1 1 00:00:00,360 --> 00:00:02,940 Virtualized Infrastructure. 2 2 00:00:02,940 --> 00:00:03,840 In the last lesson, 3 3 00:00:03,840 --> 00:00:05,670 we started talking about virtualization, 4 4 00:00:05,670 --> 00:00:07,860 and in this lesson, I want to dig a little bit deeper 5 5 00:00:07,860 --> 00:00:09,840 and talk about three main areas. 6 6 00:00:09,840 --> 00:00:12,540 We're going to talk about virtual hosts, virtual networks, 7 7 00:00:12,540 --> 00:00:14,310 and management interfaces. 8 8 00:00:14,310 --> 00:00:15,810 Now, when I talk about virtual hosts, 9 9 00:00:15,810 --> 00:00:17,280 this is a virtualized computer 10 10 00:00:17,280 --> 00:00:19,230 that allows the installation and configuration 11 11 00:00:19,230 --> 00:00:21,120 of its own operating system. 12 12 00:00:21,120 --> 00:00:23,250 I mentioned that I have a MacBook Pro here, 13 13 00:00:23,250 --> 00:00:26,580 and I have Windows running inside a virtualized environment. 14 14 00:00:26,580 --> 00:00:28,380 So when I use something like VMware, 15 15 00:00:28,380 --> 00:00:30,720 it gives me all the virtual hardware I need. 16 16 00:00:30,720 --> 00:00:32,880 So a virtual host, like a physical host, 17 17 00:00:32,880 --> 00:00:34,590 has to be patched and hardened. 18 18 00:00:34,590 --> 00:00:36,720 Because when I install Windows 10 in there, 19 19 00:00:36,720 --> 00:00:38,610 it now is vulnerable to all of the things 20 20 00:00:38,610 --> 00:00:40,020 that Windows 10 is vulnerable to. 21 21 00:00:40,020 --> 00:00:42,090 So I have to make sure I keep up to date with my patches, 22 22 00:00:42,090 --> 00:00:42,923 I need to make sure I have the right 23 23 00:00:42,923 --> 00:00:44,340 configurations and hardening, 24 24 00:00:44,340 --> 00:00:46,050 and then I can create a good image of that, 25 25 00:00:46,050 --> 00:00:47,790 and that becomes my image moving forward 26 26 00:00:47,790 --> 00:00:49,560 for all of my virtual hosts. 27 27 00:00:49,560 --> 00:00:50,760 Now, the great thing about this is 28 28 00:00:50,760 --> 00:00:53,010 it makes it really easy to deploy new hosts. 29 29 00:00:53,010 --> 00:00:56,280 The bad thing about that is that can lead to VM Sprawl. 30 30 00:00:56,280 --> 00:00:57,720 Now, what is VM Sprawl? 31 31 00:00:57,720 --> 00:00:59,940 Well, this is an expansion of VMs being provisioned 32 32 00:00:59,940 --> 00:01:02,400 without proper change control procedures. 33 33 00:01:02,400 --> 00:01:04,140 Again, because it's really easy 34 34 00:01:04,140 --> 00:01:06,630 and quick to remove and replace a virtual machine, 35 35 00:01:06,630 --> 00:01:08,970 a lot of times, people will replace virtual machines, 36 36 00:01:08,970 --> 00:01:11,070 but they'll never turn off the old ones. 37 37 00:01:11,070 --> 00:01:13,200 And so you might have 50 that are approved, 38 38 00:01:13,200 --> 00:01:14,400 and now you look up another day, 39 39 00:01:14,400 --> 00:01:16,560 and you've got 60 or 70 or 80. 40 40 00:01:16,560 --> 00:01:17,700 I've seen some networks 41 41 00:01:17,700 --> 00:01:19,200 where there are hundreds and thousands 42 42 00:01:19,200 --> 00:01:21,390 of these virtual machines all over the place 43 43 00:01:21,390 --> 00:01:23,580 and nobody really realizes they're there. 44 44 00:01:23,580 --> 00:01:26,160 Now, all of those, are now expanding your attack surface 45 45 00:01:26,160 --> 00:01:27,390 because those are all machines 46 46 00:01:27,390 --> 00:01:28,440 that have an operating system 47 47 00:01:28,440 --> 00:01:30,690 that maybe communicate with the outside world. 