Is there security needed between virtual machines? Some say no, some say yes. I've been out talking to a number of virtualization users and non users on this topic and I'm finding that some say no and some say yes. The users of virtualization technology tend to say yes while others looking at virtualization from the outside tend to say no. Why is this?
Well, I thought I'd blog on my thoughts on this!
You see, in the physical datacenter there is no firewalling between servers plugged into the same switch and because of this some people think, well if its not done in the physical world why should it be done in the virtual world. I believe that its not done in the physical world today because there are no solutions today that embed security into datacenter switches. Should it be done in the physical world? I think so! It never hurts to get security as close as possible to the things you are trying to protect and what better place than the switch port in which the critical asset are connected to. This is why people have HOST BASED FW/IPS ON SERVERS! To get security as close as possible! Is that needed?
So my first response to those that say, security between virtual machines is not needed because its not done in the physical world is: Well, just because people have done things one way for many years doesn't mean there isn't a better way.
Would environments be more secure if there was security between servers? I tend to think so. You see, many of the attacks that are taking place these days are not attacks for fame but attacks for fortune and gone are the days where people just hacked to spread nasty viruses. Its all about the data these days (ie. credit cards, social security numbers, etc). We've all heard about the TJ Max security breach where customer data was compromised and many others like banks that have had credit cards compromised.
How and the heck do you think most of these things happened? Attackers are targeting the datacenter these days. Physical or Virtual. Their gateway into these environments are the Web Front End Servers. Let me say that again. The Web Front End Servers! Hackers get to the data from the web front end server that talks to the database backend server. This useually occurs by something called "Cross-Site Scripting" or "SQL Injection" breaches.
Here is a trival way of how this happens:
A hacker finds a vulnerable web site. He sometimes does this by something called Google Hacking. He uses Google to search for sites that has vulnerabilities on it. Say a web site has some content on one of the pages that says "Powered by Drupal 4.1". If a hacker knows that Drupal 4.1 software has a vulnerability in it, he can now target all the search results related to this. Click Here for more detail.
Now lets say Drupal 4.1 on a web site has a SQL-Injection vulnerability because the developer of the Drupal software didn't do Form Field Validation properly. A Form field is something you fill out on a web page like a form that asks for the user name and password. User names and passwords to log into the web site are stored on whats called a Database Server. Hmmm... So this means the web server needs to talk to the database server right? Yes! Keep this in the back of our head for now. The hacker enters in "Admin" for the user ID and "password doesn't matter 'or 1=1--" for the password. And presto! He is logged in to the server as Admin.
The reason he was able to log in is because the web site sends a SQL Database command to the Database server and because the developer of the Drupal software didn't do "Form Field Validation" properly (method of checking for invalid characters like the ' (single quote) symbol), the user was able to bypass the password. Notice the 'OR 1=1 command appended to the password. One does equal one so therefore it will return a TRUE result to the password checker and the OR says use the password typed in (password doesnt matter) OR check to see if one is equal to one. If its true then the password is valid for this user which is Admin.
Now that the user is on the web server, he probably has the ability to connect to the database server or other servers in the network. Why? Because there is connectivity from the web front end to all of the backend servers. He essently can backdoor his way throughout the network.
Another method is for him to append some SQL statement to another SQL statement. Lets say their is a FORM FIELD on the website that collects some information from the database to display it to web site users. It could be entering in the Zip code to find store locations in your area. Instead of putting in the zip code you could put in "95123 'UNION SELECT * FROM credit_card_table--". The hacker is injecting via the UNION command (which means join one SQL statement with another one) a command that says grab all (via the asterisk) information out the credit card table.
Lastly, the hacker can use the UNION command to write text of his desire to a text file on the database server. He may write some nasty code, tell the database to write the code to a file and then tell the server to execute that file. The code could be used to do a denial of service attack to the other virtual machines or whatever. The possibilities are endless!!
Anyway, these are high level examples. I think you get the point.
The Web Front End Virtual Machine has a need to talk to the Web Back End Virtual Machine and security such as Firewalling, Intrusion Prevention definately needs to be in place to have a higher level of security.
Another reason to have security between virtual machines is because servers are now mobile in the virtual world. They move between trust domains to take advantage of computing resources that may be available on a given piece of hardware. Lets say one PHYSICAL server was hosting database VM's and another PHYSICAL server was hosting file server VM's. The file server VM could VMOTION to the same environment as the database VM's. Now where is your isolation between trust domains or unlike resources?
People should think about this problem in greater detail. I'd love to hear everyones comments as to whether or not they think security between VM's is needed.
John Peterson
Montego Networks
Recent Comments