If you plan on taking the Security+ exam you should have a good understanding of virtualization including some of the virtualization weaknesses. Three potential virtualization weaknesses are:
- VM Escape
- Loss of Confidentiality
- Loss of Availability
Note: This blog is an excerpt from the
CompTIA Security+: Get Certified Get Ahead: SY0-301 Study Guide.
VM Escape
VM escape is an attack that allows an attacker to access the host system from within the virtual system. The host system runs an application or process called a hypervisor to manage the virtual systems. In some situations, the attacker can run code on the virtual system and interact with the hypervisor.
Most virtual systems run on a physical server with elevated privileges, similar to administrator privileges. A successful VM escape attack often gives the attacker unlimited control over the host system and each virtual system within the host.
When vendors discover VM escape vulnerabilities, they write and release patches. Just as with any patches, it is important to test and install these patches as soon as possible. This includes keeping both the physical and the virtual servers patched.
Remember This
VM escape is an attack that allows an attacker to access the host system from within the virtual system. If successful, it allows the attacker to control the physical host server and all other virtual servers on the physical server. Keeping both virtual and physical systems up to date with current patches protects them against known vulnerabilities, including VM escape.
Loss of Confidentiality
As a reminder, each virtual system or virtual machine is just one or more files. While this makes it easy to manage and move virtual machines, it also makes them easy to steal.
It’s worth pointing out that a virtual machine includes the operating system and data, just as a physical system would have both the operating system and data on its physical drives. For example, a virtual machine can include a database with credit card data, company financial records, or any type of proprietary data.
With this in mind, consider an administrator that has turned to the dark side and become a malicious insider. The insider has access to the systems and can easily copy the virtual machine, take it home, and launch it on another physical server. At this point, the attacker has access to the system and the data.
You may remember from chapter 1 that one of the primary methods of protecting against loss of confidentiality is with encryption. Virtual systems support encryption just as physical systems do. If any of the data is important, you can protect it with encryption.
Loss of Availability
Another weakness associated with virtualization is that the host operating system becomes a single point of failure. If a physical server is hosting five virtual servers, and it fails, the five virtual servers also fail.
One way to overcome this weakness for critical servers is to use clustering technologies. Chapter 9 covers clustering in more depth, but, in short, a failover cluster ensures that a service provided by a critical server continues to operate even if a server fails. The failover clustering service switches from a failed server in a cluster to an operational server in the same cluster.
As a simple example, imagine that you have are hosting five virtual database servers on one physical server. You can mirror this configuration on another physical server with the same five virtual servers. If one physical server fails, the other server takes over.
Remember This
You can protect against loss of confidentiality on virtual machines by encrypting files and folders, just as you can encrypt them on a physical system. You can protect against loss of availability on virtual machines using redundancy and failover technologies.
 | Pass the First Time! |
Up-to-date Content
New multiple-choice and performance-based questions added regularly
Pass the first time with quality practice test questions, performance-based questions, flashcards, and audio.Buy The Full Access Study Package Today
60 Days Access
Need more time? You can easily renew for another 60 days at a significantly reduced price.
All materials are available online shortly after making your payment.
Get the Security+ Full Access Study Package Here
Our online Security+ study materials are the perfect complement to the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide. They can also be used to help ensure you’re ready no matter what study guide you’re using.
This exam is expensive.
Make sure you’re ready before exam day.
Here’s what you’ll get:- All of the multiple-choice questions from the best-selling CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide. See a demo here. All questions have full explanations so you’ll know why the correct answers are correct and why the incorrect answers are incorrect.
- Over 40 new multiple-choice questions we’ve added after publishing the study guide.
- Over 30 performance-based questions. See a demo here.
- All of the flashcards from the study guide. View them in any Web browser.
- All of the audio from the study guide. Listen to a sample here.
- Access to a free discount code for 10% off your Security+ voucher.
Buy The Full Access Study Package Today
60 Days Access
All materials are available online shortly after making your payment.
Good tips! There was a good bit about vitualization and clustering on the exam. I passed the test yesterday, and your books (Kindle editions) were invaluable! Thank you for your help; I’m really into networking, so CCNA is up next for me, but I will circle back around to your SSCP study materials afterwards. Oh and by the way, the performance -based questioins are no joke! Practice, Practice, Practice!
Congratulations on the pass and thanks for the kind words. Good luck with the CCNA and then the SSCP.