48 48 00:01:30,690 --> 00:01:32,490 So you need to keep track of all this stuff 49 49 00:01:32,490 --> 00:01:35,460 because it is something that's a big vulnerability for you. 50 50 00:01:35,460 --> 00:01:37,710 Now, when you start dealing with security fixes, 51 51 00:01:37,710 --> 00:01:38,730 one of the things you have to realize 52 52 00:01:38,730 --> 00:01:41,580 is there's actually two places you have to focus on. 53 53 00:01:41,580 --> 00:01:42,780 There's the operating system 54 54 00:01:42,780 --> 00:01:44,370 and the applications at the top layer 55 55 00:01:44,370 --> 00:01:47,130 within the virtual machines and within those virtual hosts, 56 56 00:01:47,130 --> 00:01:48,810 those all have to be passion hardened, 57 57 00:01:48,810 --> 00:01:51,600 but so does the physical hardware and firmware 58 58 00:01:51,600 --> 00:01:54,390 and the hypervisor that's running all of this stuff. 59 59 00:01:54,390 --> 00:01:57,360 So if you're using something like VMware's ESXi, 60 60 00:01:57,360 --> 00:01:58,440 there are versions of that, 61 61 00:01:58,440 --> 00:01:59,880 that is essentially software, 62 62 00:01:59,880 --> 00:02:01,950 and so you need to make sure you're running a good version 63 63 00:02:01,950 --> 00:02:03,810 that is secure and hardened. 64 64 00:02:03,810 --> 00:02:05,490 These are all the different things you have to think about 65 65 00:02:05,490 --> 00:02:06,900 when you're dealing with virtualization. 66 66 00:02:06,900 --> 00:02:08,370 It's a lot more complex 67 67 00:02:08,370 --> 00:02:10,620 than just having one physical machine. 68 68 00:02:10,620 --> 00:02:11,453 Because after all, 69 69 00:02:11,453 --> 00:02:13,110 I can have an ESXi server 70 70 00:02:13,110 --> 00:02:15,000 and it's a small little box server 71 71 00:02:15,000 --> 00:02:16,710 that's maybe a 1U unit. 72 72 00:02:16,710 --> 00:02:18,030 That 1U unit might have 73 73 00:02:18,030 --> 00:02:20,730 8, or 10, or 12 different servers running on it. 74 74 00:02:20,730 --> 00:02:21,690 And because of that, 75 75 00:02:21,690 --> 00:02:24,000 those are all different hosts that are virtualized 76 76 00:02:24,000 --> 00:02:25,920 inside the one physical server, 77 77 00:02:25,920 --> 00:02:28,740 that's 10 or 12, or 15 different things that I have to patch 78 78 00:02:28,740 --> 00:02:30,510 in addition to the physical server. 79 79 00:02:30,510 --> 00:02:31,710 So you have to keep track of that 80 80 00:02:31,710 --> 00:02:33,390 as you're going through and doing your patch management 81 81 00:02:33,390 --> 00:02:34,230 and make sure that when you're doing 82 82 00:02:34,230 --> 00:02:35,520 your vulnerability scans, 83 83 00:02:35,520 --> 00:02:38,400 you're keeping that stuff into the scope as well. 84 84 00:02:38,400 --> 00:02:40,650 Now, the next thing we want to talk about is virtual networks 85 85 00:02:40,650 --> 00:02:41,910 because if you have hosts, 86 86 00:02:41,910 --> 00:02:43,530 you need to connect them some way. 87 87 00:02:43,530 --> 00:02:46,110 Well, a virtual network takes those virtual hosts 88 88 00:02:46,110 --> 00:02:49,080 and interconnects them using virtual switches, routers, 89 89 00:02:49,080 --> 00:02:50,790 and other virtualized networking equipment 90 90 00:02:50,790 --> 00:02:52,590 as part of your hypervisor. 91 91 00:02:52,590 --> 00:02:55,320 Now again, these virtual networks are created with code, 92 92 00:02:55,320 --> 00:02:56,580 it's just software, 93 93 00:02:56,580 --> 00:02:58,170 and so there can be bugs in the code, 94 94 00:02:58,170 --> 00:02:59,910 there can be security holes in the code, 95 95 00:02:59,910 --> 00:03:02,220 and that's things you have to think about as well. 96 96 00:03:02,220 --> 00:03:04,077 Now, when you start taking your virtual hosts 97 97 00:03:04,077 --> 00:03:05,580 and you put 'em on different systems 98 98 00:03:05,580 --> 00:03:07,050 and you want to start connecting them, 99 99 00:03:07,050 --> 00:03:08,100 you need to be careful here 100 100 00:03:08,100 --> 00:03:08,933 and you need to figure out 101 101 00:03:08,933 --> 00:03:10,650 how you're going to map these virtual hosts 102 102 00:03:10,650 --> 00:03:11,970 to the physical hardware 103 103 00:03:11,970 --> 00:03:14,040 because you want to make sure you don't expose data 104 104 00:03:14,040 --> 00:03:15,210 or system access 105 105 00:03:15,210 --> 00:03:17,730 to different risks that could be associated with it. 106 106 00:03:17,730 --> 00:03:19,680 Now, what am I really saying here? 107 107 00:03:19,680 --> 00:03:21,210 Let's say I have this one server 108 108 00:03:21,210 --> 00:03:23,580 that's going to run all my virtualization for me. 109 109 00:03:23,580 --> 00:03:24,870 Now, do I want to put on 110 110 00:03:24,870 --> 00:03:26,610 my internal network virtualized servers in there, 111 111 00:03:26,610 --> 00:03:27,720 like my active directory 112 112 00:03:27,720 --> 00:03:29,970 and my external network, or DMZ stuff 113 113 00:03:29,970 --> 00:03:31,980 like web servers and email? 