There is quite a bit of documentation on bare metal or Type 1 hypervisors, including my own book, VMware vSphereTM and Virtual Infrastructure Security: Securing the Virtual Environment, but there is not much material on the proper security of hosted environments, or Type 2 hypervisors, such as Microsoft Virtual Server, VMware Workstation, Fusion, Player, or Server as well as Qemu, Virtuozzo, or OpenVZ.
VMware vSphere has started its journey to Common Criteria certification,
The biggest question I ask myself when I see VMsafe appliances is: will it replace my current virtual firewall setup? Replace my Anti-virus? or Both? I am seeing a trend that gives me pause. That is a VMsafe appliance being more than one thing. For example, Trend Micro is an Anti-Virus company that bought Third Brigade (a firewall company) and are now in the mix of merging the two technologies into one. What has happened to one tool that does one thing and does that one thing very well?
Since I last blogged ThinApp I have been thinking about the security aspects of ThinApp and came up with a set of questions to which I searched for some answers. In essence could ThinApp be used to subvert existing system security? What about other similar technologies like Microsoft App-V.
The use of VMware VMsafe enabled third party products introduces third party fastpath drivers into your hypervisor. What these drivers ultimately do is interact with the VMsafe fastpath API, but is that ALL they do? That is why we need some level of certification for VMsafe fast path drivers. We need to KNOW that they do not do anything wrong, bad, or unfortunate.
In many cases when you start to discuss security of virtualization, you soon drop into a discussion of virtual networking, and management network security. In other words you are laying out the traditional security zones that exist within the networking world. Network security, virtual and physical, is extremely important however there is more to virtualization security than just your network. Here are some new ways to consider virtualization security.