No Real Virtualization Security Threat? C’mon…
Ok, I was going to hold off on posting anything until I was back in the home office next week, but a post over at CNET by Jon Oltsik called “The real issue around server virtualization security” caused a minor ulcer eruption in my core being and I had to let out some steam.
First off, the good: Jon is correct in the 2nd half of the post that the primary threat today is virtual infrastructure management, and how to integrate virtualization into our existing physical data centers. Management is the #1 issue that’s keeping us from fully moving to a complete Virtual Data Center. Before we can virtualize everything in our data center, we have to guarantee that we can manage it just like we can today with physical resources. So yes, Jon did have something good to say.
But unfortunately this is outweighed by his complete incorrectness on devaluating the security risks associated with virtual platforms. He uses the argument that since there hasn’t been an exploit ever against a virtual environment platform then you shouldn’t worry about it:
Starting with IBM and virtual machines on the mainframe, there hasn’t been a single compromise at the virtualization operations layer that I know of.
This has 3 problems:
- This is the exact same argument we faced 3-4 years ago with Web Application Firewalls (WAFs), and look where we are now. PCI not only includes a clause that specifically addresses WAFs but they’ve recently released a clarification document on what it means to use a WAF within the PCI guidelines. 3 years ago, that would have been unheard of, because we didn’t have press every other week about web application vulnerabilities. We do now, and of course everyone is cramming to install a WAF in front of their apps and we’re inundated with reports of identity theft via applications (in state or over the wire). Had those customers evaluated and been conscious of their risk up front maybe they wouldn’t have been open to all those SQL Injection and XSS attacks. Risk Management is all about planning, not reacting.
- Yeah, IBM virtual machines on mainframes have been around for a long, long time, and there hasn’t been a public exploit since day 1. However, any homegrown hacker can’t simply download the IBM virtualization solution in 3 clicks and beat the hell out of it in her basement for 6 months just to gain virtual street cred. It’s a different time, Jon, and everyone has access to all three major x86 hypervisor platforms today for free (and with Xen, they even have source). And she knows that every enterprise in the world is looking at x86 virtualization right now so her addressable insecure market is limitless. There’s more incentive to hack VMware’s hypervisor than IBM. It’s simple hacker economics.
- No compromise of the “virtual operations layer?” I would disagree, as I’m sure VMware, Xen, and Joanna would. Has there been a mass (or at least public) “ownership” of a major x86 hypervisor yet? No. Does that mean there won’t be? No. A comet hasn’t hit the earth and destroyed all mankind, but we still have people watching out for it.
Long story short, it is a disservice to tell the public not to worry about virtualization security threats. Is it a good idea to tell people it’s so insecure not to implement it? Absolutely not. But to tell people “Nah, it’s all good; there’s nothing to worry about with security. I’m sure it will be fine; these aren’t the droids you’re looking for” is just plain wrong. You should always be prepared, and aware of your possible threats and risk. And adding another processing and computing platform of any type to your data center does introduce a risk metric. Is more likely that someone is going to take down your data center through your hypervisor than because of a natural disaster? Probably not. But at least ake sure you measure that security risk and metric and don’t ignore it.

