In this lesson,
we're going to discuss virtualization and containerization.
Virtualization is a powerful technology
that allows for the emulation of servers,
each running its own operating systems
within a virtual machine.
Containerization is a lightweight alternative
to full machine virtualization
that involves encapsulating an application in a container
within its own operating environment.
In this lesson,
we're going to cover both virtualization
and containerization,
the benefit and the risks of both,
some vulnerabilities that threaten your virtual machines
and how to secure them.
Virtual machines operate on a platform
known as a hypervisor,
which manages the distribution
of the physical servers' resources
such as the processor, memory,
and hard disk space among the virtual machines
Hypervisors come in two main types, type 1 and type 2.
A type 1 hypervisor,
also known as a bare metal or a native hypervisor,
runs directly on the host hardware
and functions similarly to an operating system.
Examples of type 1 hypervisors include Microsoft's Hyper-V,
Citrix's XenServer and VMware's ESXi and vSphere.
On the other hand,
type 2 hypervisor operates
within a standard operating system
such as Windows, Mac, or Linux.
An example of this can be seen in the next lesson
where Windows 10 will be installed
as an emulated desktop computer inside a virtual machine
run by VirtualBox software on a Mac OS X desktop.
This demonstrates the versatility of type 2 hypervisors
like VirtualBox and VMware,
which allow for the operation
of different systems within another.
However,
it's important to note that a type 1
or bare metal hypervisor is generally faster
and efficient than a type 2 or hosted hypervisor.
This is because a bare metal hypervisor
does not spend the physical computer's resources
running a full desktop operating system first.
Instead, it acts as a streamlined,
specialized operating system
to provide the physical resources
to the virtual machines it hosts.
Containerization, on the other hand,
is a lightweight alternative to full machine virtualization
that involves encapsulating an application in a container
within its own operating environment.
This provides many benefits of loading
an application onto a virtual machine
as the application can be run
on any suitable physical machine
without any worries about dependencies.
In simpler terms,
containerization is a method of running applications
in isolated user spaces called containers.
These containers are separated from each other
but share the whole system's OS kernel.
Each container includes the application
and all of its dependencies.
However, it shares the OS,
and usually the binaries and libraries
from the host machine.
This approach offers several advantages,
including efficiency and speed,
portability, scalability, isolation, and consistency.
Popular containerization technologies include Docker,
Kubernetes and Red Hat OpenShift.
These technologies have revolutionized
the way developers and organizations create, deploy,
and manage applications, particularly in cloud environments.
While virtualization brings with it a lot
of capability to add separation inside of our servers
and bring in some additional security,
there are some unique vulnerabilities
that can be exploited by attackers
when it comes to virtualization.
These can include VM escape, privilege elevation,
live VM migration and resource reuse.
Virtual machines are segmented and separated by default.
So if an attacker is able to exploit
the operating system being run inside one virtual machine,
it doesn't necessarily mean that they can get
on the other virtual machines being hosted
by the same physical server.
Virtual machine escape or VM escape occurs
when an attacker is able to break out
of one of these normally isolated virtual machines
and they can begin to interact directly
with the underlying hypervisor.
From this position,
the attacker could migrate themselves
out and into another virtual machine
being hosted on the same physical server.
Now VM escape techniques are extremely difficult to conduct.
They rely on exploiting physical resources
that are shared between the VMs
but it's still a vulnerability that you need to be aware of.
To mitigate this vulnerability,
virtual servers should be hosted
on the same physical servers
as other virtual machines in the same network
or network segment based on its classification.
Privilege elevation occurs when a user is able
to grant themselves the ability
to run functions as a higher level user
such as the root or the administrator.
While this can be bad on a single server,
it can be catastrophic on a physical server
if the attacker is able to perform this
on the hypervisor itself.
A few years ago,
VMware had a flaw on their hypervisor
that allowed a user to escalate privileges
into any of the guest operating systems
hosted by that hypervisor.
To prevent this,
it's important to remain current on your hot fixes
and your service packs for your virtualization software.
