1
00:00:00,060 --> 00:00:00,893
In this lesson,

2
00:00:00,893 --> 00:00:04,050
we're going to discuss virtualization and containerization.

3
00:00:04,050 --> 00:00:06,120
Virtualization is a powerful technology

4
00:00:06,120 --> 00:00:08,610
that allows for the emulation of servers,

5
00:00:08,610 --> 00:00:10,920
each running its own operating systems

6
00:00:10,920 --> 00:00:12,630
within a virtual machine.

7
00:00:12,630 --> 00:00:15,030
Containerization is a lightweight alternative

8
00:00:15,030 --> 00:00:17,100
to full machine virtualization

9
00:00:17,100 --> 00:00:20,520
that involves encapsulating an application in a container

10
00:00:20,520 --> 00:00:22,920
within its own operating environment.

11
00:00:22,920 --> 00:00:23,753
In this lesson,

12
00:00:23,753 --> 00:00:25,680
we're going to cover both virtualization

13
00:00:25,680 --> 00:00:27,240
and containerization,

14
00:00:27,240 --> 00:00:29,460
the benefit and the risks of both,

15
00:00:29,460 --> 00:00:32,009
some vulnerabilities that threaten your virtual machines

16
00:00:32,009 --> 00:00:34,140
and how to secure them.

17
00:00:34,140 --> 00:00:36,510
Virtual machines operate on a platform

18
00:00:36,510 --> 00:00:38,130
known as a hypervisor,

19
00:00:38,130 --> 00:00:39,870
which manages the distribution

20
00:00:39,870 --> 00:00:42,540
of the physical servers' resources

21
00:00:42,540 --> 00:00:44,550
such as the processor, memory,

22
00:00:44,550 --> 00:00:47,560
and hard disk space among the virtual machines

23
00:00:48,420 --> 00:00:53,160
Hypervisors come in two main types, type 1 and type 2.

24
00:00:53,160 --> 00:00:54,720
A type 1 hypervisor,

25
00:00:54,720 --> 00:00:57,990
also known as a bare metal or a native hypervisor,

26
00:00:57,990 --> 00:01:00,300
runs directly on the host hardware

27
00:01:00,300 --> 00:01:03,630
and functions similarly to an operating system.

28
00:01:03,630 --> 00:01:08,310
Examples of type 1 hypervisors include Microsoft's Hyper-V,

29
00:01:08,310 --> 00:01:13,310
Citrix's XenServer and VMware's ESXi and vSphere.

30
00:01:13,740 --> 00:01:14,970
On the other hand,

31
00:01:14,970 --> 00:01:16,950
type 2 hypervisor operates

32
00:01:16,950 --> 00:01:18,960
within a standard operating system

33
00:01:18,960 --> 00:01:21,660
such as Windows, Mac, or Linux.

34
00:01:21,660 --> 00:01:24,330
An example of this can be seen in the next lesson

35
00:01:24,330 --> 00:01:26,370
where Windows 10 will be installed

36
00:01:26,370 --> 00:01:30,180
as an emulated desktop computer inside a virtual machine

37
00:01:30,180 --> 00:01:34,170
run by VirtualBox software on a Mac OS X desktop.

38
00:01:34,170 --> 00:01:37,470
This demonstrates the versatility of type 2 hypervisors

39
00:01:37,470 --> 00:01:39,930
like VirtualBox and VMware,

40
00:01:39,930 --> 00:01:41,580
which allow for the operation

41
00:01:41,580 --> 00:01:43,560
of different systems within another.

42
00:01:43,560 --> 00:01:44,393
However,

43
00:01:44,393 --> 00:01:46,140
it's important to note that a type 1

44
00:01:46,140 --> 00:01:49,230
or bare metal hypervisor is generally faster

45
00:01:49,230 --> 00:01:53,070
and efficient than a type 2 or hosted hypervisor.

46
00:01:53,070 --> 00:01:55,380
This is because a bare metal hypervisor

47
00:01:55,380 --> 00:01:58,170
does not spend the physical computer's resources

48
00:01:58,170 --> 00:02:01,470
running a full desktop operating system first.

