Compliance in Virtualized Environments

Compliance Challenges in Virtualized Environments

Compliance to best practice and industry standards is challenging for new technologies like virtualization
Compliance in Virtualized Environments
Compliance Standards
Assurance of Control Objectives
Prescription of Control Implementations

New technologies introduce new components and processes causing conflict with existing control prescriptions
Each server must only have one primary function.[§ 2.2.1, Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers Version 1.2 October 2008, v1.2]
Key components should be protected by segregating the critical applications from the other applications and information.[CI2.1.4(a), The Standard of Good Practice for Information Security]
Utility programs are programs that may be able to override system and application controls. They should be restricted and controlled. If these system utilities are not needed, they should be disabled or removed.[§ 11.5.4, ISO/IEC 27002-2005 Code of practice for information security management]

Security boundaries within process and technical domains are still being defined and designed for virtualization
What consistent best practice exists for virtualized image management?
Are there varying levels of granularity regarding access control within different virtualization technologies?

Virtualized PCI Application Domain Model
Relationship Scenarios
S1. Untrusted users publicly enter PCI information
S2. / S2a. Servers transfer PCI info to provider (S2a. Telephone)
S3. Remote locations access applications containing PCI Information
S6. Staff access PCI application from LAN/WAN
S7. Staff access management interfaces of physical and virtual guests and hosts
S9.Staff access management interfaces of the routers/switches
S11. Data is transferred between the Web-facing PCI Servers and internal PCI database servers

What do we want to be compliant with?
HIPAA, PCI, SOX, GLB, NERC, CFR
Do the high level objectives of the compliance standard conflict with virtualization?
Does the regulating body allow for interpretation of the standards?
Who has the regulating body assigned to attest to the compliance of the standards?

What specific control objectives are impacted by virtualization? (Improved?)
Process and environment classification (NERC CIP-003-1 R4.2)
Extension of information asset classification(HIPAA 164.308(a)(7)(ii)(E))
Log Monitoring & Tracking (PCI 4.2 (v1.1))
System boundary definition (NIST 800-53)
Are there specific control implementations in conflict?
Least Privilege implementation issues
Lockout Procedure By-pass

What design & service management issues in virtualization are related to compliance?
Business Continuity Management
Security Audit & Assurance Levels
Change Control Implementations
Security Domain / Boundary Control
Access Control & Privilege Administration
Security Operation Schedule Management

Issues with Virtualized Environments and PCI Compliance
Understanding of domains,boundaries & access
7.1 – Is access to computing resources and cardholder information limited to only those individuals whose jobs require such access?
Does a logical virtualization deployment diagram exist?
Will “complex” virtualization management components (HA, DRS, Vmotion or VCB) be used in the environment?
How is virtualization platform user administration performed?(ESX/VCenter)

Example EnvironmentDiagram (Poor / No information)

Example LogicalDiagram (Better)

Configuration Questions(1-4)
What legacy systems will be migrated to the ESX environment?
What do systems currently hosted in the ESX environment do?
Does a logical deployment diagram for PCI systems exist?
Will HA, DRS, Vmotion or VCB be used in this environment?
Are there change management policies in place for system management?
Is there a formal installation procedure for ESX hosts? Guests? Virtual Centre?

Configuration Questions (2-4)
What resource limiting and share assignment exists in the design?
How is ESX/VCenter user administration performed? Formally documented?
What security measures are place to avoid copying/pasting or adding of devices to the virtual guests?
Are templates being used for deploying guests? If so, what security measures are being used for template creation?
What system logging policies exist; How is logging deployed within the ESX architecture?
What is currently being done internally for system clock synchronization?

Configuration Questions(3-4)
Is there a formal policy in place for physical access to the data centre?
What security measures will be applied virtual machines: System hardening, antivirus agents, spyware filters, intrusion detection
systems, etc.
What policy for vulnerability management within the virtualized
architecture has been defined?
Is SAN zoning and masking configured and managed properly to ensure
unauthorized presentation of data to virtual machines?

Configuration Questions (4-4)
The Windows host running VirtualCentre (VC) must have strict security measures enforced in order to protect access to the management of the virtual infrastructure.
What account is used to run VirtualCentre in the management stations?
What roles and permissions are used/disabled in VC?
Is the VC computer placed in a separate management network?
Where does the VC database reside and what method of authentication is used on this database?
What security practices have been applied to secure the database?
Are self-signed certificates used?

General Thoughts around Virtualization & PCI
The fallacy of cost reduction
Increased complexity
Increase in exposure to:
Technical misconfiguration
Central points of access / collusion for staff
LEGAL LIABILITY

Real world issues in virtualization compliance:
Design & Service Management standards are changing rapidly
Experts disagree on effectiveness of controls and implementations
Virtualization allows people and entities to quickly create boundary less service environments

How do I approach a compliance review in my environment?
Understand your compliance governance structure
Understand your virtualization security architecture
Manage and compensate for real world issues

Thanks
Michael Legary, CISSP, CISM, CISA, CCSA, CSA, GCIHFounder & CIOSeccuris Inc.Email: Michael.Legary@seccuris.comDirect: 204-255-4490Main: 204-255-4136Fax: 204-942-6705
This presentation contains reference material and direct content from multiple copyright holders. References available on request / within presentation slide notes.
Resources
Center for Internet Security
http://www.cisecurity.org/
VMware Security Center
http://www.vmware.com/security/

Compliance in Virtualized Environments

by Seccuris Inc.

Accessibility

Categories

Upload Details

Usage Rights

1 Embed 7

Statistics