It is estimated that 25% of SMBs use virtualized environments and the forecast for the coming years looks very promising. There are various benefits gained with virtualization, such as, lower operational costs, resources scalability, IT automation, faster deployments of application servers and many more features. On the other hand, we tend to ignore or give low importance to challenges or risks that are introduced with virtualized environments. As the overall benefits outweigh the challenges, the perceived risks are low! Is this the approach we need to take to move forward towards secure and stable virtualized environments?
What are the new challenges introduced with virtualization? As opposed to the traditional environment, we can hardly define a control structure for a virtualized environment. With the greater flexibility and rapid provisioning there is a risk of sprawl management and with the decentralized unrestricted access management, there is a risk of non-compliance or security breaches – virtualized control management needs to take a new form! The challenge is to create a structure that is dynamic, portable and accurate.
Implementing a control structure to an existent uncontrolled environment may be painful as it may requires configuration changes! As regards to implementing best practices and procedural controls the tasks is somewhat less painful. Therefore, securing and controlling the virtualized environment should take into consideration both the technical aspects and human factors. The best approach would be to plan ahead all controls before implementing the virtualized environment.
There are various areas to consider when designing a virtualized environment. One concept often ignored by IT stuff is to separate the management network traffic from the data services network through separate subnets. Another common trend is to group Virtual Machines by performance levels instead of trust/criticality level first. Is the IT including the hypervisor (virtualized platform) in its patch management exercise? There may be even tougher design decisions at the network level. As the network components in virtualized environments are all virtual, such as, vnics, virtual switches, etc. special attention is required to design the network layout. The environment may require a firewall or DMZ within the hypervisor or enabling virtual MAC protection. Remember, that certain vendor specific products enable nics in promiscuous mode and disable MAC protection!
If the company backup strategy is based on images and snapshots, then apart from the well defined procedures and policies one needs to test recovery procedures. In a Windows Active Directory environment, restoring an outdated or out of sync AD server will cause problems! Images of Virtual Machines are easily copied to external devices and taken off the premises. Are there any controls in place or detection mechanisms to monitor such movements?
Once, the virtualized environment is up and running, guidelines, procedures and policies need to be put in place. These should include segregation of duties, identity and access management, asset and log management. As it is very difficult to track incidents, access restrictions to logs need to be established. While restricting access to virtualized resources is important, make sure that logs are enabled and collected from all components, including the hypervisor logs. Educating stuff about policies and procedures is essential, however, auditing such procedures on regular basis is vital!