49
00:02:01,470 --> 00:02:03,660
Instead, it acts as a streamlined,

50
00:02:03,660 --> 00:02:05,760
specialized operating system

51
00:02:05,760 --> 00:02:07,710
to provide the physical resources

52
00:02:07,710 --> 00:02:10,229
to the virtual machines it hosts.

53
00:02:10,229 --> 00:02:12,210
Containerization, on the other hand,

54
00:02:12,210 --> 00:02:16,290
is a lightweight alternative to full machine virtualization

55
00:02:16,290 --> 00:02:19,860
that involves encapsulating an application in a container

56
00:02:19,860 --> 00:02:22,170
within its own operating environment.

57
00:02:22,170 --> 00:02:24,240
This provides many benefits of loading

58
00:02:24,240 --> 00:02:26,340
an application onto a virtual machine

59
00:02:26,340 --> 00:02:28,350
as the application can be run

60
00:02:28,350 --> 00:02:30,090
on any suitable physical machine

61
00:02:30,090 --> 00:02:32,640
without any worries about dependencies.

62
00:02:32,640 --> 00:02:33,900
In simpler terms,

63
00:02:33,900 --> 00:02:36,900
containerization is a method of running applications

64
00:02:36,900 --> 00:02:40,530
in isolated user spaces called containers.

65
00:02:40,530 --> 00:02:43,470
These containers are separated from each other

66
00:02:43,470 --> 00:02:46,410
but share the whole system's OS kernel.

67
00:02:46,410 --> 00:02:48,540
Each container includes the application

68
00:02:48,540 --> 00:02:50,460
and all of its dependencies.

69
00:02:50,460 --> 00:02:52,590
However, it shares the OS,

70
00:02:52,590 --> 00:02:55,260
and usually the binaries and libraries

71
00:02:55,260 --> 00:02:57,450
from the host machine.

72
00:02:57,450 --> 00:03:00,270
This approach offers several advantages,

73
00:03:00,270 --> 00:03:02,550
including efficiency and speed,

74
00:03:02,550 --> 00:03:06,510
portability, scalability, isolation, and consistency.

75
00:03:06,510 --> 00:03:09,810
Popular containerization technologies include Docker,

76
00:03:09,810 --> 00:03:12,660
Kubernetes and Red Hat OpenShift.

77
00:03:12,660 --> 00:03:14,790
These technologies have revolutionized

78
00:03:14,790 --> 00:03:18,270
the way developers and organizations create, deploy,

79
00:03:18,270 --> 00:03:21,930
and manage applications, particularly in cloud environments.

80
00:03:21,930 --> 00:03:24,000
While virtualization brings with it a lot

81
00:03:24,000 --> 00:03:26,670
of capability to add separation inside of our servers

82
00:03:26,670 --> 00:03:28,830
and bring in some additional security,

83
00:03:28,830 --> 00:03:30,420
there are some unique vulnerabilities

84
00:03:30,420 --> 00:03:32,850
that can be exploited by attackers

85
00:03:32,850 --> 00:03:34,680
when it comes to virtualization.

86
00:03:34,680 --> 00:03:38,520
These can include VM escape, privilege elevation,

87
00:03:38,520 --> 00:03:41,880
live VM migration and resource reuse.

88
00:03:41,880 --> 00:03:45,390
Virtual machines are segmented and separated by default.

89
00:03:45,390 --> 00:03:47,580
So if an attacker is able to exploit

90
00:03:47,580 --> 00:03:51,420
the operating system being run inside one virtual machine,

91
00:03:51,420 --> 00:03:53,820
it doesn't necessarily mean that they can get

92
00:03:53,820 --> 00:03:56,250
on the other virtual machines being hosted

93
00:03:56,250 --> 00:03:58,020
by the same physical server.

94
00:03:58,020 --> 00:04:01,080
Virtual machine escape or VM escape occurs

95
00:04:01,080 --> 00:04:03,030
when an attacker is able to break out

96
00:04:03,030 --> 00:04:06,150
of one of these normally isolated virtual machines

97
00:04:06,150 --> 00:04:08,460
and they can begin to interact directly

98
00:04:08,460 --> 00:04:10,800
with the underlying hypervisor.

99
00:04:10,800 --> 00:04:12,030
From this position,

100
00:04:12,030 --> 00:04:14,010
the attacker could migrate themselves

101
00:04:14,010 --> 00:04:17,010
out and into another virtual machine

102
00:04:17,010 --> 00:04:20,160
being hosted on the same physical server.

