NIST drafts guide for hypervisor security
Connecting state and local government leaders
The widespread growth in server virtualization for hosting enterprise applications and providing cloud services calls for new recommendations for secure deployment of hypervisor platforms, the standards agency said.
The National Institute of Standards and Technology released a draft of SP-800-125 A, Security Recommendations for Hypervisor Deployment, for public comment. Because of widespread growth in server virtualization for hosting enterprise applications and providing cloud services, recommendations for secure deployment of hypervisor platforms are needed, the standards agency said.
Since the January 2011 publication of NIST’s SP 800-125, Guide to Security for Full Virtualization Technologies, both the feature set of hypervisors as well as tools for configuring the virtualized infrastructure spawned by the hypervisor have seen considerable increase.
The NIST guidance examines the security implications of hypervisor platform choices and provides security recommendations for deployments in an enterprise.
Hypervisors provide abstraction of all physical resources (such as CPU, memory, network and storage) and allow IT managers to run multiple virtual machines (VMs) on a single physical host, also referred to as a virtualized or hypervisor host. The hypervisor can also define a network that enables communication among the VMs. Enterprise data centers use the hypervisor for server virtualization because it makes better use of hardware resources and reduces power consumption However, it is also susceptible to threats from rogue VMs that can subvert the hypervisor’s access control to hardware resources such as memory and storage.
In providing security recommendations for the hypervisor, NIST has taken two different approaches: One is based on platform options that provide ease of security assurance, and the second is based on configuration choices such as management of virtual machines, hypervisor host, hypervisor software and virtual networks, NIST said.
SP-800-125 A defines a set of 22 security recommendations (in terms of architectural choices and configuration settings) intended to ensure the security of tasks performed by the hypervisor.
In its draft, NIST classifies the hypervisor platform architecture along three dimensions, with each providing at least two different architectural choices. The choices refer to the ease of providing security assurance in one architectural type compared to another.
- The entity over which the hypervisor installs – whether bare metal (directly on hardware) or over a full-fledged host operating system.
- Source of support for functions such as processor and memory virtualization – whether hardware or software.
- Hardware support for boot integrity assurance – whether yes or no.
The security recommendations on baseline functions refer to configuration choices that ensure the secure execution of tasks. Those functions are:
- Execution isolation for VMs – Scheduling VMs for execution, management of the application processes running in VMs as well as context switching between various processor states when running applications in VMs.
- Device emulation and access control – Emulating all network and storage devices that different native drivers in VMs are expecting, mediating access to physical devices by different VMs.
- Execution of privileged operations for guest VMs – Certain operations invoked by guest operating systems, instead of being executed directly by the host hardware, may have to be run on its behalf by the hypervisor, because of their privileged nature.
- Management of VMs – Setting configuration parameters for VMs and control of VM states, such as start, pause, stop etc.
- Administration of hypervisor platform and hypervisor software – This involves setting parameters for user interactions with the hypervisor host as well as hypervisor software and configuration of the virtual network inside the hypervisor.
According to NIST, the draft hypervisor security recommendations are needed because of the unique functions that the hypervisor performs as well as the features of the underlying hardware platform.
The public comment period closes on Monday, Nov. 10, 2014. Comments should be sent to mouli@nist.gov.