UPDATED 07:00 EDT / OCTOBER 23 2014

The National Institute of Standards and Technology NEWS

NIST drafts hypervisor security recommendations

The National Institute of Standards and Technology

The National Institute of Standards and Technology

The National Institute of Standards and Technology (NIST) has released a draft publication laying out the basics of hypervisor security. SP800-125a was published earlier this week, and is now open for public comment.

The guide, written by NIST director and George Mason University professor Ramaswamy Chandramouli, is geared towards enterprise security and IT management, as well as data center managers and admins tasked with securing business data as it moves off premise to cloud environments. Altogether, 22 security recommendations are covered in the draft, relating to hypervisor deployment and virtualization components.

Several of the main threat types are already well known and understood, seen in many kinds of server software. Network-based attacks for example, should be on the radar of every sysadmin, while other common risks include web-based management interfaces.

Less common threats include virtual machine escapes can result from a hypervisor configuration error, resulting in rogue virtual machine accessing host resources like memory and storage. In this situation, an attacker could use a rootkit to attack a second virtual machine on the same host or even take control of the hypervisor itself.

VLAN hopping is another threat specific to hosted environments, wherein a rogue virtual machine can break out from its isolation and spy on virtual traffic intended for other VMs on the same segment. Other examples include attacks on the hypervisor itself, such as resource starvation leading to denial of service attacks.

The network is also vulnerable. NIST says that rogue VMs could spoof an IP or MAC address then jump across the VLANs that are supposed to keep traffic from different segments isolated, or else attemp to intercept traffic.

“From the list of security recommendations in this document, it should be clear that many of the security recommendations have been necessitated by the unique functions that the hypervisor performs as well as the supporting features of the underlying hardware platform,” the draft said.

The draft is open for comment until November 10.

photo credit: Pensiero via photopin cc

A message from John Furrier, co-founder of SiliconANGLE:

Your vote of support is important to us and it helps us keep the content FREE.

One click below supports our mission to provide free, deep, and relevant content.  

Join our community on YouTube

Join the community that includes more than 15,000 #CubeAlumni experts, including Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and experts.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy

THANK YOU