103
00:04:20,160 --> 00:04:23,670
Now VM escape techniques are extremely difficult to conduct.

104
00:04:23,670 --> 00:04:26,610
They rely on exploiting physical resources

105
00:04:26,610 --> 00:04:28,560
that are shared between the VMs

106
00:04:28,560 --> 00:04:32,010
but it's still a vulnerability that you need to be aware of.

107
00:04:32,010 --> 00:04:33,720
To mitigate this vulnerability,

108
00:04:33,720 --> 00:04:35,340
virtual servers should be hosted

109
00:04:35,340 --> 00:04:37,050
on the same physical servers

110
00:04:37,050 --> 00:04:39,720
as other virtual machines in the same network

111
00:04:39,720 --> 00:04:43,170
or network segment based on its classification.

112
00:04:43,170 --> 00:04:46,080
Privilege elevation occurs when a user is able

113
00:04:46,080 --> 00:04:47,970
to grant themselves the ability

114
00:04:47,970 --> 00:04:50,970
to run functions as a higher level user

115
00:04:50,970 --> 00:04:53,430
such as the root or the administrator.

116
00:04:53,430 --> 00:04:55,890
While this can be bad on a single server,

117
00:04:55,890 --> 00:04:58,470
it can be catastrophic on a physical server

118
00:04:58,470 --> 00:05:00,480
if the attacker is able to perform this

119
00:05:00,480 --> 00:05:02,400
on the hypervisor itself.

120
00:05:02,400 --> 00:05:03,420
A few years ago,

121
00:05:03,420 --> 00:05:05,910
VMware had a flaw on their hypervisor

122
00:05:05,910 --> 00:05:08,700
that allowed a user to escalate privileges

123
00:05:08,700 --> 00:05:11,100
into any of the guest operating systems

124
00:05:11,100 --> 00:05:12,930
hosted by that hypervisor.

125
00:05:12,930 --> 00:05:13,860
To prevent this,

126
00:05:13,860 --> 00:05:16,710
it's important to remain current on your hot fixes

127
00:05:16,710 --> 00:05:19,740
and your service packs for your virtualization software.

128
00:05:19,740 --> 00:05:22,500
Another vulnerability to consider is one associated

129
00:05:22,500 --> 00:05:24,930
with live migration of virtual machines.

130
00:05:24,930 --> 00:05:26,460
When a virtual machine needs to move

131
00:05:26,460 --> 00:05:28,350
from one physical host to another,

132
00:05:28,350 --> 00:05:30,480
this is called a live migration.

133
00:05:30,480 --> 00:05:33,090
If an attacker can gain a foothold into your network

134
00:05:33,090 --> 00:05:36,030
and place themselves between these two physical machines,

135
00:05:36,030 --> 00:05:37,440
they can implement a form

136
00:05:37,440 --> 00:05:39,690
of an adversary-in-the-middle attack

137
00:05:39,690 --> 00:05:41,850
where they can capture the data being sent

138
00:05:41,850 --> 00:05:43,890
between two physical servers.

139
00:05:43,890 --> 00:05:45,960
This data has not been encrypted.

140
00:05:45,960 --> 00:05:48,870
This can allow the attacker to breach the confidentiality

141
00:05:48,870 --> 00:05:51,930
of the servers being hosted as virtual machines

142
00:05:51,930 --> 00:05:54,630
when they're transmitted over the network.

143
00:05:54,630 --> 00:05:56,790
Finally, resource reuse.

144
00:05:56,790 --> 00:05:58,890
Resource reuse is a concept in computing

145
00:05:58,890 --> 00:06:01,260
where system resources, like memory, storage,

146
00:06:01,260 --> 00:06:03,300
or processing power can be reused

147
00:06:03,300 --> 00:06:05,340
for different tasks or processes.

148
00:06:05,340 --> 00:06:08,160
While this is an efficient way to utilize resources,

149
00:06:08,160 --> 00:06:10,380
can also introduce a type of vulnerability

150
00:06:10,380 --> 00:06:13,680
known as a resource reuse vulnerability.

