The growth of virtualization within enterprise IT is causing security experts to raise alarms about potential risks. Virtualization has made the flow of information more seamless, but traditional security and compliance rules no longer apply within the changed environment.
While hypervisor updates and security products focused on virtualization are improving virtual machine security, there are still significant threats that must be addressed. In general, there are five common oversights regarding virtual server security that businesses need to resolve.
1. Sacrificing security for ease of use.
Virtualization offers tremendous flexibility and has significantly eased the management of information. However, both of these boons often make virtual infrastructure less secure.
One example is this: VMware comes with many simple-to-use configuration options designed to make administration of the virtual server easier. However, these options can hurt security if a business blindly trusts the default settings. The default vSwitch settings are essentially an open door that potential hackers know how to exploit and circumvent.
2. Not managing roles and permissions.
Easy-to-hack settings is bad enough, but when this is coupled with a failure to restrict access and to limit permissions for users, a business is entering incendiary terrain.
If a business gives junior administrators and low-level staff full access—and not limited rights and privileges—there exists a strong possibility that this access will be abused. The abuse need not be intentional either.
The solution is this: Give zero permission to everyone and then add administrative rights based on each employee’s role and responsibilities.
3. Ignoring resource controls.
Among the greatest risks to virtual infrastructures is that the workloads do not have any physical separation. This reliance on a single host makes it easy for problems to spread and extend throughout.
Fortunately, the problem can be fixed by placing limits on VM (virtual machine) resources. This makes it nearly impossible for one VM or critical resource to starve another. CPU and memory access are only part of the equation; it’s equally important that storage and network I/O (input/output) controls be in place to prevent distributed-denial-of-service attacks.
4. Not maintaining a rigid schedule for maintenance and patch application.
Maintenance and path applications are not exciting chores, but they can cause temporary service disruptions that upset end-users.
Simply, these tasks are essential to keeping infrastructure protected. If a business doesn’t take the time to ensure that its networks are protected with the latest security fixes, trouble looms ahead. The solution is to establish a regular maintenance schedule and stick to it to ensure that virtual servers are protected from the most common threats and hacks.
5. Drifting out of configuration and compliance.
Security within virtual infrastructures is very similar to that within the physical world.
It’s important to clearly define and adhere to company policies to ensure that safety and security never lag. Over time, complacency can set in; this causes a business to gradually drift out of compliance. When this happens, errors and breaches are nearly inevitable.
The solution is to utilize a configuration tool in conjunction with a well-defined system to manage the virtual server. Doing so ensures that the virtual machine’s configuration doesn’t change at any point throughout its life cycle.
