virtualization security landscape what is changed虚拟化安全格局发生了哪些变化.pdfVIP

TheVirtualizationSecurityLandscape:

WhatsChanged?

DaveShackleford

IANS

SessionID:Sect-302

SessionClassification:Intermediate

VirtualizationSecurity:ThenandNow

Westartedthisdiscussionin2004-2005

What’schanged?

First,we’llcoverthreatstovirtualenvironmentsand

risksweface

rd

Next,we’lltalkcontrols–bothbuilt-inand3-party

options

Architectureconsiderationsforvirtualenvironments

makeadifferencetoo–anythingnewhere?

I’llalsocoversome“lessonslearned”andthings

I’veobservedalongtheway

2

Virtualization

Threatsand

Risks

3

ThreatstoVirtualization

Threatstovirtualizationinfrastructureusually

targetvulnerabilitiesinvariousproducts

Therehavebeennumerousvulnerabilitiesinmajor

virtualizationproductssince2008

Somethreatsaremorefocusedonhypervisor

compromise

Hardwarechipsetvirtualization

Architecture

Software

Othersarefocusedonmanagement

components,storage,etc.

4

OperationalRisks

VMSprawl

Lackofchangeandconfigurationmanagement

controls

Poorinventorymaintenance

Lackofvisibility

Insidethehostsystem

VM-to-VMtrafficacrossvirtualswitches

SeparationofDuties

Often,virtualizationhandedtoanexisting

Windowsadminteam

Toomanyrights/privileges

BothpeopleANDVMs

Managementcomponentsandservicesmayhave

extensiveprivileges

5

Vulnerabilities

VMSA-2009-0006

Criti