NIST's how-to on securing virtual machines
Connecting state and local government leaders
The benefits of virtualization can be offset by added complexity and security risks; NIST has released guidelines for addressing these risks.
Virtualization, which can allow multiple operating systems to run on a single platform and emulate separate machines, offers the promise of efficiency and can help to enable cloud computing, but it can come at the cost of increased complexity and risk, the National Institute of Standards and Security warns.
NIST has released a set of guidelines for addressing these risks in Special Publication 800-125, "Guide to Security for Full Virtualization Technologies.”
The guidelines complement recently released drafts of NIST security guidelines for public cloud computing. The agency also has set up a new wiki, the Cloud Computing Collaboration site to enable communication among the cloud community and NIST cloud research working groups.
“The recent increase in the use of full virtualization products and services has been driven by many benefits,” the guidelines say. Mounting multiple virtual machines on a single server can make more efficient use of hardware and processing capacity, and can provide desktops with access to a variety of operating systems and applications. “Desktop virtualization also supports better control of OSes to ensure that they meet the organization’s security requirements.”
Related coverage:
NIST guide tackles security challenges of public cloud computing
But, “full virtualization has some negative security implications,” NIST warns. “Virtualization adds layers of technology, which can increase the security management burden by necessitating additional security controls. Also, combining many systems onto a single physical computer can cause a larger impact if a security compromise occurs.”
Ease of sharing information between systems also can open new attack vectors if not carefully controlled. “In some cases, virtualized environments are quite dynamic, which makes creating and maintaining the necessary security boundaries more complex.”
SP 800-125 addresses security concerns for both server and desktop virtualization, building on general security best practices to provide specific guidance for the new environments. Its recommendations are to:
- Secure all elements of a full virtualization solution and maintain their security. The security of a full virtualization solution is heavily dependent on the individual security of each of its components, from the hypervisor and host operating system to guest operating systems, applications and storage.
- Restrict and protect administrator access to the virtualization solution. The security of the entire virtual infrastructure relies on the security of the virtualization management system that controls the hypervisor and allows the operator to start guest operating systems, create new guest operating system images and perform other administrative actions.
- Ensure that the hypervisor is properly secured. Securing a hypervisor involves actions that are standard for any type of software, such as installing updates. Other recommended actions specific to hypervisors include disabling unused virtual hardware, disabling unneeded hypervisor services, and monitoring the security of each guest operating system running within it as well as activity occurring between guest operating systems.
- Carefully plan the security for a full virtualization solution before installing, configuring and deploying it. Security should be considered from the initial planning stage of the systems development life cycle to maximize security and minimize costs. It is much more difficult and expensive to address security after deployment and implementation.
NIST also has proposed guidelines for addressing the challenges of cloud computing in draft SP 800-144, "Guidelines on Security and Privacy in Public Cloud Computing," along with a concise definition of cloud computing in draft SP 800-145.
“The security challenges cloud computing presents are formidable, especially for public clouds whose infrastructure and computational resources are owned by an outside party that sells those services to the general public,” the guidelines say. They provide an overview of security and privacy challenges, and points out considerations that organizations should take when outsourcing data, applications and infrastructure to a public cloud.
To foster collaboration among the cloud community and help ensure the government's secure adoption of cloud computing, NIST also has set up the Cloud Computing Collaboration.
This site includes general information about NIST's cloud computing program and events. These pages are used by the NIST-sponsored working groups established at the November Cloud Computing Forum and Workshop II. The pages provide descriptions of the group's task, weekly meeting information and working documents. Registration is required to contribute to the wiki, which can be done from the link on the main NIST Cloud Computing Program website.