1 1 00:00:00,390 --> 00:00:01,950 Virtualization. 2 2 00:00:01,950 --> 00:00:03,870 In this lesson, we're going to talk a little bit 3 3 00:00:03,870 --> 00:00:05,430 about virtualization. 4 4 00:00:05,430 --> 00:00:07,920 Now, I'm not going to go and rehash everything you learned 5 5 00:00:07,920 --> 00:00:11,040 in A+ or Security+ about virtualization. 6 6 00:00:11,040 --> 00:00:12,870 I assume you already remember that, 7 7 00:00:12,870 --> 00:00:14,670 but I'm going to cover some of the highlights 8 8 00:00:14,670 --> 00:00:16,140 and then we're going to talk about two specific 9 9 00:00:16,140 --> 00:00:17,700 types of virtualization. 10 10 00:00:17,700 --> 00:00:19,530 First, what is virtualization? 11 11 00:00:19,530 --> 00:00:20,670 This is a review. 12 12 00:00:20,670 --> 00:00:23,070 Virtualization is a host computer that's installed 13 13 00:00:23,070 --> 00:00:25,260 with a hypervisor that can be used to install 14 14 00:00:25,260 --> 00:00:27,180 and manage multiple guest operating systems 15 15 00:00:27,180 --> 00:00:29,730 or virtual machines known as VMs. 16 16 00:00:29,730 --> 00:00:30,900 Now, what does this look like? 17 17 00:00:30,900 --> 00:00:32,220 Essentially, you have a piece 18 18 00:00:32,220 --> 00:00:34,290 of hardware that's called the bare bones 19 19 00:00:34,290 --> 00:00:37,080 and then you install some sort of virtualization on it. 20 20 00:00:37,080 --> 00:00:38,940 That would be called a hypervisor. 21 21 00:00:38,940 --> 00:00:41,460 Now that hypervisor can be either a bare bones hypervisor 22 22 00:00:41,460 --> 00:00:43,380 or it can be an operating system 23 23 00:00:43,380 --> 00:00:46,260 with a hypervisor running on top of the operating system. 24 24 00:00:46,260 --> 00:00:49,200 For instance, on my laptop, I have a MacBook. 25 25 00:00:49,200 --> 00:00:51,960 On that MacBook, I have the Mac operating system. 26 26 00:00:51,960 --> 00:00:54,630 And on that Mac operating system, I have a hypervisor 27 27 00:00:54,630 --> 00:00:57,810 known as VMware that I can actually run Windows inside 28 28 00:00:57,810 --> 00:00:59,430 of that as a virtual machine. 29 29 00:00:59,430 --> 00:01:01,440 Now, as part of that hypervisor virtualization, 30 30 00:01:01,440 --> 00:01:03,390 I can then install the guest operating system 31 31 00:01:03,390 --> 00:01:04,500 shown here in yellow, 32 32 00:01:04,500 --> 00:01:06,330 and then any applications I want. 33 33 00:01:06,330 --> 00:01:07,500 So on my particular system, 34 34 00:01:07,500 --> 00:01:09,300 even though I'm running a Mac system, 35 35 00:01:09,300 --> 00:01:11,340 I have one virtual machine 36 36 00:01:11,340 --> 00:01:13,290 with an operating system that's Windows 10 37 37 00:01:13,290 --> 00:01:15,780 and another one that's running a Ubuntu Linux. 38 38 00:01:15,780 --> 00:01:16,980 And that way I have access 39 39 00:01:16,980 --> 00:01:18,270 to all three operating systems 40 40 00:01:18,270 --> 00:01:19,770 for whichever programs I need 41 41 00:01:19,770 --> 00:01:22,710 or whatever demonstrations I'm trying to do for my students. 42 42 00:01:22,710 --> 00:01:25,320 Now when we talk about virtualization in this lesson, 43 43 00:01:25,320 --> 00:01:27,210 we're going to focus on two main areas. 44 44 00:01:27,210 --> 00:01:28,620 We're going to talk about VDI, 45 45 00:01:28,620 --> 00:01:30,600 which is virtual desktop infrastructure 46 46 00:01:30,600 --> 00:01:32,280 and we're going to talk about containerization 47 47 00:01:32,280 --> 00:01:35,100 and how both of these affect you as a security analyst. 