Another vulnerability to consider is one associated
with live migration of virtual machines.
When a virtual machine needs to move
from one physical host to another,
this is called a live migration.
If an attacker can gain a foothold into your network
and place themselves between these two physical machines,
they can implement a form
of an adversary-in-the-middle attack
where they can capture the data being sent
between two physical servers.
This data has not been encrypted.
This can allow the attacker to breach the confidentiality
of the servers being hosted as virtual machines
when they're transmitted over the network.
Finally, resource reuse.
Resource reuse is a concept in computing
where system resources, like memory, storage,
or processing power can be reused
for different tasks or processes.
While this is an efficient way to utilize resources,
can also introduce a type of vulnerability
known as a resource reuse vulnerability.
A resource reuse vulnerability occurs
when a system resource such as memory
is not properly cleared or reset
before being assigned to another task.
This can potentially allow sensitive information
from the previous task to be exposed to the new task.
This type of vulnerability is particularly relevant
in multi-tenant environments like cloud computing
where resources are shared among multiple users.
If a resource reuse vulnerability exists,
one user might be able to access sensitive information
belonging to another user.
Finally,
when we're specifically relying
upon application containerization
as our virtualization method,
it's important to realize that the containers
are all sharing a single common operating system.
If the attacker is able to exploit
that one operating system through some vulnerability,
this causes all of the applications being hosted
on that operating system to be at risk.
So now that I scared you
with all the threats that exist on virtual machines,
let's talk about how we can best secure them.
Most of the things that we need to do
to secure a virtual machine are very similar to things
that we need to do to secure a regular physical server.
This includes things like updating
your operating systems and your applications.
Also, you need to ensure that each virtual machine
has a good antivirus solution installed
with its own software firewall,
good strong passwords, and good policies,
and all of other security features
that we're going to discuss throughout this course.
First, remember that a hypervisor,
whether it's a type 1, type 2,
or application containerization based model
needs to be updated and secured
whenever the manufacturer releases a new security patch.
For example, if an exploit has been discovered
that you can now conduct a VM escape against VMware,
you can be certain that the company like VMware
is going to quickly release a patch
to fix this critical vulnerability.
In managing virtual machines or VMs,
it's crucial to limit the connections
between VMs and the physical machines,
which can be represented
by a virtualized network cord or network shares.
A VM gets infected with malware
should remain isolated from other VMs
hosted by the same hypervisor,
provided the isolation configurations
are correctly implemented.
Connections between a VM and a shared resource
such as a network file server can potentially allow data
to be passed between different VMs,
breaking down the isolation.
Therefore, is advised to minimize
and remove any unneeded features to support operations,
reducing the attack surface and potential vulnerabilities.
If an attacker compromises a VM and forces it
to use a large amount of physical server resources,
it can affect other VMs hosted on the same server,
potentially resulting in a denial of service.
To mitigate this,
consider distributing your VMs
among several physical servers.
As a system administrator,
it's important to track your VMs
and ensure that they're properly patched and up-to-date.
Be aware of virtualizations sprawl
where VMs are created and deployed without proper oversight,
making it easy to lose track of them.
Lastly,
enable encryption of the file that hosts the VMs
to ensure safety and confidentiality.
This protects the VM files
from unauthorized access on the server.
So remember,
virtualization is a technology
that allows for the emulation of servers
each running its own operating system
within a virtual machine.
Containerization is a lightweight alternative
to full machine virtualization
that encapsulates an application in a container
with its own operating environment.
Hypervisors come in two types,
type 1 or a bare metal hypervisor
and type 2 or a hosted hypervisor.
Type 1 hypervisors are generally faster
and more efficient than type 2.
Virtualization vulnerabilities include VM escape,
data remnants, privilege escalation,
live VM migration, resource reuse and VM sprawl.
Securing virtual machines involves updating
the operating systems and applications,
installing antivirus solutions,
implementing software firewalls, using strong passwords,
and applying security patches for the hypervisor.