TECHNOLOGY FOR CHANGE

Virtualization Security Needs a Closer Look

Salvatore Salamone | Date: 05-10-10 | Comments

North Carolina State University researchers are exploring ways to make virtualization and cloud computing more secure�something that is increasingly needed as more organizations embrace the two technologies.

Most IT organizations are using virtualization and cloud computing today. But many have not yet moved their mission-critical apps to virtualized servers.

A CDW survey of 387 IT executives found that while 90 percent of enterprises have virtualized portions of their data centers, 62 percent are still keeping critical apps on physical servers.

One reason for the delay is security. Gartner estimates that through 2012, 60 percent of virtualized servers will be less secure than the physical servers they replace.

Why less secure? There are immature tools to protect virtualized environments. And in a bit of a twist, the blame also has to do with virtualization�s ease of use. Creation and deployment of virtual machines is fast and uncomplicated compared with what�s needed in a traditional deployment. As a result, individuals and groups sometimes get their projects going bypassing IT.

With funding from the National Science Foundation and the U.S. Army Research Office, North Carolina State University researchers are trying to address the first problem. To that end, Dr. Xuxian Jiang, assistant professor of computer science, and his Ph.D. student Zhi Wang have developed software called HyperSafe to secure hypervisors against malware attacks.

�We can guarantee the integrity of the underlying hypervisor by protecting it from being compromised by any malware downloaded by an individual user,� Jiang says. �By doing so, we can ensure the hypervisor�s isolation.�

According to the researchers, for malware to affect a hypervisor, it typically needs to run its own code in the hypervisor. HyperSafe utilizes two components to prevent that from happening. First, the HyperSafe program uses a technique called non-bypassable memory lockdown, which bars the introduction of new code by anyone other than the hypervisor administrator. �This also prevents attempts to modify existing hypervisor code by external users,� Jiang explains.

Second, HyperSafe uses a technique called restricted pointer indexing. This technique characterizes a hypervisor�s normal behavior and then prevents any deviation from that profile. So only the hypervisor administrators themselves can introduce changes to the hypervisor code.

Jiang and Wang will present their research May 18 at the 31st IEEE Symposium on Security and Privacy in Oakland, Calif.

Locking Down Administration

As researchers and vendors work to improve virtualization security tools, organizations can take steps now to address the other problem Gartner identified�that of individuals and groups bypassing IT and lax deployment methods.

This problem was substantiated in a study released last month by security and compliance solutions provider Prism Microsystems. The company surveyed 302 security and IT managers, and found that 65 percent of respondents indicated they have not implemented separation of duties between the staffers responsible for provisioning virtual machines and other administrator groups. eWEEK noted that �not coincidentally, 34.9 percent said they are worried about the potential for insider abuse due to the expanded control available to administrators.� In addition, compromising the credentials of a virtual administrator could provide an outside hacker with �the keys to the castle.�

The solution here is not technical. Addressing this problem requires policies and procedures to ensure all deployments are properly done to minimize security risks. To get started, the Website Help Net Security offers an overview of virtualization security issues and tips.