Recently many discussions have been made regarding virtualized security IT infrastructure. Many research paper has been published describing the pros and cons of virtualized security environment. Additionally, new advances have been made for enhancing security for virtualized IT. In this presentation a survey has been made for recent advances in security for server virtualization.
INTRODUCTION
DESKTOP AND SERVER VIRTUAL TECHNIQUES
Virtualization describes conception and management of virtual machines as the composure of hardware and software. The concept of computer resources such as an operating system, a server, an application, or a storage device is represented in virtual machines. With the help of virtualization, even a particular physical resource be able to appear as resource providing multiple characteristics (which is called as emulation). In this context, many virtual machines co-exits on the same physical resource thereby following the principle of virtualization allow each virtual machine to isolate from each other and also from the host computer they are executed on.
Server virtualization describes virtualization of full computing platform. In all, virtual machine provides isolated, self-contained and indistinguishable environment. Thus, virtual machine creation is based on:
Emulation:
Emulation done by virtualization layer of the entire hardware which includes the CPU, I/O components, chipsets and so on allows even an unmodified guest operating system to run on hardware which is different to the physical hardware as for example: Microsoft Virtual PC for MAC, Bochs etc.
Full Virtualization:
The virtualization layer in this framework which is even called as - virtual machine monitor(VMM) emulates the hardware which helps unmodified guest operating system to run in segregation. Whilst as other hardware components including disks, memory, network adaptors and other I/O devices are emulated, CPU is passed through to the Virtual Machines.
Paravirtualization:
In paravirtualization, virtual machine emulators which are known as hypervisors not necessarily imitate hardware but in place offers unique API for access to the hardware which means there must be modification in unmodified guest operating system. For example VMware ESX server.
HARDWARE -supported VIRTUALIZATION
Besides software-based emulation, the hardware layer will also provide the capability of virtualization. The example for hardware-based virtualization of x86 based operating system are Intel Virtualization Technology( Intel VT). The extension of Intel VT is referred to as VT-x which is 32 bit processor and the 64 bit itanium processor extension is referred to as VT-i. Intel VT are known under the code name 'Vanderpool'. Hardware based virtualization are also provided by AMD with AMD virtualization extensions (as AMD-V) and these are known by the codename 'Pacifica'. Full virtualization and paravirtualization softwares support hardware based virtualization.
Virtualization Security - Benefits
A lot of operational benefits are provided by virtualization as flexible server administration concepts and enhanced hardware procedures. Following are the benefits of virtualization from security point of view:
Isolation of unstable or compromised applications:
The main characteristic of virtualization is operation of individual virtual machine in
segregation. Thus security can be provided in the following scenario:
- unstable software can be executed without harming the production system.
- the distribution of malware are hindered.
- the capability of isolation is useful during evaluation of new product versions.
Separation of security functionality from production systems:
Often security functionality is disabled by the malware in order to conceal itself from the user.
High availability:
In business environment two things are more important - maintainance of data and accessibility of resources. Time and cost can be reduced by involving virtualization through the use of VM instances for failure purposes.
Disaster Recovery:
Remedy for system compromise can be done by virtualisation by following quick and easy reset to clean and reliable mechanism. Significant advantages are offered by server virtualization. The thing that is required is baseline installation of the pretentious system. After evaluation of the compromised system, installation of the baseline can be patched and then curved into production.
Security Limitations of Virtualization
Following are the recently found security challenges for virtualized IT infrastructure:
Service Drop-outs in the Large:
Virtualization provides a technique in which different systems can be consolidated onto same physical server that helps in dropping the number of hosts that have to be bought and maintained. From security point of view applications that are running inside virtual machine depends on various layers of the underlying infrastructure. These layer consists of the physical machine, the hypervisor and the guest operating system. This shows dependencies from the physical machine and the operating system. Thus, existence of two additional architectural layer can cause system instability. Therefore, if no extra measures are taken many services will suffer from drop outs when host operating system, physical server or VM emulator fails.
