Tutor: Virtualized Infrastructure. 2 2
In the last lesson, 3 3
we started talking about virtualization, 4 4
and in this lesson, I want to dig a little bit deeper 5 5
and talk about three main areas. 6 6
We're going to talk about virtual hosts, virtual networks, 7 7
and management interfaces. 8 8
Now, when I talk about virtual hosts, 9 9
this is a virtualized computer 10 10
that allows the installation and configuration 11 11
of its own operating system. 12 12
I mentioned that I have a MacBook Pro here, 13 13
and I have Windows running inside a virtualized environment. 14 14
So when I use something like VMware, 15 15
it gives me all the virtual hardware I need. 16 16
So a virtual host, like a physical host, 17 17
has to be patched and hardened. 18 18
Because when I install Windows 10 in there, 19 19
it now is vulnerable to all of the things 20 20
that Windows 10 is vulnerable to. 21 21
So I have to make sure I keep up to date with my patches, 22 22
I need to make sure I have the right 23 23
configurations and hardening, 24 24
and then I can create a good image of that, 25 25
and that becomes my image moving forward 26 26
for all of my virtual hosts. 27 27
Now, the great thing about this is 28 28
it makes it really easy to deploy new hosts. 29 29
The bad thing about that is that can lead to VM Sprawl. 30 30
Now, what is VM Sprawl? 31 31
Well, this is an expansion of VMs being provisioned 32 32
without proper change control procedures. 33 33
Again, because it's really easy 34 34
and quick to remove and replace a virtual machine, 35 35
a lot of times, people will replace virtual machines, 36 36
but they'll never turn off the old ones. 37 37
And so you might have 50 that are approved, 38 38
and now you look up another day, 39 39
and you've got 60 or 70 or 80. 40 40
I've seen some networks 41 41
where there are hundreds and thousands 42 42
of these virtual machines all over the place 43 43
and nobody really realizes they're there. 44 44
Now, all of those, are now expanding your attack surface 45 45
because those are all machines 46 46
that have an operating system 47 47
that maybe communicate with the outside world. 48 48
So you need to keep track of all this stuff 49 49
because it is something that's a big vulnerability for you. 50 50
Now, when you start dealing with security fixes, 51 51
one of the things you have to realize 52 52
is there's actually two places you have to focus on. 53 53
There's the operating system 54 54
and the applications at the top layer 55 55
within the virtual machines and within those virtual hosts, 56 56
those all have to be passion hardened, 57 57
but so does the physical hardware and firmware 58 58
and the hypervisor that's running all of this stuff. 59 59
So if you're using something like VMware's ESXi, 60 60
there are versions of that, 61 61
that is essentially software, 62 62
and so you need to make sure you're running a good version 63 63
that is secure and hardened. 64 64
These are all the different things you have to think about 65 65
when you're dealing with virtualization. 66 66
It's a lot more complex 67 67
than just having one physical machine. 68 68
Because after all, 69 69
I can have an ESXi server 70 70
and it's a small little box server 71 71
that's maybe a 1U unit. 72 72
That 1U unit might have 73 73
8, or 10, or 12 different servers running on it. 74 74
And because of that, 75 75
those are all different hosts that are virtualized 76 76
inside the one physical server, 77 77
that's 10 or 12, or 15 different things that I have to patch 78 78
in addition to the physical server. 79 79
So you have to keep track of that 80 80
as you're going through and doing your patch management 81 81
and make sure that when you're doing 82 82
your vulnerability scans, 83 83
you're keeping that stuff into the scope as well. 84 84
Now, the next thing we want to talk about is virtual networks 85 85
because if you have hosts, 86 86
you need to connect them some way. 87 87
Well, a virtual network takes those virtual hosts 88 88
and interconnects them using virtual switches, routers, 89 89
and other virtualized networking equipment 90 90
as part of your hypervisor. 91 91
Now again, these virtual networks are created with code, 92 92
it's just software, 93 93
and so there can be bugs in the code, 94 94
there can be security holes in the code, 95 95
and that's things you have to think about as well. 96 96
Now, when you start taking your virtual hosts 97 97
and you put 'em on different systems 98 98
and you want to start connecting them, 99 99
you need to be careful here 100 100
and you need to figure out 101 101
how you're going to map these virtual hosts 102 102
to the physical hardware 103 103
because you want to make sure you don't expose data 104 104
or system access 105 105
to different risks that could be associated with it. 106 106
Now, what am I really saying here? 107 107
