Virtualization is utterly fantastic.
And in this episode I want to talk about some of the security aspects about virtualization.
But before we do that I want to make sure you get an idea of what I've got laying around here.
Mainly to lock in from other episodes where we talk about type 1 Type 2 hypervisor that type of thing.
Let me show you what's going on right here now.
First of all here's my computer right here.
And this machines running Windows 10.
Now what I want to do for starters is show you a type 2 hypervisor that I have running on this particular
system called Oracle's virtual box.
Very very popular.
So I'm going to come down to Oracle's virtual box.
Now if you look really close you can see I've got two windows here.
So first all this is the actual virtual box manager.
And I have one two three four virtual machines already pre-installed here.
And one of them is running and if you want to see that when I K'NEX here and here is one virtual machine
and I don't remember the password right now but doesn't matter that terribly much.
So that is a type 2 hypervisor it's running locally on this system and Virtual Box is a very very common
type of type hypervisor and it's also free.
I love it.
Now the other thing I have running is a type 1 hypervisor So let's take a look at this network diagram
one more time.
So here's my computer running it's Type 2 hypervisor.
Over here I've got a server system and on the server it is running an operating system called VM whereas
e s x y.
Now ESX is kind of the poor man's version of type 1 hypervisor but it works great.
We love it.
VM where we think you're fantastic.
Now if I were to actually walk over to that system and plug a monitor into it it's kind of boring.
I mean you just get this ugly boring screen that means absolutely nothing so other than the actual initial
installation all the heavy lifting that's done with VM Ware is done through a client.
So I happen to have the VM where Klein installed on this particular system they call this the VM manager.
Now this is a slightly older version of ESX I but I like it and for the simple stuff we do here in total
seminars.
It works absolutely great for us the big things we're doing is testing software to make sure that it
works on different operating systems.
We also do some policy checking like if I set a policy that could mess everybody up we try it on a virtual
machine first.
We do patches on a virtual machine make sure the patch doesn't blow everybody up so we can do a lot
of fun stuff with it.
So but what you're looking at here is all the virtual machines we have in fact I'm going to show them
all to you because I don't want you guys to have that kind of access.
But these are all R&D type systems that we keep around for one reason or another.
Invariably someone's going to ask me like I'm running Vista Business and something happened.
So we have examples of all the stuff that we turn to time and time again.
Now to turn one on I just click one and turn on the on button.
But you can see I think I've already got one running here yeah.
So what I've got here is a copy of Ubuntu and if I ever need a new buntu box I can access through my
VM where client and I can turn this on and do anything that I want.
Now there is one more type of virtualization I want to talk about and that is cloud based.
Now using infrastructure as a service is a very very powerful tool today.
Things like Amazon Web Services or my current personal favorite Microsoft asor are really great places
to go if you just need to spin up a web server or a game server or whatever it might be.
And I've actually got a free trial version running right here.
So if you take a look what I have right now is the free trial version of Microsoft Asor and I've got
a bunch of stuff set up and running.
But what I'm mainly interested in showing you right now is this guy right here.
So what you're looking at in this particular case is an up and running server.
You can actually see it's IP address.
I haven't given it a DNS name yet but what I've done is using the Microsoft as your services and this
is all done with their free trial by the way.
I can set up a server.
It will come with an IP address.
It will get a default domain name usually something really boring name like portal or something like
that.
But the important thing is up and running I can configure the DNS I can set IP I can do all kinds of
powerful powerful stuff like that.
So here we're looking at three different types of virtualization the type 2 hypervisor type 1 hypervisor
and a very much a classic cloud infrastructure as a service set up.
So virtual machines are absolutely fantastic I mean obviously they save space.
I can put a lot of computers onto a single physical computer.
They save power for the exact same reason instead of running five or six boxes I just can run one but
they also do a lot of really really important things.
In fact if you really think about it to me virtualization is by itself a security feature with virtualization
I can take care of.
As I mentioned earlier patch management if I want to test a patch I can do it on a virtual machine before
I push it out to all my big boxes if I have hardware issues with virtualization pretty much ex-special
if I'm on one particular platform.
All the hardware can be configured identically so things like do I have the right driver for that video
card or whatever it might be kind of goes out the window availability if something goes down it's trivial
for me to spit up another version of a particular VM so availability is very very important.
And when it comes to testing the test every day I mean security controls.
I want to put in a new type of security control that only allow certain people to log in.
I can put this out on a virtual machine test it and then I can determine whether it's going to work
or not in the real world.
I can also use it for sandboxing in particular when I talk about sandboxing.
I'm talking about making a virtual machine making something that's separate from my real world network
and then doing something with that.
And that way if there's a problem I don't have to risk everybody else.
Software is being dispersed and I want to make sure there's no malware on it.
I can set up a VM make sure it's not connected my network install it and see what happens.
So it's incredibly powerful.
The other big thing that we can do with virtual machines is network separation.
So let's take a look at this little diagram.
So here's my server.
Now on that server is a whole bunch of virtual machines so I'm just going to make for little boxes here
above the server to show the four virtual machines I'm running if I want to separate them from my main
network.
It's trivial.
Pretty much all hypervisor is allow me to create a virtual switch so that I can do is I can create like
a little pretend switch here that's between my real server and my four virtual machines I can connect
the four virtual machines to that but I don't have to connected through the physical server to my real
network.
