IT Security Risk Mitigation Report: Virtualization Security

New report from Booz Allen identifies fundamental virtualization risks and countermeasures to reduce them.

To avoid compromising a single server—and potentially other network services—in an enterprise, organizations have traditionally relied on separate servers. But this can be costly. Virtualization offers a cost-effective alternative with greater IT resource utilization and flexibility. It also allows organizations to leverage processing power that would otherwise sit idle by deploying a unique virtual machine (VM) for each network service on one host while maintaining separation between servers.

Although virtualization has been around for 30 years, only recently has it become a key technology in supporting security for cloud computing. It provides an approach to consolidate data centers and improve asset utilization and system control. But virtualization also introduces risks from the increased complexity involved in the virtualized environment management, hypervisor, and other paradigms. Booz Allen Hamilton’s report, “IT Security Risk Mitigation Report: Virtualization Security,” identifies fundamental virtualization risks and countermeasures to reduce them.

To be mitigated effectively, risks associated with virtualization must be fully understood. Booz Allen’s report found that risk mitigation strategies in these scenarios are similar to the defense-in-depth strategies employed in any IT environment, e.g., expanding security patching programs to include the hypervisor (i.e., software that mediates VMs and host interactions), host systems, and VMs. In addition, the standard threats to the enterprise infrastructure not only remain with virtualization, they expand.

The virtualization software itself is of particular concern because the hypervisor maintains all communication channels to the VMs. An attack on these channels, therefore, could potentially hijack the VM itself. In addition, the report discusses other measures that must be applied to ensure virtualization security, including preventing VMEscape—one of the most dangerous attacks an organization can face.

Security is a major area of concern for any organization deploying a virtual environment. The introduction of VMs has created security considerations unheard of just a few years ago. “IT Security Risk Mitigation Report: Virtualization Security” provides insight into managing these new risks, and shows how Booz Allen’s expertise helps organizations develop comprehensive and secure virtualization solutions that comply with federal security standards.
 
Booz Allen Associates Nima Khamooshi, Wilson Leung, and Theodore Winograd contributed to the report.

study posted December 4, 2008