Let's say I have this one server 108 108
that's going to run all my virtualization for me. 109 109
Now, do I want to put on 110 110
my internal network virtualized servers in there, 111 111
like my active directory 112 112
and my external network, or DMZ stuff 113 113
like web servers and email? 114 114
No, I want to keep those 115 115
on two physically different servers. 116 116
So I might have two servers that I'm going to have, 117 117
one for my internal network, and one for my DMZ, 118 118
and then I can have virtualized servers 119 119
inside of those servers in those zones. 120 120
So if you have them all in the same computer, 121 121
there is a risk that there could be cross-contamination. 122 122
There's not supposed to be, 123 123
but again, bad things happen. 124 124
There's things like VM escapes 125 125
and there's things like hackers 126 126
who can get into the hypervisor, 127 127
and go from one machine to another. 128 128
And if they can do that, 129 129
that's going to put your data and systems at risk. 130 130
Now, one word of warning I have here 131 131
in terms of virtual networking 132 132
when you're thinking about your virtual switches 133 133
that are part of your hypervisor, 134 134
these don't always behave like physical switches. 135 135
They often will fail, 136 136
and they might not be able to isolate the traffic adequately 137 137
between your different virtual hosts 138 138
that are sitting on that hypervisor. 139 139
So if you're worried about that, 140 140
which a lot of companies are, 141 141
you can actually take that information 142 142
and switch it out to physical hardware, 143 143
by connecting each virtual machine 144 144
to a dedicated network interface card. 145 145
Now, if you don't have enough network interface cards, 146 146
and that's when you're going to have to start relying 147 147
on some of those virtual networking, 148 148
and you're going to have to do your due diligence 149 149
to figure out which company 150 150
and which software is the best for that. 151 151
Now, the last thing we want to talk about here 152 152
is the management interface. 153 153
Now, the management interface 154 154
is the management application that's located, 155 155
either on the physical host that runs the virtual machine 156 156
or on a centralized platform 157 157
that can oversee that virtual machine 158 158
and many others across your network. 159 159
Now, this is a great way of doing things, 160 160
and it can make your life really easy 161 161
as a system administrator 162 162
because you have one platform in a centralized location 163 163
that accesses all of your virtual machines. 164 164
And that's great, but again, 165 165
that's a risk and you need to make sure you're protecting it 166 166
because if somebody gets access to that one area, 167 167
they now have access to all of your virtual machines. 168 168
So you need to keep that in mind as well. 169 169
One of the ways you can do this 170 170
is you can utilize a separation of duties. 171 171
You can do this by having different administrators 172 172
for the hypervisor who manages the management interface, 173 173
and one for the different servers and hosts 174 174
that are being run as virtual machines. 175 175
So you can have two teams, the virtualization team, 176 176
and the system administration team. 177 177
The virtualization team is responsible for the servers, 178 178
and the hypervisor, and patching those things. 179 179
The server team, on the other hand, 180 180
the system administrators 181 181
are going to be responsible for all of the virtualized servers 182 182
that are being run on top of those hypervisors. 183 183
And so that's a good way of separating out the duties 184 184
and be able to make sure that one person 185 185
doesn't have too much control over everything. 186 186
Finally, you want to make sure 187 187
you're monitoring the host platform itself, 188 188
and you want to make sure 189 189
it's not suffering from resource exhaustion, 190 190
'cause it's really easy for us 191 191
to spin up a new virtual machine. 192 192
But if we spin up too many virtual machines, 193 193
all of those virtual machines take processor, 194 194
they take storage, they take memory, 195 195
and the physical server that's hosting them 196 196
is going to eventually run out of all of that. 197 197
So if I have a big server that has say 64 gigabytes of RAM, 198 198
and I give each of my servers four gigabytes of RAM, 199 199
how many servers can I put on there? 200 200
I can only put on 16 servers, right? 201 201
Because I would run out of memory otherwise. 202 202
So if I put on 20 servers, 203 203
I now have too many servers for the amount of RAM I have. 204 204
And so this is one of those things you have to monitor 205 205
and keep track of because otherwise, 206 206
you could inadvertently cause a denial of service.