114 114 00:03:31,980 --> 00:03:33,060 No, I want to keep those 115 115 00:03:33,060 --> 00:03:35,160 on two physically different servers. 116 116 00:03:35,160 --> 00:03:37,230 So I might have two servers that I'm going to have, 117 117 00:03:37,230 --> 00:03:39,870 one for my internal network, and one for my DMZ, 118 118 00:03:39,870 --> 00:03:41,820 and then I can have virtualized servers 119 119 00:03:41,820 --> 00:03:44,040 inside of those servers in those zones. 120 120 00:03:44,040 --> 00:03:46,290 So if you have them all in the same computer, 121 121 00:03:46,290 --> 00:03:48,690 there is a risk that there could be cross-contamination. 122 122 00:03:48,690 --> 00:03:49,950 There's not supposed to be, 123 123 00:03:49,950 --> 00:03:52,020 but again, bad things happen. 124 124 00:03:52,020 --> 00:03:53,430 There's things like VM escapes 125 125 00:03:53,430 --> 00:03:54,750 and there's things like hackers 126 126 00:03:54,750 --> 00:03:56,100 who can get into the hypervisor, 127 127 00:03:56,100 --> 00:03:57,990 and go from one machine to another. 128 128 00:03:57,990 --> 00:03:59,190 And if they can do that, 129 129 00:03:59,190 --> 00:04:01,890 that's going to put your data and systems at risk. 130 130 00:04:01,890 --> 00:04:03,570 Now, one word of warning I have here 131 131 00:04:03,570 --> 00:04:05,190 in terms of virtual networking 132 132 00:04:05,190 --> 00:04:06,960 when you're thinking about your virtual switches 133 133 00:04:06,960 --> 00:04:08,490 that are part of your hypervisor, 134 134 00:04:08,490 --> 00:04:10,980 these don't always behave like physical switches. 135 135 00:04:10,980 --> 00:04:12,450 They often will fail, 136 136 00:04:12,450 --> 00:04:14,850 and they might not be able to isolate the traffic adequately 137 137 00:04:14,850 --> 00:04:16,560 between your different virtual hosts 138 138 00:04:16,560 --> 00:04:18,420 that are sitting on that hypervisor. 139 139 00:04:18,420 --> 00:04:20,160 So if you're worried about that, 140 140 00:04:20,160 --> 00:04:21,660 which a lot of companies are, 141 141 00:04:21,660 --> 00:04:23,730 you can actually take that information 142 142 00:04:23,730 --> 00:04:26,190 and switch it out to physical hardware, 143 143 00:04:26,190 --> 00:04:28,110 by connecting each virtual machine 144 144 00:04:28,110 --> 00:04:30,210 to a dedicated network interface card. 145 145 00:04:30,210 --> 00:04:31,890 Now, if you don't have enough network interface cards, 146 146 00:04:31,890 --> 00:04:33,210 and that's when you're going to have to start relying 147 147 00:04:33,210 --> 00:04:34,770 on some of those virtual networking, 148 148 00:04:34,770 --> 00:04:36,000 and you're going to have to do your due diligence 149 149 00:04:36,000 --> 00:04:37,050 to figure out which company 150 150 00:04:37,050 --> 00:04:39,750 and which software is the best for that. 151 151 00:04:39,750 --> 00:04:41,340 Now, the last thing we want to talk about here 152 152 00:04:41,340 --> 00:04:42,900 is the management interface. 153 153 00:04:42,900 --> 00:04:44,160 Now, the management interface 154 154 00:04:44,160 --> 00:04:45,990 is the management application that's located, 155 155 00:04:45,990 --> 00:04:48,930 either on the physical host that runs the virtual machine 156 156 00:04:48,930 --> 00:04:50,550 or on a centralized platform 157 157 00:04:50,550 --> 00:04:52,200 that can oversee that virtual machine 158 158 00:04:52,200 --> 00:04:54,450 and many others across your network. 