Separating Fact from Fiction - ESXi Hypervisor Security

Transcription

1 INF2336 Separating Fact from Fiction - ESXi Hypervisor Security Mike Foley, VMware, Inc Yuecel Karabulut, VMware, Inc

2 Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitment from VMware to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new technologies or features discussed or presented have not been determined. CONFIDENTIAL 2

3 We Would Like to Talk About Three Things Today 1 Virtualization Security: Fact vs. Fiction 2 Foundational Platform Security Solutions 3 Operational Security Where the REAL Threat Is 3

4 Trusted by These Security Teams and 500k+ More

5 Security Concerns Fact or Fiction

6 What Are You Most Concerned About? What most vsphere Admins say We are concerned about internal threats Example: Malicious privileged VI admin behavior in branch offices 6

7 What Are You Most Concerned About? Some customers (mostly Security Professionals) say We are concerned about VM escape scenarios Example: Guest-to-host-attack by exploiting a potential vulnerability in the VM process 7

8 What is the More Likely Scenario? VM Escape or Operational Security Threats 8

9 What is the More Likely Scenario? Probability Cost Cost.vs. Probability a.k.a. Sexy.vs. Boring 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% VM Escape Operational Security Threats 9

10 Fact vs. Fiction VM Escape Fiction VM Escape is considered a Primary threat by some security professionals Fact There is a lot of theoretical intent to prove it! Known/past attempts took advantage of since patched vulnerabilities In many cases were done NOT on VMware or with Type 2 hypervisors It s very hard to do! If it was easy you d be reading about it on social media! 10

11 Why is VM Escape Really Hard to Do? Proven VM Isolation and Evolving Architecture Secure Software + + Minimum Attack + Development Surface Lifecycle World Class Systems Security Engineers

12 Just the facts!

13 Layers of Isolation and Protection Isolation is the Name of the Game Instruction Isolation Memory Isolation Device Isolation Network Isolation Noisy Neighbor Isolation Storage Isolation Memory Protection

14 Instruction Isolation Virtual CPU Virtual machines don t have access to Physical Ring 0 Ring 3 User Apps Virtualized Privilege Levels Ring 2 Ring 1 Hardware Privilege Level Ring 0 Physical Ring 0 Guest OS VMM OS Requests Trap to VMM without Binary Translation or Paravirtualization Hypervisor Physical Host

15 Memory Isolation VM to VM and VM to Host Hypervisor managed guest memory page tables Isolated via CPU virtualization extensions (HWMMU) Guest OS managed memory page tables Hypervisor managed Memory Page Tables Host Memory Page Table Hypervisor HWMMU Guest OS managed memory pages tables Hypervisor managed Memory Page Tables Host and Virtual Machine Page Tables are completely inaccessible to each other Physical Host

16 Device Isolation: Guests Only See What They Are Allocated VM Kernel and VM Monitor mediate access to the physical resources, and all physical hardware access takes place through the VM Kernel. Guest OS Guest Device Driver Virtual Device Guest Device Driver I/O Stack Guest OS Guest Device Driver Virtual Device Guest Device Driver Physical Device Driver Hypervisor Guest OS Guest Device Driver Direct Path I/O Physical Host

17 Network Isolation at the vswitch level vswitches are not routers! VM 1 Guest Device Driver VM 2 Guest Device Driver VM 3 Guest Device Driver To route packets between vswitches you need something else. Virtual Device Virtual Device Virtual Device Virtual Device Example: Can a VM on vswitch 1 see a VM on vswitch 2? Virtual Switch 1 Virtual Switch 2 Virtual Switch 3 Hypervisor Physical Host

18 VLAN s and vswitches No Hopping Allowed MAC Flooding? 802.1q and ISL tagging? Double-encapsulation Attacks? Multicast brute-force Attacks? Spanning Tree Attacks? Random Frame Attacks? VLAN Hopping? Not vulnerable Not vulnerable Not vulnerable Not vulnerable Not vulnerable Not vulnerable Native VLAN is not used 18

19 Operational Security Where the REAL Threat Is

20 Fact vs. Fiction Operational Security Fiction Operational Security is considered a Secondary threat by security professionals Fact Threat/Risk Management is not well understood Least Privilege is NOT widely adopted Common ROOT passwords All admins have vcenter privileges Actions are not tied to policy Patching ESXi is not a priority Compromise the Admin, get access to the infrastructure 20

21 Least Privilege RBAC Security Policy Enforcement

22 Least Privilege Workflow-based Security Policy Enforcement Leverage VMware Orchestrator to limit privilege exposure Consider VMware vcac for workflow approvals Example: Remove Delete VM from Admin Role Replace with vco action Use vcac for approval workflow

23 Least Privilege Workflow-based Security Policy Enforcement Leverage VMware Orchestrator to limit privilege exposure Consider VMware vcac for workflow approvals Example: Remove Delete VM from Admin Role Replace with vco action Use vcac for approval workflow

24 I Can t Help You if you Don t Patch! 24

25 You protect your physical datacenter with this guy

26 and this is how you protect your virtual datacenter?

27 Isolate Your Management Interfaces Limit access to vcenter and ESXi with a dedicated Management Network

28 Takeaways VM Escape VMware works hard to mitigate any and all potential threats in this area Real Threat Vectors Continuous Threat Analysis Operational Security Adopt Least Privilege RBAC and Workflow-based Security Policy Enforcement Patch your systems! Isolate your Management Interfaces Network Embrace Virtualized Networking and Micro-Segmentation (Go to the NSX sessions for more info!) 28

29 Questions?

30 Online Resources ESXi Security Whitepaper and vsphere Hardening Guide Whitepaper Hardening Guide 30

31 VMware vsphere Beta Help shape the future of vsphere Gain visibility into features and technology that may be in upcoming versions of vsphere No nominations required. Open to everyone! 31

32 Thank You

33 Fill out a survey Every completed survey is entered into a drawing for a $25 VMware company store gift certificate

34 INF2336 Separating Fact from Fiction - ESXi Hypervisor Security Mike Foley, VMware, Inc Yuecel Karabulut, VMware, Inc