Getting started with virtualization security can be a little daunting. I’m not going to go into a great level of detail, but I do want to point out some sources of information to get you started down the path to securing your virtual datacenters (you did plan the security of the infrastructure before you virtualized, right?). This entire blog entry will be a list of places to find guidance in terms of virtualization security and compliance. It is by no means exhaustive; I’ll leave the rest of the resources out there as an exercise for the reader.
The first place to look for security guidance is always the vendors:
Microsoft released Hyper-V as a free hypervisor that runs on top of windows with Windows Server 2008. Here are a couple resources you can use: http://technet.microsoft.com/en-us/library/dd569113.aspx - Hyper-V Security Guide http://www.microsoft.com/en-us/download/details.aspx?id=16650 – Hyper-V Security Guide download
VMware is the best known, longest running hypervisor out there. Their products have gone through a lot of changes over the years, so it’s pretty important to track the version of VMware/vSphere you’re using closely. Listed below are the hardening guides for each version:
VMware 3 (Seriously? You should update!):
vSphere 5 (brand new):
Xen is a very popular open source hypervisor. I couldn’t find any specific hardening documents for Xen, but I believe the standard Linux hardening guides will go a long way. Here is a portal for their documentation: http://xen.org/support/documentation.html
Vendors are great and all, but I think objective third parties provide the most insight into the problem, as they’re not trying to sell you on how great their software is or ram virtual security appliances down your throat.
Defense Information Systems Agency (DISA) STIG:
Cloud Security Alliance:
CIS Security Benchmarks:
Aren’t regulations fun? While not exactly a security data point, regulation guidance is useful at times.