VMs Create Potential Risks

Those tens of thousands of virtual servers spawned from your thousands of physical ones offer no guarantee your security policies will carry over, and can leave you with a security time bomb ticking away in your data center, according to vendors and some experts.

"Virtualization is both an opportunity and a threat," says Patrick Lin, senior director of product management for VMWare. "But one of the key things about hypervisors is their design is simpler than the modern operating system. As a result, they are simpler to harden and lock down, and there are not as many vulnerabilities."

"On the flip side, it's a new layer that's another opportunity for attack," he says.

Hypervisors are programs that allow multiple operating systems to use the same hardware. But these programs can also breed complexity, and with complexity comes security problems.

Virtualization security solutions so far have been focused mostly on the hypervisor: IBM, for instance, recently unveiled SHype, a new secure hypervisor technology that ties security policies to virtual machines. IBM won't give specifics on its internal plans for the technology, but it has provided some elements of SHype to the Xen Open Source Project. (See Vendors Push Virtual Security.)

And VMWare's desktop Ace software lets you lock down virtual machines, even when they are moved around. Lin says it works like a network access control (NAC) for virtual machines.

Thomas Ptacek, a security researcher with Matasano Security, says the move to virtualization is the biggest thing happening in IT today. "And every application running in a modern IT organization is on a path to being moved to one big iron [machine] running multiple VMs," he says. "And its impact on security touches everything."

That has prompted some security vendors to step up. Allwyn Sequeira, senior vice president of product operations for Blue Lane Technologies, says virtualization is creating a tornado of forces that could blow away security as we know it: the new hypervisor layer creating a new security attack vector; VM sprawl, where virtual machines become unmanaged and unprotected, and rogue VMs emerge; and in the dynamic moves and changes model of VM, patching and testing cycles get disrupted, mismatched, and complex.

"Some say virtualization of the OS doesn't change anything, and others, that with virtualization, everything is broken," Sequeira says. "I think it's somewhere in the middle."

Sequeira wouldn't comment on Blue Lane's upcoming announcement in the virtualization space, but there's a pretty big hint on its Website: "Coming soon: Virtual Security for VMware's ESX hypervisor."

Security analysts caution against over-reaction. "We are still very early on in the whole virtualization thing," says Michael Rothman, president of Security Incite. "The real threats end up being more theoretical than real now... But over time, this will become a real challenge."

"It also changes the definition of what is an application, where does the data reside," he says. "And how do I end up securing it? To me, this is going to create another situation where you have to look at security from the outside in."

And virtualization technology itself isn't inherently insecure. There are more vulnerabilities in your operating system than in your virtualization software, such as VMware, Matasano's Ptacek notes. It's more about how you configure your virtual architecture, where the virtual machine software is the main barrier among the different apps sharing the same physical machine.

"So you design it the same way you design a secure network. You partition sensitive applications to sensitive servers, and consolidate the less sensitive ones onto the same hardware."

Ptacek says the biggest security risk with virtualization to watch out for are "guest-to-guest attacks," where an attacker gets the root or administrator privileges on the hardware, and then can hop from one virtual machine to another. "This assumes the attacker has already broken into one of the machines," he says, and it puts other apps at risk on the compromised machine.

But this type of attack isn't easy to execute, especially when cryptography is involved. But with a lot of math, an attacker can "infer some bits of the crypto secret," Ptacek adds.

There hasn't been much activity in VM bug disclosures as yet, but that will change as more apps use virtualization, he says, and then attackers will have fresh vulnerabilities to prey upon as well.

The underlying problem: Virtualization creates a set of dynamics in the IT infrastructure that traditional security approaches "don't cope with well," says Kevin Leahy, director of virtualization at IBM. "As you move virtual resources around, it adds another layer or dimension of complexity to it. You want to ensure that all security policies, access privileges, etc., that you put on the box originally will also be true with the new 'box' you put it on."

VMWare's Lin agrees that security should be part of the virtualization design. Aside from Ace, VMWare offers a virtual Layer 2 switch in its ESX Server -- a hypervisor -- with VLAN support, and the VMWare software lets you lock down virtual network adapters "from running in promiscuous mode," he says. VMWare also offers resource management and the ability to set user permissions.

"We built VMWare Infrastructure 3 architecture as secure as we can make it," Lin says. "But you also need to follow best practices in virtualization."

— Kelly Jackson Higgins, Senior Editor, Dark Reading