So if you've got a bunch of virtual machines and you need them segregated it's trivial to do because
of virtual switches on top of that virtual machines handle the lands or anything else just like a real
world computer would do as well.
The last one the big one for me are snapshots and backups.
If I shut down a virtual machine it manifests as a file just one file and backing up becomes trivial.
I can simply make a backup copy of that very large file and I'm talking in many many gigabyte size and
send it off to the side of something blows up.
I can simply bring that file back bring that virtual machine up and it's as though nothing ever happened.
What we tend to do more often though with virtual machines is what we call a snapshot.
So I've actually got that capability right here.
So I'm going to do is I'm going to show you this is the virtual machine I'm running on my oracle virtual
box.
And one of the things I can do if I need to is I can just take a quick snapshot and
I can type in anything I want that helps me describe what's going on.
OK.
And what's happened is a perfect example of the state of this system as it is up and running right now
is stored snapshots are amazing.
If I'm going to be testing a piece of software for example usually where I'm going to do is I'm going
to have this virtual machine I'm going to go ahead take a snapshot install the software and then see
what the differences if something happens that blows up the application.
I can restore instead of having to copy a whole file.
I can just go back to a previous snapshot.
So that is an incredibly powerful tool.
And when you're going to be seen on the exams.
So virtualization is in of itself a security feature.
However there are things that take place within the virtual world that can be a problem.
And I want to just call that virtual threats
when we're talking about threats to virtual machines.
The number one thing you need to remember is that anything that can happen to a virtual machine is the
same stuff that can happen to a physical machine.
So when we're talking about stuff like now where or not patching the machine properly or having a host
firewall although usually a virtual machine will take advantage of whatever network firewalls provided.
But the host is up to you setting up policies so specially if you've got a type 1 or Type 2 hypervisor
that you're directly in control of.
You have to take care of all this stuff.
This is all your job now.
Luckily when you get into the cloud most I S type of setups provide a lot of this stuff.
So take a look right here.
So here in my asor even got a whole big security center and you can see I'm getting lots of red bars
mainly because I haven't said anything up yet.
So if I take a look at this I believe I click on recommendations.
It's got all kinds of stuff.
It's recommending that I do.
So for example add a next generation firewall so if I click on that
I'm going to create a solution.
And lookee here they've got three different companies that are more than glad for a small consideration
to provide all of these tools so when we see stuff like this particularly when it's done on the cloud
we tend to call this security as a service so this is a very very powerful thing.
Now there are two other security aspects that are very unique to virtualization.
So let me talk about both of these and we'll do it through a diagram.
So let's imagine the circle right here is my entire infrastructure all of my computers and everything.
Now over time here the accounting department sets up a virtual machine with Amazon Web Services and
then over here the sales department sets up something on Zaur and somebody else sets up a private cloud
and even with in my own infrastructure people start setting up type 1 hypervisor and stuff like this.
This is known generically as VM sprawl.
Now the sprawl is a bad thing and it's something that we want to avoid.
Unfortunately it can be tricky.
The other one I want to talk about is called V.M. escape.
Now here's a type 1 hypervisor and we're going to say he's got four virtual machines running on like
we talked about earlier.
There are situations this happened 10 12 times over the last 10 years where people have come up with
tricky ways to be able to punch out on the virtual machine and get to the hypervisor itself and the
host system and caused naughty naughty things in general.
These are the types of things we need to avoid.
So let's talk about hardening virtualization.
There's a number of issues to consider when it comes to hardening virtualization.
Probably one of the biggest ones is cleaning data Redmond's.
When you have a virtual ised hypervisor Well when you have hybridize with it's running virtualization
he's going to have a lot of data that's sitting on its drives.
If you ever want to recycle these drives or anything you've got to make sure to clean them out.
Even if you're in a situation where you're taking out one virtual machine it's usually a good idea to
take the time to wipe out all the data that is associated with that one virtual machine.
The biggest thing you can do when it comes to virtualization is make good policies.
You've got to let people know what they can and can't do when it comes to virtualization.
If the accounting department is going over to Amazon Web Services and setting up their own servers that's
because you haven't set up good policies.
So make sure people are aware of that.
Also understand that all hypervisor is come with some type of user privileges built into all of these
and you can decide what users can create virtual machines when you copy virtual machines who can make
snapshots who can just view them and take advantage of these controls so that you have good tight control
on your Vienna's next patch everything.
And I'm not just talking about the virtual machines themselves I'm not talking about just the application
running with virtual machines.
I'm not talking about just the operating system even hypervisor need patching.
So you've got to stay on top of all of these last and this is something that runs into when things get
a little bit more complicated.
The something called Cloud Access security brokers.
Let me show you what that means.
So here's my infrastructure and let's say I've got one particular infrastructure as a service that I'm
using out there for my own websites or whatever it might be a Cloud Access security broker acts as an
intermediary between your infrastructure your in-house stuff and the cloud.
It will either manifest as some type of device that's running locally although that's fairly rare and
it usually shows up as a service that's running up on the cloud itself.
Its job is to make sure that policies are controlled at watches for malware.
It does everything you need to in order to take advantage of the best in security as a service.
The big thing you're going to be running into on the exam when it comes to virtualization is when you
use this type of virtualization do you need a virtual switch or not.
Do you need Cloud Access security brokers.
You're not going to be really running into long questions.
More a matter of you know the network guy needs to do this is virtualization an option and what type
of virtualization do you need to use.