>> When we talk about virtualization,
we really have to talk about the heart and
soul of a virtualized environment,
and that's the hypervisor.
The hypervisor is what allows
OS isolation into Virtual Machines.
It's going to provide communication
from what's happening in Virtual Machine,
either through the operating system
or directly to the hardware.
That depends on whether or not we have
a type I or type II Hypervisor.
A type I Hypervisor,
sometimes referred to as the "bare metal" Hypervisor,
meaning that it sits directly on top of
the hardware so you don't
install an operating system first.
You install the hypervisor,
and it has direct access to the hardware
through the commands within the virtual software.
With this, you have a more secure system.
It's hardware-based.
It's just a Virtual Machine,
and because of that, you get better performance.
You cut out the middleman that comes
with a type II Hypervisor.
With a type II Hypervisor,
you first install a host-based operating system
like Windows or Linux,
then on top of that,
you install a Virtual Machine through
an application like Oracle VBox.
That's the one I've been using a lot lately.
>> I like that.
>> There's a Virtual Machine on your VM workstation.
Those are the ones that most users
may have more experience with.
This is considered to be software-based because it's
software that you install on
>> top of an operating system,
>> but here's the deal with that.
All of your commands from the VM are
running through the guest operating system,
so you've got that middleman.
Keep in mind, if you're running this on
Windows and Linux operating systems,
you have the vulnerabilities of
those operating systems introduced to the mix.
When we use these,
you might be using them in a lab environment.
We might be using them on
an individual system to do things with
application virtualization or for testing devices.
But when we're talking about
>> really virtualizing servers,
>> that's when we're going to do
this bare metal type I Hypervisor.
Any Cloud-based service providers going to
be running type I?
If hypervisors are compromised,
everything in the virtual environment is compromised,
and there are rootkits for hypervisors.
There are types of malware
that specifically target hypervisors.
We need to make sure that our hypervisor,
like any other piece of software, is hardened.
It's up to date pass just
like any other operating system or
application that does reduce
the likelihood of having malicious code introduced.
As a general rule,
if we're accessing our resources through
the Cloud and we have a virtualized environment,
the hypervisor is usually
the Cloud services provider's responsibility.
We need to make sure that we know
how that's protected and be
aware of any mitigating strategies to keep that safe.
If we're running the type II Hypervisor,
then, of course,
we're responsible for making sure
this software is patched and running correctly.
Lots of concerns here.
Again, virtualization doesn't fix
every problem and it certainly
doesn't make your typical problems go away.
One of the first issues that we have to think
about is an issue called VM escape,
which is exactly what it sounds like.
Virtualization is supposed to be
true isolation for these applications and systems.
In a multi-union environment,
our visual system should be truly
isolated from other virtual systems.
However, VM escape is when some entity,
whether it's a process or an individual,
hops from one Virtual Machine to another.
Shouldn't happen, but again,
there are attacks specifically
geared towards virtualized environments.
Another concern.
You may have maybe 15 different services
running on a single physical machine.
That means that one network card
>> on that system provides
>> a pathway into the system for all those 15 services.
From a physical perspective as well,
if you have failure of that physical machine then
services are gone from the time
being until we can get it restored.
Other ideas like anti-malware.
A lot of times we slap anti-malware on
a machine and we say we're good.
That's all taken care of.
But what you have is you have
numerous Virtual Machine running on a system.
You have to have anti-malware on the host.
But for each additional guest operating system
that has to be scanned for malware as well.
It really is like a separate physical machine.
The same thing with monitory.
You're not going to get monitoring of
those virtual machines from
one tool and just scanning the host.
We have to make
these considerations and make sure we have
the right tools and each of
>> the guest operating systems.
>> Last but not least, unintentional bridging.
Like we said, you've got
one network care connecting
you out to the public network.
You've got an internal network
and your virtual network cards.
You can build a virtual network,
connect everybody through
virtual switches, and all that's great.
But if we misconfigured our network cards,
they may be bridged out to the network,
which is exactly how things like VM escapes happiness.
I've accidentally got a pathway to
the network through my host machine.
We need to make sure that those are limited to
the virtual land as opposed
to being bridged to the outside world.
We wrap up the discussion, virtualization.
There's no doubt that it has numerous benefits.
Virtualization saves us space,
saves our hardware,
saves on heating and cooling and allows us to
run multiple services on a single physical machine,
making it more cost-effective.
All that's great. We get
Virtual Desktop Interfaces where
we take that golden image,
that's a configuration of
exactly what we want on those host computers,
and then even if our clients or end-users make changes,
it's still going to refer back to
the golden image of the end of the day.
We have to think about our hypervisors.
Our hypervisors are either type I or type II.
Type 1 is a bare metal hypervisor,
that's directly on top of the hardware.
That's where you're going to get the best performance
and the best security because there is no middleman.
Now, with the hypervisor,
there's type II,
install the hypervisor on top of the operating system,
for the hypervisor to interact with
the hardware has to go through the OS.
That OS has its own set of vulnerabilities.
Then last, we discussed some security concerns.
We said no environment is perfect.
You have to watch for things like
VM escape or process might move from
one VM to another and
perhaps malware or worm might spread.
We have to think about things like hyper jacking,
which is where a rootkit gets
installed in the hypervisor.
We have to be concerned with multi-tenancy.
There are a lot of areas for
security concerns of hypervisors and virtualization.
But with our due diligence and a little bit of effort,
we can secure these environments and reap the benefits.