The National Institute of Standards and Technology

The National Institute of Standards and Technology (NIST) has released a draft publication laying out the basics of hypervisor security. SP800-125a was published earlier this week, and is now open for public comment.

The guide, written by NIST director and George Mason University professor Ramaswamy Chandramouli, is geared towards enterprise security and IT management, as well as data center managers and admins tasked with securing business data as it moves off premise to cloud environments. Altogether, 22 security recommendations are covered in the draft, relating to hypervisor deployment and virtualization components.

Several of the main threat types are already well known and understood, seen in many kinds of server software. Network-based attacks for example, should be on the radar of every sysadmin, while other common risks include web-based management interfaces.

Less common threats include virtual machine escapes can result from a hypervisor configuration error, resulting in rogue virtual machine accessing host resources like memory and storage. In this situation, an attacker could use a rootkit to attack a second virtual machine on the same host or even take control of the hypervisor itself.

VLAN hopping is another threat specific to hosted environments, wherein a rogue virtual machine can break out from its isolation and spy on virtual traffic intended for other VMs on the same segment. Other examples include attacks on the hypervisor itself, such as resource starvation leading to denial of service attacks.

The network is also vulnerable. NIST says that rogue VMs could spoof an IP or MAC address then jump across the VLANs that are supposed to keep traffic from different segments isolated, or else attemp to intercept traffic.

“From the list of security recommendations in this document, it should be clear that many of the security recommendations have been necessitated by the unique functions that the hypervisor performs as well as the supporting features of the underlying hardware platform,” the draft said.

The draft is open for comment until November 10.

photo credit: Pensiero via photopin cc