1. Security in Virtualized Environments
Kenneth Smith
CISSP CISA CCSK
@ken5m1th
9/18/2018
© Copyright 2013 GreenPages Technology Solutions

2. Agenda
What do we trust?
What’s different in a virtualized infrastructure
Hypervisor security controls
Guest security controls
Silver lining
Great tools and references
Recommendations
9/18/2018

3. Winner of the worst Infosec stock image EVER!
Source: Intacore.com bad Intacore…bad
9/18/2018

4. What do we trust in traditional infrastructure?
Hardware
Firewall appliances?
Network routers and switches?
Servers?
Why?
Physical placement concept
Dedicated purpose
Very clear roles & separation of duties
Good foundation
9/18/2018

5. What’s different in a virtualized infrastructure?
Consolidation
More stuff running in one place
Many moves/adds/changes
General purpose x86 hardware
Servers are files
All kinds of products can run as VM’s
Lost a few things
Some of the trustworthy foundation
Roles blurred
9/18/2018

6. Hypervisors
9/18/2018

7. What do we still trust? The physical network
Hardware that Hypervisor runs on
Operating system configuration?
Applications?
9/18/2018

8. Must first trust the foundation
Physical hosts
Hypervisor running on physical hosts
Hypervisor management system
Third party tools
SAN / NAS
Ancillary applications and systems
9/18/2018

9. Hypervisor Security Controls
Hypervisor Management
Virtual network
Trusted boot
Physical
9/18/2018

10. Hypervisor Trusted boot
Attests to integrity of BIOS and hardware
Can assign certain Hypervisors to specific hardware
Relies on chipset hardware and CPU features
9/18/2018

11. Hypervisor Virtual Networking
Categorized as SDN
Standard networking features
Provided by hypervisor vendor or third parties
Can include security features
Firewall
IPSec Encryption
Network monitoring
9/18/2018

12. Hypervisor Management Controls
Guest access controls
Storage access controls
Change management
Image and snapshot management
Monitoring
Automation
Orchestration
9/18/2018

13. Hypervisor Third-party Solutions
Firewalls
VMDK encryption
Logging and SIEM
IDS/IPS
More granular access controls
Key management
Vulnerability management
Multi-hypervisor management
9/18/2018

14. Guest Security Controls
Application
Host-based tools
Operating system
Trusted boot
9/18/2018

15. Source: The Virtualization Practice, LLC.
Caption this slide….
9/18/2018
Source: The Virtualization Practice, LLC.

16. Is there a silver lining?
Fewer places to look
Fewer people to talk to (maybe)
More automation / orchestration
Further abstraction via private cloud
Background image source: law.upenn.edu
9/18/2018

17. Vendors addressing virtualization security
VMware Architecture Design Guide for PCI
Maps out a design strategy
Educates on security/compliance controls of VMware
Reviewed by a QSA
9/18/2018

18. Vendors addressing virtualization security (cont’d)
VMware Solution Guide for PCI
Further educates on security/compliance controls of Vmware
Maps each requirement to a feature of Vmware security controls
Reviewed by a QSA
9/18/2018

19. Vendors addressing virtualization security (cont’d)
VMware vSphere 5.1 Hardening Guide
Step-by-step check list of recommended secure configuration settings
Managed by Mike VMWare
9/18/2018

20. Vendors addressing virtualization security (cont’d)
VBlock Solution for Trusted Multi-tenancy
Released by VCE
Educates on security/compliance controls
Maps security requirements to control capabilities
9/18/2018

21. Vendor Security/Compliance Solutions
9/18/2018

22. Industry addressing virtualization security
Guide to Security for Full Virtualization Technologies - NIST
Great vendor-neutral primer
Start with this document!
9/18/2018

23. Recommendations Educate your organization
Get to know virtualization security controls
Trust but verify Verify then trust
Get ready even more confusion: cloud
9/18/2018