48 48 00:01:35,100 --> 00:01:36,240 When we talk about VDI, 49 49 00:01:36,240 --> 00:01:38,580 this is a virtual desktop infrastructure. 50 50 00:01:38,580 --> 00:01:40,710 This is a virtualization implementation 51 51 00:01:40,710 --> 00:01:42,750 that separates the personal computing environment 52 52 00:01:42,750 --> 00:01:44,910 from a user's physical computer. 53 53 00:01:44,910 --> 00:01:48,030 So I have a Windows 10 machine that I can access 54 54 00:01:48,030 --> 00:01:50,040 and it's actually part of a VDI network. 55 55 00:01:50,040 --> 00:01:52,500 So when I want to use it, I will log into a piece 56 56 00:01:52,500 --> 00:01:55,410 of software on my Mac, it will reach out to the cloud 57 57 00:01:55,410 --> 00:01:57,420 and I will connect to that Windows 10 machine. 58 58 00:01:57,420 --> 00:01:59,520 And then I have control over that virtual image 59 59 00:01:59,520 --> 00:02:01,560 that's in the cloud being run. 60 60 00:02:01,560 --> 00:02:03,810 They have all the operating system, the applications, 61 61 00:02:03,810 --> 00:02:05,460 and everything I need, and every time I try 62 62 00:02:05,460 --> 00:02:08,490 to run a command, it processes it on that cloud server. 63 63 00:02:08,490 --> 00:02:10,830 It doesn't process it on my local machine. 64 64 00:02:10,830 --> 00:02:13,680 My local machine is just a dummy box to connect to it 65 65 00:02:13,680 --> 00:02:15,360 and that's the idea of VDI. 66 66 00:02:15,360 --> 00:02:17,160 So as you can see, you can have VDI 67 67 00:02:17,160 --> 00:02:18,300 on lots of different things. 68 68 00:02:18,300 --> 00:02:22,080 You can have it on a desktop, a laptop, a phone, a tablet. 69 69 00:02:22,080 --> 00:02:23,940 It doesn't really matter because the device 70 70 00:02:23,940 --> 00:02:25,890 is just there to connect to the server 71 71 00:02:25,890 --> 00:02:28,050 and then run that virtual image, 72 72 00:02:28,050 --> 00:02:29,010 which is being processed 73 73 00:02:29,010 --> 00:02:30,750 all that data on the server. 74 74 00:02:30,750 --> 00:02:32,130 Now again, as I've been saying, 75 75 00:02:32,130 --> 00:02:33,630 the server is going to perform all 76 76 00:02:33,630 --> 00:02:36,180 the application processing and the data storage 77 77 00:02:36,180 --> 00:02:39,330 so you can use a Chromebook, a MacBook, a Windows machine, 78 78 00:02:39,330 --> 00:02:41,400 it doesn't matter because whatever that VDI 79 79 00:02:41,400 --> 00:02:43,710 environment is, that's what you're actually connecting to 80 80 00:02:43,710 --> 00:02:45,120 and that's what's actually processing 81 81 00:02:45,120 --> 00:02:46,800 the application for you. 82 82 00:02:46,800 --> 00:02:49,230 Now, a lot of companies can completely offload 83 83 00:02:49,230 --> 00:02:52,470 their entire IT infrastructure by using third-party 84 84 00:02:52,470 --> 00:02:54,900 services by using this VDI concept. 85 85 00:02:54,900 --> 00:02:57,930 And so it's a really tempting thing for CIOs to do, 86 86 00:02:57,930 --> 00:02:59,160 because I don't have to run 87 87 00:02:59,160 --> 00:03:00,150 the operating systems anymore. 