159 159 00:04:54,450 --> 00:04:56,490 Now, this is a great way of doing things, 160 160 00:04:56,490 --> 00:04:58,140 and it can make your life really easy 161 161 00:04:58,140 --> 00:04:59,100 as a system administrator 162 162 00:04:59,100 --> 00:05:01,530 because you have one platform in a centralized location 163 163 00:05:01,530 --> 00:05:03,837 that accesses all of your virtual machines. 164 164 00:05:03,837 --> 00:05:05,820 And that's great, but again, 165 165 00:05:05,820 --> 00:05:07,770 that's a risk and you need to make sure you're protecting it 166 166 00:05:07,770 --> 00:05:10,290 because if somebody gets access to that one area, 167 167 00:05:10,290 --> 00:05:12,570 they now have access to all of your virtual machines. 168 168 00:05:12,570 --> 00:05:14,550 So you need to keep that in mind as well. 169 169 00:05:14,550 --> 00:05:15,690 One of the ways you can do this 170 170 00:05:15,690 --> 00:05:18,120 is you can utilize a separation of duties. 171 171 00:05:18,120 --> 00:05:20,010 You can do this by having different administrators 172 172 00:05:20,010 --> 00:05:23,190 for the hypervisor who manages the management interface, 173 173 00:05:23,190 --> 00:05:25,380 and one for the different servers and hosts 174 174 00:05:25,380 --> 00:05:27,330 that are being run as virtual machines. 175 175 00:05:27,330 --> 00:05:30,000 So you can have two teams, the virtualization team, 176 176 00:05:30,000 --> 00:05:31,860 and the system administration team. 177 177 00:05:31,860 --> 00:05:34,620 The virtualization team is responsible for the servers, 178 178 00:05:34,620 --> 00:05:37,140 and the hypervisor, and patching those things. 179 179 00:05:37,140 --> 00:05:38,520 The server team, on the other hand, 180 180 00:05:38,520 --> 00:05:39,390 the system administrators 181 181 00:05:39,390 --> 00:05:41,700 are going to be responsible for all of the virtualized servers 182 182 00:05:41,700 --> 00:05:44,070 that are being run on top of those hypervisors. 183 183 00:05:44,070 --> 00:05:45,930 And so that's a good way of separating out the duties 184 184 00:05:45,930 --> 00:05:47,610 and be able to make sure that one person 185 185 00:05:47,610 --> 00:05:50,190 doesn't have too much control over everything. 186 186 00:05:50,190 --> 00:05:51,510 Finally, you want to make sure 187 187 00:05:51,510 --> 00:05:53,460 you're monitoring the host platform itself, 188 188 00:05:53,460 --> 00:05:54,293 and you want to make sure 189 189 00:05:54,293 --> 00:05:56,760 it's not suffering from resource exhaustion, 190 190 00:05:56,760 --> 00:05:57,780 'cause it's really easy for us 191 191 00:05:57,780 --> 00:05:59,520 to spin up a new virtual machine. 192 192 00:05:59,520 --> 00:06:01,440 But if we spin up too many virtual machines, 193 193 00:06:01,440 --> 00:06:03,540 all of those virtual machines take processor, 194 194 00:06:03,540 --> 00:06:05,550 they take storage, they take memory, 195 195 00:06:05,550 --> 00:06:07,530 and the physical server that's hosting them 196 196 00:06:07,530 --> 00:06:09,510 is going to eventually run out of all of that. 197 197 00:06:09,510 --> 00:06:12,900 So if I have a big server that has say 64 gigabytes of RAM, 198 198 00:06:12,900 --> 00:06:15,450 and I give each of my servers four gigabytes of RAM, 199 199 00:06:15,450 --> 00:06:17,370 how many servers can I put on there? 200 200 00:06:17,370 --> 00:06:18,990 I can only put on 16 servers, right? 201 201 00:06:18,990 --> 00:06:20,910 Because I would run out of memory otherwise. 202 202 00:06:20,910 --> 00:06:22,350 So if I put on 20 servers, 203 203 00:06:22,350 --> 00:06:25,680 I now have too many servers for the amount of RAM I have. 204 204 00:06:25,680 --> 00:06:27,450 And so this is one of those things you have to monitor 205 205 00:06:27,450 --> 00:06:29,190 and keep track of because otherwise, 206 206 00:06:29,190 --> 00:06:31,690 you could inadvertently cause a denial of service.