151
00:06:13,680 --> 00:06:15,780
A resource reuse vulnerability occurs

152
00:06:15,780 --> 00:06:17,880
when a system resource such as memory

153
00:06:17,880 --> 00:06:20,160
is not properly cleared or reset

154
00:06:20,160 --> 00:06:22,650
before being assigned to another task.

155
00:06:22,650 --> 00:06:25,260
This can potentially allow sensitive information

156
00:06:25,260 --> 00:06:28,740
from the previous task to be exposed to the new task.

157
00:06:28,740 --> 00:06:31,560
This type of vulnerability is particularly relevant

158
00:06:31,560 --> 00:06:34,620
in multi-tenant environments like cloud computing

159
00:06:34,620 --> 00:06:37,560
where resources are shared among multiple users.

160
00:06:37,560 --> 00:06:40,110
If a resource reuse vulnerability exists,

161
00:06:40,110 --> 00:06:42,750
one user might be able to access sensitive information

162
00:06:42,750 --> 00:06:44,310
belonging to another user.

163
00:06:44,310 --> 00:06:45,143
Finally,

164
00:06:45,143 --> 00:06:46,380
when we're specifically relying

165
00:06:46,380 --> 00:06:48,390
upon application containerization

166
00:06:48,390 --> 00:06:50,190
as our virtualization method,

167
00:06:50,190 --> 00:06:52,410
it's important to realize that the containers

168
00:06:52,410 --> 00:06:56,100
are all sharing a single common operating system.

169
00:06:56,100 --> 00:06:57,750
If the attacker is able to exploit

170
00:06:57,750 --> 00:07:00,930
that one operating system through some vulnerability,

171
00:07:00,930 --> 00:07:03,870
this causes all of the applications being hosted

172
00:07:03,870 --> 00:07:07,020
on that operating system to be at risk.

173
00:07:07,020 --> 00:07:07,980
So now that I scared you

174
00:07:07,980 --> 00:07:10,650
with all the threats that exist on virtual machines,

175
00:07:10,650 --> 00:07:13,080
let's talk about how we can best secure them.

176
00:07:13,080 --> 00:07:14,400
Most of the things that we need to do

177
00:07:14,400 --> 00:07:17,160
to secure a virtual machine are very similar to things

178
00:07:17,160 --> 00:07:20,460
that we need to do to secure a regular physical server.

179
00:07:20,460 --> 00:07:21,930
This includes things like updating

180
00:07:21,930 --> 00:07:24,600
your operating systems and your applications.

181
00:07:24,600 --> 00:07:27,090
Also, you need to ensure that each virtual machine

182
00:07:27,090 --> 00:07:29,640
has a good antivirus solution installed

183
00:07:29,640 --> 00:07:32,280
with its own software firewall,

184
00:07:32,280 --> 00:07:34,950
good strong passwords, and good policies,

185
00:07:34,950 --> 00:07:36,630
and all of other security features

186
00:07:36,630 --> 00:07:38,880
that we're going to discuss throughout this course.

187
00:07:38,880 --> 00:07:41,220
First, remember that a hypervisor,

188
00:07:41,220 --> 00:07:43,140
whether it's a type 1, type 2,

189
00:07:43,140 --> 00:07:45,690
or application containerization based model

190
00:07:45,690 --> 00:07:47,820
needs to be updated and secured

191
00:07:47,820 --> 00:07:51,690
whenever the manufacturer releases a new security patch.

192
00:07:51,690 --> 00:07:53,580
For example, if an exploit has been discovered

193
00:07:53,580 --> 00:07:56,490
that you can now conduct a VM escape against VMware,

194
00:07:56,490 --> 00:07:58,440
you can be certain that the company like VMware

195
00:07:58,440 --> 00:08:00,210
is going to quickly release a patch

196
00:08:00,210 --> 00:08:02,790
to fix this critical vulnerability.

197
00:08:02,790 --> 00:08:05,130
In managing virtual machines or VMs,

198
00:08:05,130 --> 00:08:06,750
it's crucial to limit the connections

199
00:08:06,750 --> 00:08:09,300
between VMs and the physical machines,

200
00:08:09,300 --> 00:08:10,470
which can be represented

201
00:08:10,470 --> 00:08:13,903
by a virtualized network cord or network shares.