88 88 00:03:00,150 --> 00:03:01,800 I don't have to worry about patching them, 89 89 00:03:01,800 --> 00:03:04,260 because my third-party provider can do it all for me. 90 90 00:03:04,260 --> 00:03:05,340 That's one of the big benefits 91 91 00:03:05,340 --> 00:03:07,740 of VDI and one of the main selling features. 92 92 00:03:07,740 --> 00:03:09,960 Now, one of the bad things about it though, 93 93 00:03:09,960 --> 00:03:12,360 the big disadvantage of VDI is that users 94 94 00:03:12,360 --> 00:03:14,640 have no local processing ability. 95 95 00:03:14,640 --> 00:03:16,860 So if the server is down or the network is down 96 96 00:03:16,860 --> 00:03:19,740 or the connectivity is down, you can't do any work. 97 97 00:03:19,740 --> 00:03:21,810 And so if there's an outage on that server, 98 98 00:03:21,810 --> 00:03:23,070 everyone's down. 99 99 00:03:23,070 --> 00:03:24,930 Whereas right now, I'm sitting on my laptop 100 100 00:03:24,930 --> 00:03:26,190 and if my internet connection went out, 101 101 00:03:26,190 --> 00:03:27,780 I could still do work. 102 102 00:03:27,780 --> 00:03:30,390 But in VDI I couldn't because if my network connection 103 103 00:03:30,390 --> 00:03:32,310 is down, I can't reach the server. 104 104 00:03:32,310 --> 00:03:34,200 So these are the things you have to think about. 105 105 00:03:34,200 --> 00:03:35,610 Now, the next area we're going to talk 106 106 00:03:35,610 --> 00:03:38,250 about is containerization, and this is much more focused 107 107 00:03:38,250 --> 00:03:40,530 on servers instead of the end user. 108 108 00:03:40,530 --> 00:03:41,363 When we talk about VDI, 109 109 00:03:41,363 --> 00:03:43,230 it's really focused on your end users, right? 110 110 00:03:43,230 --> 00:03:44,880 When we talk about containerization 111 111 00:03:44,880 --> 00:03:46,950 this is a type of virtualization that's applied 112 112 00:03:46,950 --> 00:03:49,080 by a host operating system to provision 113 113 00:03:49,080 --> 00:03:52,050 an isolated execution environment for an application. 114 114 00:03:52,050 --> 00:03:53,190 And a lot of people use these 115 115 00:03:53,190 --> 00:03:55,260 because they're fairly secure. 116 116 00:03:55,260 --> 00:03:56,910 The nice thing about doing containers 117 117 00:03:56,910 --> 00:03:59,280 is that containers will enforce resource separation 118 118 00:03:59,280 --> 00:04:01,230 at the operating system level. 119 119 00:04:01,230 --> 00:04:02,220 So what this really looks like 120 120 00:04:02,220 --> 00:04:04,050 is you have a piece of hardware, 121 121 00:04:04,050 --> 00:04:05,160 and then on top of that hardware, 122 122 00:04:05,160 --> 00:04:06,630 you have some host OS, 123 123 00:04:06,630 --> 00:04:07,980 and then you have a container manager, 124 124 00:04:07,980 --> 00:04:09,900 something like Kubernetes or Docker 125 125 00:04:09,900 --> 00:04:11,220 or something like that. 126 126 00:04:11,220 --> 00:04:13,860 And then it has these different containers 127 127 00:04:13,860 --> 00:04:14,693 that can be created. 128 128 00:04:14,693 --> 00:04:16,350 In this case, I have three containers. 129 129 00:04:16,350 --> 00:04:17,400 I have the first environment, 130 130 00:04:17,400 --> 00:04:19,590 which is based on the kernel of the host OS. 131 131 00:04:19,590 --> 00:04:22,050 So this is a Linux system, and so in this case, 132 132 00:04:22,050 --> 00:04:23,520 container one is running Linux 133 133 00:04:23,520 --> 00:04:25,440 and it can run some applications there. 134 134 00:04:25,440 --> 00:04:26,940 Now, container two can do the same thing. 