says virtualization is creating a tornado of forces that could blow away security as we know it: the new hypervisor layer creating a new security attack vector; VM sprawl, where virtual machines become unmanaged and unprotected, and rogue VMs emerge; and in the dynamic moves and changes model of VM, patching and testing cycles get disrupted, mismatched, and complex.

"Some say virtualization of the OS doesn't change anything, and others, that with virtualization, everything is broken," Sequeira says. "I think it's somewhere in the middle."

Sequeira wouldn't comment on Blue Lane's upcoming announcement in the virtualization space, but there's a pretty big hint on its Website: "Coming soon: Virtual Security for VMware's ESX hypervisor."

Security analysts caution against over-reaction. "We are still very early on in the whole virtualization thing," says Michael Rothman, president of Security Incite. "The real threats end up being more theoretical than real now... But over time, this will become a real challenge."

"It also changes the definition of what is an application, where does the data reside," he says. "And how do I end up securing it? To me, this is going to create another situation where you have to look at security from the outside in."

And virtualization technology itself isn't inherently insecure. There are more vulnerabilities in your operating system than in your virtualization software, such as VMware, Matasano's Ptacek notes. It's more about how you configure your virtual architecture, where the virtual machine software is the main barrier among the different apps sharing the same physical machine.

"So you design it the same way you design a secure network. You partition sensitive applications to sensitive servers, and consolidate the less sensitive ones onto the same hardware."

Ptacek says the biggest security risk with virtualization to watch out for are "guest-to-guest attacks," where an attacker gets the root or administrator privileges on the hardware, and then can hop from one virtual machine to another. "This assumes the attacker has already broken into one of the machines," he says, and it puts other apps at risk on the compromised machine.

But this type of attack isn't easy to execute, especially when cryptography is involved. But with a lot of math, an attacker can "infer some bits of the crypto secret," Ptacek adds.

There hasn't been much activity in VM bug disclosures as yet, but that will change as more apps use virtualization, he says, and then attackers will have fresh vulnerabilities to prey upon as well.

The underlying problem: Virtualization creates a set of dynamics in the IT infrastructure that traditional security approaches "don't cope with well," says Kevin Leahy, director of virtualization at IBM. "As you move virtual resources around, it adds another layer or dimension of complexity to it. You want to ensure that all security policies, access privileges, etc., that you put on the box originally will also be true with the new 'box' you put it on."

VMWare's Lin agrees that security should be part of the virtualization design. Aside from Ace, VMWare offers a virtual Layer 2 switch in its ESX Server -- a hypervisor -- with VLAN support, and the VMWare software lets you lock down virtual network adapters "from running in promiscuous mode," he says. VMWare also offers resource management and the ability to set user permissions.

"We built VMWare Infrastructure 3 architecture as secure as we can make it," Lin says. "But you also need to follow best practices in virtualization."

— Kelly Jackson Higgins, Senior Editor, Dark Reading

  • IBM Corp. (NYSE: IBM)
  • Matasano Security LLC
  • VMware Inc. (NYSE: VMW) Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
     

    Recommended Reading:

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    COVID-19: Latest Security News & Commentary
    Dark Reading Staff 7/14/2020
    Omdia Research Launches Page on Dark Reading
    Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
    Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
    Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    Special Report: Computing's New Normal, a Dark Reading Perspective
    This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
    Flash Poll
    The Threat from the Internetand What Your Organization Can Do About It
    The Threat from the Internetand What Your Organization Can Do About It
    This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-6287
    PUBLISHED: 2020-07-14
    SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create a...
    CVE-2020-6289
    PUBLISHED: 2020-07-14
    SAP Disclosure Management, version 10.1, had insufficient protection against Cross-Site Request Forgery, which could be used to trick user in to browsing malicious site.
    CVE-2020-6290
    PUBLISHED: 2020-07-14
    SAP Disclosure Management, version 10.1, is vulnerable to Session Fixation attacks wherein the attacker tricks the user into using a specific session ID.
    CVE-2020-6291
    PUBLISHED: 2020-07-14
    SAP Disclosure Management, version 10.1, session mechanism does not have expiration data set therefore allows unlimited access after authenticating once, leading to Insufficient Session Expiration
    CVE-2020-6292
    PUBLISHED: 2020-07-14
    Logout mechanism in SAP Disclosure Management, version 10.1, does not invalidate one of the session cookies, leading to Insufficient Session Expiration.