Virtualization Security: No One Product Does It

VMware environments demand multiple tools to build barriers, trap intruders, maintain VM security-- and keep the Jason Cornishes out.

Security in the virtual environment is both potentially better than in the physical world and at the same time more complex. After the Jason Cornish affair, you may be asking yourself whether your virtual machines could be exposed to a powerful, concentrated attack like that through the VM management interface.
Cornish, in his
deletion of 88 production servers
at Japanese pharmaceutical company Shionogi, had a legitimate password, probably handed off to him from an unidentified insider about to become a casualty of layoffs. Shionogis procedures didnt detect the maneuver or the placement of a vSphere client on a data center server from which an authorized IT administrator could gain access to vCenter management consoles. With these tools in hand, Cornish deleted his former employers production environment, apparently while munching down $4.96 worth of hamburger and fries at McDonalds.
Mark Chuang, VMwares director of product marketing in the security area, did not respond to a query about the Cornish affair. But he said in an interview at VMworld Aug. 31 that VMwares vShield framework contains many VMware security measures, plus third parties are plugging their own security products into it. The plug-ins work through a VMware vShield API. Together, these point products and VMwares measures amount to a defense in depth, he said.
What about intruders? VMware works with three partners to supply intrusion detection in the virtual environment. They are McAfees Network IPS, HPs Tipping Point, and Sourcefire. These three also happen to be Gartners picks as the three leading intrusion detection/intrusion prevention vendors. McAfee has been a leader in the field for the past five years, according to Gartner. HP enjoys a leadership spot, thanks to its acquisition of
Tipping Point
as part of the 3Com purchase. Sourcefire is an intrusion prevention specialist; its Sourcefire 3D System appliance has been rated by NSS Labs as providing the most complete protection among the IPS competitors.
Intrusion detection--I should say, intrusion prevention, as the field has changed--consists of using an appliance on the network to inspect all incoming packets in real time, looking for any patterns that match known patterns of attack. The appliance can block an attack signature when it detects one. In many cases, a McAfee, Tipping Point, or Sourcefire intrusion prevention appliance is going to be a physical device. But theres no reason it cant also be a virtual appliance and be installed at a specific point of vulnerability in the virtual environment. Sourcefire in particular has been quick to extend physical world-type protections into virtual appliances and virtual world operations.
These systems are updated quickly, usually within 24 hours, when a new malware signature is discovered, which makes them useful as blocking mechanisms until all data center servers can be updated with a vulnerability patch.
Would one of these systems have prevented a Cornish-style attack? No, Cornish did not use any malware or attack pattern to get into the data center over the network. He connected and logged in as an authorized user, which is a different problem, and one that is related to an insider-style attack. By definition, intrusion detection is looking for outsiders coming in.
In addition to intrusion detection at the network perimeter, there are many additional security boundaries that can be guarded. Chuang said applications may be grouped according to their sensitivity in particular hardware clusters, then security measures, such as firewalls, applied to those clusters--another physical boundary.
At the same time, the VMware API allows third party security products to peer inside the operation of specific virtual machines, including their CPU and memory use, allowing the addition of highly specific point products to the virtual environment.
Chuang mentioned seven security partners: Trend Micro, Symantec, Luminous, Sophos, BitDefender, Kaspersky, and again, McAfee. They offer different security measures, including virtual firewalls applied to specific virtual machines or virtual machine hosts. Lets take a look at a few of them to see how defense in depth might be constructed.
Trend Micro focuses on defense of the integrity of servers in the data center, including host servers and their virtual machines, said Harish Agastya, director of marketing for the firms data center security products, in an interview. We can make sure the files have not been modified in some way. Our software notifies you if something has changed, said Agastya.
Trend Micros Deep Security product, which acts as a watchdog over virtual and physical environments, would have notified the Shionogi IT staffers that Cornish had deleted the files of its production systems--but after the fact notification isnt much help, is it?
Deep Security, however, was highly useful in a situation where a knowledgeable insider modified the payroll system just before direct deposits were made in order to route a number of deposits to his own account. The alteration was then erased at the end of the payroll run and the original list of recipients restored. When employees complained they hadnt gotten their payments, IT managers could find no defect in the payroll list. But using Trend Micros Deep Security product, they found that the files were being altered, then restored, immediately before and after the payroll run. The discovery helped IT administrators identify who was capable of such a maneuver and track down the offender, Agastya said.
The Deep Security virtual appliance, working with VMwares vShield Endpoint, can maintain vigilance over virtual machine files, examine access attempts for any known threats, and screen out malware, he added. VShield Endpoint allows the normal processing required by an agent located in a virtual machine--the usual way of implementing anti-malware measures--to be offloaded to Deep Security, improving virtual machine performance. Trend Micros approach is agent-less, said Agastya. Symantec, as another VMware security partner, offers a suite of backup, recovery, and data protection products. In addition, in May, it announced
Virtualization Ray
, or V-Ray, to supply visibility into a variety of virtualized environments and help protect them. It provides you the visibility needed to peer inside your VMs and understand how to protect these systems it said at the time.
How does that make you more secure? Well after the announcement, Stephen Foskett explained
in his Packrat blog
that V-Ray has been embedded in Symantec products such as NetBackup and Backup Exec. V-Ray can identify files within a virtual machine image that have been changed, compared to a secure, backup image, and recover the original virtual machine by restoring the correct file. This is quicker than rebuilding an entire virtual machine from scratch.
The visibility offered by V-Ray will be embedded in other Symantec products that work in virtual environments.
Sophos provides spam and malware protection and email encryption, as well as data loss protection, in its Virtual Email Security Appliance. Data loss protection is an inspection service that detects and prevents the exposure of sensitive data, such as credit card or social security numbers, being moved around carelessly in email. The Sophos virtual appliance combines runs in the virtual environment alongside a virtualized email server.
The Sophos antivirus protection engine, however, has its shortcomings, according to some observers. For a summary of its weaknesses, read this report on the findings of Google researcher
Tavis Ormandy
at the Black Hat USA event last month in Las Vegas.
Data loss protection is one of the latest measures VMware has added to its vShield 5.0 framework, Chuang said. It included DLP from EMC subsidiary, RSA, a sister company to VMware. Many people dont know when they have sensitive information resident on virtual machines. Our goal is to do whatever we can do to help insure compliance, he said.
File protection and compliance protection are strong security measures to add to the virtual environment, but they still dont amount to much protection against a character such as Jason Cornish, due to be sentenced for the $800,000 in damage he caused Shiongi last November.
I was discussing that point with Eric Chiu, CEO of HyTrust at VMworld Aug. 31, and he claimed, 80% of the people we talk to have not secured their virtual machines. As the virtualized part of the data center continues to grow, that picture has to change.
He recommended products that can log who is accessing and copying virtual machines. They may be stealing, he notes matter of factly. Only give virtual machine administrators the level of privilege they need to do their jobs. Dont give the god-like root privileges to everyone.
In addition, limit the number of servers any one administrator may access, and include an alerting system that tells responsible parties when bad things are happening, such as the deletion of a production server or multiple productions servers, he recommends.
This still would not have prevented Jason Cornish from doing damage, but it would have limited the damage one former systems administrator could have done, even with illicitly restored privileges. In the virtual world, new boundaries can and must be identified and watchdog measures, as well as the more traditional filtering mechanisms, put in place to sound the alarm when something starts to go wrong.
Virtualization is taking over enough of the data center to raise particular security concerns. For VMwares wider view, see
VMwares Next Act: Operations Expert.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Virtualization Security: No One Product Does It