202
00:08:13,903 --> 00:08:16,350
A VM gets infected with malware

203
00:08:16,350 --> 00:08:18,600
should remain isolated from other VMs

204
00:08:18,600 --> 00:08:20,640
hosted by the same hypervisor,

205
00:08:20,640 --> 00:08:22,890
provided the isolation configurations

206
00:08:22,890 --> 00:08:25,350
are correctly implemented.

207
00:08:25,350 --> 00:08:27,990
Connections between a VM and a shared resource

208
00:08:27,990 --> 00:08:31,230
such as a network file server can potentially allow data

209
00:08:31,230 --> 00:08:33,419
to be passed between different VMs,

210
00:08:33,419 --> 00:08:35,010
breaking down the isolation.

211
00:08:35,010 --> 00:08:37,409
Therefore, is advised to minimize

212
00:08:37,409 --> 00:08:42,000
and remove any unneeded features to support operations,

213
00:08:42,000 --> 00:08:45,510
reducing the attack surface and potential vulnerabilities.

214
00:08:45,510 --> 00:08:48,660
If an attacker compromises a VM and forces it

215
00:08:48,660 --> 00:08:51,990
to use a large amount of physical server resources,

216
00:08:51,990 --> 00:08:55,290
it can affect other VMs hosted on the same server,

217
00:08:55,290 --> 00:08:58,440
potentially resulting in a denial of service.

218
00:08:58,440 --> 00:08:59,670
To mitigate this,

219
00:08:59,670 --> 00:09:01,590
consider distributing your VMs

220
00:09:01,590 --> 00:09:04,050
among several physical servers.

221
00:09:04,050 --> 00:09:05,520
As a system administrator,

222
00:09:05,520 --> 00:09:07,830
it's important to track your VMs

223
00:09:07,830 --> 00:09:10,980
and ensure that they're properly patched and up-to-date.

224
00:09:10,980 --> 00:09:13,440
Be aware of virtualizations sprawl

225
00:09:13,440 --> 00:09:18,030
where VMs are created and deployed without proper oversight,

226
00:09:18,030 --> 00:09:19,950
making it easy to lose track of them.

227
00:09:19,950 --> 00:09:20,783
Lastly,

228
00:09:20,783 --> 00:09:24,030
enable encryption of the file that hosts the VMs

229
00:09:24,030 --> 00:09:27,570
to ensure safety and confidentiality.

230
00:09:27,570 --> 00:09:29,010
This protects the VM files

231
00:09:29,010 --> 00:09:30,990
from unauthorized access on the server.

232
00:09:30,990 --> 00:09:31,980
So remember,

233
00:09:31,980 --> 00:09:33,510
virtualization is a technology

234
00:09:33,510 --> 00:09:36,000
that allows for the emulation of servers

235
00:09:36,000 --> 00:09:37,980
each running its own operating system

236
00:09:37,980 --> 00:09:39,660
within a virtual machine.

237
00:09:39,660 --> 00:09:42,060
Containerization is a lightweight alternative

238
00:09:42,060 --> 00:09:44,280
to full machine virtualization

239
00:09:44,280 --> 00:09:47,190
that encapsulates an application in a container

240
00:09:47,190 --> 00:09:49,500
with its own operating environment.

241
00:09:49,500 --> 00:09:51,540
Hypervisors come in two types,

242
00:09:51,540 --> 00:09:53,670
type 1 or a bare metal hypervisor

243
00:09:53,670 --> 00:09:56,070
and type 2 or a hosted hypervisor.

244
00:09:56,070 --> 00:09:58,230
Type 1 hypervisors are generally faster

245
00:09:58,230 --> 00:10:00,240
and more efficient than type 2.

246
00:10:00,240 --> 00:10:03,030
Virtualization vulnerabilities include VM escape,

247
00:10:03,030 --> 00:10:05,400
data remnants, privilege escalation,

248
00:10:05,400 --> 00:10:09,690
live VM migration, resource reuse and VM sprawl.

249
00:10:09,690 --> 00:10:12,750
Securing virtual machines involves updating

250
00:10:12,750 --> 00:10:15,150
the operating systems and applications,

251
00:10:15,150 --> 00:10:17,370
installing antivirus solutions,

252
00:10:17,370 --> 00:10:20,940
implementing software firewalls, using strong passwords,

253
00:10:20,940 --> 00:10:24,033
and applying security patches for the hypervisor.