135 135 00:04:26,940 --> 00:04:28,800 Container three can do the same thing. 136 136 00:04:28,800 --> 00:04:31,230 Because we're all sharing the same host operating system, 137 137 00:04:31,230 --> 00:04:33,030 this takes a lot less resources 138 138 00:04:33,030 --> 00:04:36,300 than doing pure virtualization using virtual machines, 139 139 00:04:36,300 --> 00:04:37,740 because each virtual machine needs 140 140 00:04:37,740 --> 00:04:38,970 its own operating system, 141 141 00:04:38,970 --> 00:04:41,340 which could be eight or 10 gigabytes each. 142 142 00:04:41,340 --> 00:04:43,410 Here we're all sharing the same operating system 143 143 00:04:43,410 --> 00:04:45,540 so it uses a lot less storage 144 144 00:04:45,540 --> 00:04:47,520 and a lot less processing power. 145 145 00:04:47,520 --> 00:04:48,540 This is the real benefit 146 146 00:04:48,540 --> 00:04:50,580 of using something like a container. 147 147 00:04:50,580 --> 00:04:53,400 Now, because these containers are logically isolated, 148 148 00:04:53,400 --> 00:04:55,500 they can't actually interface with each other. 149 149 00:04:55,500 --> 00:04:57,510 If I wanted those two containers to talk, 150 150 00:04:57,510 --> 00:04:58,830 I actually would have to connect them 151 151 00:04:58,830 --> 00:05:01,230 through a virtual network and do the right routing 152 152 00:05:01,230 --> 00:05:02,910 and switching to allow them to talk. 153 153 00:05:02,910 --> 00:05:03,780 Because by default, 154 154 00:05:03,780 --> 00:05:05,520 they have no way of talking to each other. 155 155 00:05:05,520 --> 00:05:07,410 That's a great thing for security, 156 156 00:05:07,410 --> 00:05:08,670 but here's your big warning 157 157 00:05:08,670 --> 00:05:10,140 when you're dealing with containers. 158 158 00:05:10,140 --> 00:05:12,390 If an attacker compromises that host OS 159 159 00:05:12,390 --> 00:05:13,980 underneath that Linux operating system, 160 160 00:05:13,980 --> 00:05:15,810 for instance, guess what? 161 161 00:05:15,810 --> 00:05:16,740 That means they have access 162 162 00:05:16,740 --> 00:05:18,210 to all the containers as well. 163 163 00:05:18,210 --> 00:05:20,040 And so this is one of the big vulnerabilities. 164 164 00:05:20,040 --> 00:05:22,230 I can have a container system that's running 165 165 00:05:22,230 --> 00:05:23,520 50 different servers right now 166 166 00:05:23,520 --> 00:05:25,290 because I'm running all these different servers 167 167 00:05:25,290 --> 00:05:26,940 and services using containers, 168 168 00:05:26,940 --> 00:05:29,490 but if somebody gets that one server that's underneath, 169 169 00:05:29,490 --> 00:05:31,620 they now have access to all 50. 170 170 00:05:31,620 --> 00:05:33,000 This is the things you have to weigh 171 171 00:05:33,000 --> 00:05:35,070 when you start figuring out, am I going to virtualize? 172 172 00:05:35,070 --> 00:05:36,240 Am I going to use VDI? 173 173 00:05:36,240 --> 00:05:37,650 Am I going to use containers? 174 174 00:05:37,650 --> 00:05:39,330 What is the risk versus reward? 175 175 00:05:39,330 --> 00:05:40,890 There's a balancing act here. 176 176 00:05:40,890 --> 00:05:42,060 It's a business decision 177 177 00:05:42,060 --> 00:05:43,770 and it's a cybersecurity decision 178 178 00:05:43,770 --> 00:05:45,090 and so you have to measure these things 179 179 00:05:45,090 --> 00:05:47,140 to decide what is the best thing for you.