Virtual Machine (VM) Security

Ever since its introduction, virtualization technology has continued to revolutionize the IT industry. The obvious advantages of Virtual Machines have convinced many enterprises to dynamically scale up by using virtualization instead of investing in bare-metal hardware. While it may look like separate machines on the network, they are actually hosted by a hypervisor server.

However, where this feature is beneficial to many enterprises, it also rings the alarm for digital threats. Hackers require less effort to gain access to the VMs if they gain access to the hosting system. With the increasing popularity of VMs and especially, cloud-based VMs, cyber-criminals have started to adopt Virtualization specific attacks. VMware announced a vulnerability on May 25, 2021, which could allow remote code execution on public vCenter servers.

As organizations continue to deploy Virtual Machines and move towards virtualization, concerns about the security of both on-premises and VMs in the Cloud are growing. Here are some of the most common challenges organizations face when adopting VMs:

• Where is the infrastructure located?
• Where is it stored?
• What about backups?
• Who can access it?
• How do auditors observe and test it?

There is no doubt that the flexible working environment of modern enterprises has its benefits, but it also introduces complexity. Moreover, the dynamic nature of virtualization adds a further layer to already complicated infrastructure, so traditional cybersecurity techniques are no longer effective. To counter such issues, an organization must have an effective strategic plan in place. This will prevent malicious users from gaining access to virtual machines as well as other assets of the company. Among the essential practices to secure virtual machines are:

Making sure that the guest operating system of the VM is updated with the latest patches is very critical. Vulnerabilities present in the operating system can be a big deal for attacks like remote desktop access. You can also look for documentation pertaining to your particular operating system to further enhance its security.

A company should not ignore third-party applications installed on the operating system while maintaining the security of VMs. It should be mandatory to update all applications installed on a guest operating system to the latest patch. Updating applications not only reduces chances of vulnerability exploitation but also makes applications more robust and free of bugs.

A company can use different threat monitoring tools to maintain the security posture of its virtual machines. Advanced threat monitoring tools make use of cutting-edge technologies like AI and Machine Learning to actively monitor for vulnerabilities in the system, alerting administrators so they can patch them before any disaster. Anti-malware and anti-spyware applications are one example of such tools. Make sure to utilize them based on your requirements.

Unnecessary features often create more attack surfaces without adding value to the system. It is important to disable rarely used features like unnecessary hardware allocation, copy-paste operations between virtual machines and remote consoles, or host-guest filesystem. An organization can reduce the likelihood of cyberattacks by disabling unwanted features. Minimalist approaches are best, anyway.

Unified Extensible Firmware Interface, commonly known as UEFI, is a firmware upgrade over traditional BIOS firmware. UEFI has a secure boot feature that verifies the integrity of the operating system. In addition, UEFI secure boot blocks attacks such as boot kits that may harm operating systems. This feature is available on almost all modern VM systems.

For humans, making mistakes is natural, and it can happen quite a bit sometimes. Backing up your VMs regularly is always a wise practice, so you can restore them in case of mishaps. Modern VM systems also offer automatic scheduled backups, which can be configured very easily.

A popular Remote Desktop Protocol or RDP, is available for Windows VMs, allowing remote access to them. Its popularity also makes it one of the favorite targets of hackers. It is also a misconception that changing the default port of RDP can safeguard VMs. Hackers today are smart enough to scan the entire range of ports, and can easily discover that a port has been changed. A better approach is to keep RDP closed to the internet and watch for attacks: open the Windows Event Viewer and look at the Windows Security Event Log. Then filter for Event ID 4625, which represents a failed account log-on. If you see the same event in quick succession, then your VM is probably under brute-force attack.

Securing Virtual Machines can also be achieved by hardening your Virtual Machines using CIS Benchmarks to address security misconfiguration of technology software.

Whenever it is necessary to allow inbound traffic for business reasons, make sure that user accounts have a secure and strong username and password combinations. Keep a close eye on these user accounts as well as monitor whether the VM is domain-joined.

Make sure your VM network system is protected using firewalls and by closing ports that are not actively used. All the network traffic flowing in and out of the VMs should be transparent. Hackers are always on the hunt for easy prey by scanning public cloud IP ranges constantly. An organization can prevent many unauthorized users from accessing virtual machines by limiting the management ports like RDP and SSH and reducing the exposure of VMs to the public network.

Most of the operating systems, including Microsoft’s Windows and Linux, can be configured to use encryption. Windows offers BitLocker whereas, on Linux, you can use DM-Crypt to encrypt the secondary storage devices of virtual machines. Many cloud vendors also offer a vault service that can hold your private encryption keys.

If your SaaS product runs entirely on managed platform services, such as serverless functions, managed containers or a managed database, most of this post does not apply to you. There is no guest operating system to patch and no RDP port to close; the provider owns that layer. Your work shifts to identity, secrets, network policy and the configuration of the managed services themselves.

A single VM for a build server or internal tool still needs patching, closed management ports and a backup, but not a hardening program or a threat monitoring platform.

The full list becomes necessary when VMs hold customer data, when you have more than a handful of them, or when a SOC 2 or ISO 27001 auditor will ask how they are configured. At that point, build one hardened template, deploy every VM from it, and scan for drift. That is cheaper than hardening machines one at a time and easier to evidence.

Virtualization technology has made its way into almost every modern enterprise, and its benefits are also evident. The ever-evolving digital threats are not going to spare virtualization technology. Enterprises can only gain benefits from virtualization if they have a proper security plan to safeguard their virtual machines.

The effectiveness of tools or techniques relies on their users. An effective security plan addresses trending market threats, monitors threats in enterprise infrastructure, and patches vulnerabilities if any exist. With an effective VM security plan, an enterprise can secure both local and public VMs against malicious activity.

Talk to a Cybersecurity Trusted Advisor at IRM Consulting & Advisory