Download to read offline
More Related Content
VMware Security
- 1.
- 2. VMs A self-contained operating environmentthat behaves as if it is a separate computer. For example, Java applets run in a Java virtual machine (VM) that has no access to the host OS. This design has two advantages: • System Independence • Security
- 3. • VMs donot require specialized hypervisor- specific hardware. Virtualization does however require more bandwidth, storage and processing capacity than a traditional server. • VMs can easily move, be copied and reassigned between host servers to optimize hardware resource utilization. Because VMs on a physical host can consume unequal resource quantities (one may hog the available physical storage while another stores little), IT professionals must balance VMs with
- 4. VMware SECURITY • Itis strongly recommended that each virtual machine be treated as if it was a physical machine for most activities. • VMs are vulnerable to most of the same things as physical machines including data loss/corruption, hardware failures, viruses, and hackers. • Install and use virus scanning software.
- 5. • Take regularupdates to your operating system, preferably via an automatic update system. • Make regular backups of important data. Follow the recommended best practices for your guest operating system. • In most cases, simply treat your virtual workstation as you would any other machine.
- 6. SECURITY RECOMMENDATIONS • Treateach virtual machine as though it is a real machine for the purposes of security. • Install Anti-Virus Software • Choose Strong Passwords • Keep your Operating Systems Updated • Maintain Like Risk Postures for All Machines • Limit Host Access (firewalled off).
- 7. BEST PRACTICES • Don'tregister a virtual machine for DHCP on wireless. • When copying or backing up a VM image: –Make sure the virtual machine is powered off. –Do not copy the lock file directory (the only subdirectory that ends in ".lck"). • When restoring from backup, use move, not copy. This prevents issues with duplicate MAC Addresses on the same
- 8. • Treat eachVM as a standalone computer for security purposes. Install virus scanning software. Take regular OS updates. • Enable "Time synchronization between the virtual machine and the host operating system" via the VMware Tools installed on the virtual machine. • Networking: use NAT. This should be the default setting for your VMs.
- 9. • Carefully planyour disk allocations. Do not over-allocate your disk. It is dangerous to tell VMware to make images that, if they all grew to their full size, would take up more disk space than you have free. If this happens, VMware may pop up an alert, warning you when you're about to use up more space than you have. That would give you a chance to free up disk space or exit cleanly.
- 10. BACKUP • VMs areat just as much risk for data loss, , if not more, for data loss due to hardware failure, file corruption, system compromise, and other events. • If data loss happens, a backup can make a world of difference in recovering from such an event. How you use your virtual machine (VM) will determine the best way to do backups for your VMs.
- 11. • You haveimportant software/data in the VM (research, data, etc): Install software that runs regular backups of the data within within your VM. This method doesn’t preserve your VM , just the data within it. it. • Your VM is an appliance: We recommend that the system administrator manually makes backups. This preserves both the VM VM and your data within it. Simply, drag and copy the VM somewhere (e.g., an external drive). Exclude your VM files from from regular backups.
- 12. Things to noteregarding virtual machine backups: • A VM image is actually comprised of several files. All of those have to be in sync or behavior is erratic. • From outside the VM (host machine), if a backup is made when the VM is running, the results are inconsistent. Backup your VM files on the host machine when the VM is not running.
- 13. SECURITY RISKS SPECIFICTO VMS While VMs are at risk of all the same things as any other machine, you should be aware of a few additional issues. • If a host is compromised, scripts can be run on the host that can interact with the guest at whatever privilege level the guest is logged in as. This can result in malicious Trojans being installed on the host and guest machines.
- 14. • A VMthat is not virus protected, compromised, and in a shared networking configuration can be used by an attacker to scan both the private and public address spaces. The other VMs on the host (if not patched) can also be exploited via the network, so a software firewall on each of the guests is recommended. • (Enterprise version) When turning on shared folders, they can be accessed through a compromised guest. Files can then be placed on the host and attackers can access other guests' file
- 15.
- 16.
Editor's Notes
- #3 System Independence: A Java application will run the same in any Java VM, regardless of hardware / software underlying the system. Security: Because the VM has no contact with the OS, there is little possibility of a Java program damaging other files or applications. This however, has a downside. Because programs running in a VM are separate from the OS, they cannot take advantage of special OS features.
- #10 (LAST POINT) We don't recommend relying on the warning. There's no guarantee it will appear before bad things (data loss or corruption) happen.