Uncontrolled growth:
In a corporation , as there is significant increase in the number of virtual machines than the number of physical machines, security officers faces with high diversity of operating system. Virtual machines are frequently used for testing and are managed by non administrators. Thus, unpatched, unsupported and insufficiently administered landscape might be given which results in number of problems. Measures must be taken for diversity of operating system or otherwise deal with the risk created by unpatched machines on the network.
Impact on Snapshot Functionality:
System snapshot can easily be done in virtualization environment which results in secure stable system and on which rollback can be performed easily. However, it also creates some harmful side effects:
- In virtual environment, there is coexistence of different instances of same system with different patch levels . In order to provide comparable security significant overheads are made to ensure updation of the instances.
While performing cloning and snapshot functionality of virtualization, security vulnerabilities that have been fixed earlier can be reintroduced as worms, viruses and Trojan horses and so on.
-With virtualization snapshot functionality complete system are available in few files that can be transferred by copying in USB to other host which provides virtualization platform. This results in the risk of losing confidential data.
Diversity:
Most IT organisations uses homogeneity to tackle security problems : that is most recent patched software must run on all machines. While virtual machines provide more efficient usage by using unpatched or older version of softwares. This creates problem while dealing with wide range of operating systems.
Identity:
In traditional environment ad-hoc identity is associated with a machine this is MAC addresses, employee name, office number and so on which helps in establishing responsibility in case if machine turns malicious. Virtualization makes use of MAC address infeasible. Random MAC addresses are used with the hope of avoiding collision. Further, virtualization mobility feature makes it impossible in establishing responsibility in case changes have been made to a system.
Attacks on vertualization Layer
An additional architectural layer is represented by virtual machine emulator which poses a threat from security vulnerability and is a target of attacks. In September 2007, it was reported that a cumulative security patch was released by VMware. By the end of 2007 an overview of vulnerabilities are published by Lamb ( shown in Table 1). Following Peter Ferrie attacks can be categorized as:
Detecting VM Presence:
Malicious software are willingly analysed by virtual machines. In case virtual machines detects malicious code it shows its impact by changing behaviour or refusing to run.
Hence, use of virtualization in detecting malware is more complicated. Various ways exists for detecting the presence of VMs which are shown in many recent research papers.
Detecting hardware supported virtualization
Detecting software supported virtualization
Denial of Service Attack:
Attacks are made on virtual machines in order to reduce the usability of VMs. Which
means denial of service attack will results in break in the usual work of VMs which obstruct administrator to interact with affected VM.
Virtual Machine Escape:
Securing Virtualized IT Infrastructure
Providing Security for Virtual Machines:
- Working of guest operating system on client or server computer must be treated as usual operating system.
- Emulated hardware and proprietary protocols which are not required must be disabled.
- Examination of the security implications and measures for countering security risks should be established.
- Rollbacks in earlier virtual machine snapshots should not create malicious states.
- Self-contained security functionality should be provided to guest operating system.
Providing Security for Virtual Machine Emulators:
- Corporate information security guidelines should be configured and maintained by host operating system in order for securing VMs.
- Updation of virtual machine emulators should be done.
- In order to minimize risk for attackers to asses their privileges, security system of the host operating system should be employed.
Providing Network Security:
- Usage of NAT network configuration in order to protect VMs from network attack.
- in case of bridged networking, all rules that are applied for normal host must also be used for VM.
- if there is requirement for network authentication and authorization for VMs, then they should be equipped with their own network physical adaptors for the application of network security as provided by IEEE 802.1x standards.
Providing Security for Overall Computing Architecture:
Challenges and Advances
Some interesting development are highlighted with the purpose of securing some aspects of VMs:
Data Loss Prevention:
REFERANCES:
Virtual Security
About the Security Pros and Cons of Server Virtualization
Martin Wimmer
Siemens AG, Corporate Technology, CT IC CERT
D-80200 Munich, Germany
http://www.docstoc.com/docs/22651836/Virtual-Security
