Here are 10 serious security threats and some suggestions on what to do about them.
1. Virtual host security
Virtualisation can help make more efficient use of hardware, but it also creates new security problems. In particular, it allows different virtual hosts to reside in the same physical machine where the traffic between them is difficult to monitor and screen.
The problem is compounded if virtual hosts replicate to other physical machines to meet increased demand for the services they provide. Rules for accessing these machines must accompany them, and this is complex, says Rob Whiteley, an analyst with Forrester Research.
"When you deploy virtualisation at scale, it becomes a burden to manage the virtual machines," Whiteley says. Access control is still important in virtual environments, but tools for replicating it are scarce.
This can cause problems in regulated environments such the Payment Card Industry (PCI), which has standards for handling sensitive customer data. PCI standards specify what types of machines are not allowed to talk to each other.
There are three ways to deal with the problem. First, all traffic can be routed out of the physical hardware that contains virtual machines, scanned and then passed back into the hardware to reach another virtual machine. "That is a huge tax on the I/O system," Whiteley says.
Second, businesses can deploy existing software firewalls such as Check Point"'s on each virtual machine, but deploying, licensing and managing them is difficult because they were designed for real-world firewalling, not virtual world firewalling. "It"'s an operational nightmare," Whiteley says.
Third, businesses can turn to purpose-built products that are designed specifically for virtual environments such as those from Altor Networks, Reflex Security and Stonesoft, he says.
Features to look for: whether the products scale well; whether the license structure is affordable; whether policies follow new images of virtual machines.
Another way to address the problem is involving network staff in server virtualisation projects. This insures that traditional security measures that would be considered if physical servers were being added for virtual machines.
2. Protecting the virtual machine monitor (hypervisor)
If the software that keeps track of multiple virtual machines on a single hardware platform is compromised, so are all the virtual machines it tends. "There are no known threats, so there are no known remedies, but it’s only a matter of time before someone hacks a hypervisor," Whiteley says.
Networks need to defend the hardware with firewalls and intrusion-protection systems (IPS) to keep known threats away from the hypervisor if possible. As for specific threats against the hypervisor, it is uncertain what products will work.
As a rule, seek embedded hypervisors that ship with server hardware because they generally occupy a smaller footprint, making them more difficult to break. The less code involved, the fewer places there are to find vulnerabilities.