Contributed Article from Hezi Moore, co-founder and CTO of Reflex Security
While new technologies can provide significant improvements to IT operations, organizations must also consider potential network and data security implications.
Increasingly, server virtualization technologies are being used to consolidate physical servers and help organizations address data center management, operational and security challenges. Virtualization provides IT departments with a great deal of deployment, configuration and performance flexibility and is emerging as one of today’s most compelling new technologies.
However, virtualized environments face unique network security challenges that can affect the entire organization. Adding security to your virtual network, such as a virtual security appliance, can protect critical resources from intrusion, theft, service denial, regulatory compliance conflicts or other consequences.
Fortunately, by combining prudent security measures with advancing virtualization technologies, organizations can adopt and deploy “defense in depth” best practices without the traditional high costs and complexities associated with physical infrastructure and enjoy the benefits of a virtualized architecture while avoiding excessive risks.
Understanding Virtual Network Security Issues
Virtualization technologies have altered the concept of a network endpoint and appropriate endpoint security measures. Until recently, network security and auditing methods that extended to the physical machine level were generally considered adequate. However, virtualization has split the physical machine into an entire subset of virtualized servers and resources, changing the rules for network security.
While traditional perimeter and internal security devices play an important supporting role, they are not capable of fully addressing virtualized environment resources and risks.
For many organizations, there are many mission-critical reasons to consider virtual environment security. They include:
· Visibility and awareness inside the virtual environment: Network traffic inside the virtual environment can be inspected and any communication auditing trails will be recorded.
· Maintaining Regulatory Compliance: Compliance with regulatory standards such as the Payment Card Industry (PCI), or Section 404 of the Sarbanes-Oxley Act (SOX), or Health Information Portability and Accountability Act (HIPAA) Security Rule requires companies to maintain appropriate data security procedures, controls and auditing capabilities.
· Mobile server security issues: As virtual servers are moved to new environments, they can potentially compromise the security of their new environment.
· Activation of stored materials: Images that have been unused may not updated with current security measures.
· Controlling Data Access: As with physical networks, virtualized networks need to ensure only authorized individuals and devices are allowed to access the network and communicate. Unauthorized or malfunctioning endpoints need to be identified and restricted in an appropriate fashion.
· Detecting and Preventing Intrusions: As with physical networks, virtualized networks are vulnerable to intrusions that can lead to unauthorized access, data loss, service interruption or other consequences.
· Virtual environment misconfiguration: While physical network configurations can be checked by tracing wires, etc., virtual environments often face misconfiguration problems that can be difficult to untangle because the system is based entirely on files.
· Access accountability: As servers multiply, departmental managers often take over part of server management, introducing a loophole in tight control of server access.
Virtualized Environment Attack Vectors
In a virtualized environment, multiple virtual servers (a.k.a. virtual machines or VMs) share a common physical host machine. Broadly, hosts and virtualized components require similar security precautions as any critical, non-virtualized IT resource. However, virtual environments have unique attributes and incremental security challenges that are not addressed by traditional security solutions.
When a host or virtual server communicates with resources outside the host (on the LAN, Internet, etc.), it may be exposed to hostile content or users, which can result in an intrusion, malware infection or other unwanted results.
Other intra-host threats include legitimate inter-VM communication and unauthorized access. These threats may transit virtualized LAN segments unseen by external security solutions or systems inside a virtual server. The resulting gaps create an unmonitored, unprotected security hole that may expose virtual machine to unauthorized access, infection, surveillance, Denial of Service (DoS) and more.
Evaluating Virtual Environment Security Solutions
Virtualized environments are difficult to visually inspect and due to virtual server mobility and related issues, they often have dynamic configurations and server populations. In this context, threats can easily spread, devices can be overlooked, and inappropriate activity can be concealed. To prevent configuration oversights, rogue devices, auditing omissions and other issues, the security system should maintain persistent awareness of all virtualized devices, services and communications. Typically this requires capabilities such as:
· Automatic, on-going virtual network assessment (servers, connections, available services, etc.)
· Virtual network traffic monitoring, analysis and reporting
While the spectrum of pertinent vulnerabilities will vary based on business and technical considerations, the virtualized security system should typically include capabilities such as:
· Intrusion Detection / Intrusion Prevention (IDS/IPS) and LAN Firewall
· Server-based Network Access Control (NAC) and authentication
The optimal virtualized security solution supports high-availability, wire-speed operation and will not excessively consume or compete for finite host machine resources. This helps ensure security functions do not create unwanted interference with critical server operations and data access. Also, it minimizes the potential for an excessively large security overhead to overtax host machine capabilities and degrade virtual server/application performance.
Virtualized environments typically contain a heterogeneous mix of virtualization platforms, devices, operating systems and applications. Also, these environments coexist with the surrounding physical network ecosystem. Therefore, a virtualized security solution should provide:
· Compatibility with virtualization platforms (i.e. VMware) in the target environment
· Compatibility with virtualized applications, OS and related infrastructure
· Compatibility/interoperability with key physical network ecosystem elements
To be practical, a virtualized security solution should support acquisition, deployment and management options that facilitate easy manageability and low TCO. Criteria include:
· Ease of device deployment, configuration and administration
· Integrated, extensible security functionality
· Affordable acquisition, maintenance and upgrade costs
In part two of this three part article, Hezi Moore will discuss Securing Virtual Networks: Solution Alternatives.
Hezi Moore is the co-founder and CTO of Reflex Security, a leading provider of virtual security solutions.