Virtualization and Cloud Advisor

Expert analysis and advice on server virtualization technologies, deployments and management.

RSS
All Posts | RSS

Our blogger: Bernard Golden is CEO of consulting firm HyperStratus, which specializes in virtualization, cloud computing and related issues. He is also the author of "Virtualization for Dummies," the best-selling book on virtualization to date.

Wed, June 04, 2008

Virtual Servers in the DMZ Pose Security Risks

By Edward L. Haletky

Keywords: virtualization, virtualization security, virtual servers, DMZ, VMware, Microsoft

CONNECTIONS
VMware
Microsoft
There is an education gap between security administrators and virtualization administrators that must be filled. Security administrators do not always fully understand the virtual infrastructure. Virtualization administrators do not always fully understand security. This often leads to insecure virtualization server deployments: It's even more of an issue when virtual machines are placed within the network DMZ.

Often there are hard and fast rules that tell IT what can be done within a DMZ —the exposed portion of a corporate network, which might contain Web, FTP, SMTP and other servers that need open access to the Internet.

Typical of these is a rule banning systems with more than one network connection. Such multihomed systems are favorites of hackers for the easy access they provide to other potentially vulnerable machines. Typically only switches, firewalls or other networking devices are permitted multiple network connections.

However, when this rule is applied to machines supporting virtual servers, you run into some serious concerns, and you could open your network up to further attack.

I would keep all virtual servers as far away from the DMZ as I could physically put them, whether they're running XenServer, VMware Server, Microsoft Hyper-V, or any other form of virtualization.

All qualify as targets for a security administratorâ¬"s fears. But if you're using VMware ESX or VMware ESXi, the reason for that fear is less substantial.

The reason is the virtual switch, which only VMware ESX and VMware ESXi, of all the major virtualization products, currently supports.

The virtual switch works just like any other Layer 2 switch—moving network traffic to and from specific virtual machines in exactly the way a physical switch does.

Virtual switches have a few other important capabilities; they limit IP and MAC address spoofing, disable promiscuous mode, which disables wire tapping, and they support VLANs (called portgroups within VMware ESX). Virtual Switch support for VLANs currently prevents all currently documented VLAN attacks.

The virtual switch's greatest impact is that it provides a defined path from each virtual machine in the DMZ to the physical switch in the DMZ via an uplink. This allows the VMs to communicate with the outside world. The VMs on the DMZ virtual switch have no access to any of the other virtual switch defined within the host, unless the administrator purposefully bridges the virtual switches. The average VMware ESX host has 3 defined virtual switches.

These defined virtual switches, which cover other critical components (namely the Service Console management appliance, Storage, and vMotion) have their own virtual switches that are 100 percent separate and segregated from the DMZ virtual switch. These networks should be connected to the internal network and not the DMZ.

Loading...
Virtualization Vendor Matrix

Find out what vendors offer the products you need.

View the Vendor Matrix »
Virtualization ABCs

Get up to speed on virtualization.

Learn More »
Virtualization MarketSpace
White Papers
Maximum Efficiency Gains with Virtualization
Learn best practices to optimize your infrastructure and operations department and gain the most from virtualization. Learn more »
Manage Virtualization Initiatives
Learn how you can better manage virtualization initiatives to recognize this technology's maximum value. Learn more »
 
SPONSORED LINKS
 

Developing A Dynamic, Real-Time IT Infrastructure

Mid-Sized Company CIO Community: infoBOOM!

Read about virtualization and consolidation effort best practices

Building the Virtualized Enterprise with VMware Infrastructure

8 Key Ingredients to Building an Internal Cloud

White Paper: The Building Blocks for Cloud Computing

Taking the Service Desk to the Next Level

Why Data Loss is Increasing--and What You Can Do About It

Data Loss Prevention: A Better Way to Approach Security

Learn how to managing client systems in the enterprise.

Enterprise PBX Buyer's Guide

Secondary Market Primer: Your Network at Half Price

Top-line Performance that's Bottom-line Efficient

Accenture: Outsourcing for uncertain times. Click to learn more.

Learn about the VMware vSphere (TM) & Intel (R) Xeon (R) Processor 5500 Series

Data Center Optimization: Three Key Strategies

Oracle WebLogic Server Technical Demo

Data Grids and Service-Oriented Architecture

Achieving the Impossible: Unlimited Application Scalability

A Middleware Foundation for Application Grid

Tips for successful virtualization management.

Smart Decisions: The Role of Key Performance Indicators

Gartner Shares Predictions for 2009

64-page prescriptive guide to security, compliance, and IT operations.

Get Google Enterprise Search for your business information.

Cloud Computing: Read about VMware's compelling vision & set of products

White Paper: 8 Key Ingredients to Building an Internal Cloud

Learn how a virtualized enterprise can help your company reduce costs

Why Isn't Server Virtualization Saving Us More?

Bottom-Line Benefits of Virtualization

A CIO Executive Guide: Cloud Computing Looms Big on the Horizon

Seven Ways ITIL Can Help You in an Economic Downturn

Maximizing the Business Value of the PC Infrastructure

Communications and Collaboration Needs at Business Organizations

Using Open Source to Deploy Web Applications

Enterprise PBX Comparison Guide

Getting Value from Outdated Networking Equipment

Accenture IT Consulting: Logical meets technological. More . . .

Stop Application Fraud at the Source with Device Reputation

Top 10 Business and IT Drivers for the Wealth Management Sector

Oracle's Application Grid Technical Demo

Next-Generation Application Servers and Infrastructure

Application Infrastructure at Enterprise Organizations

Achieving Business Agility with Application Grid

Learn about The Information Technology Infrastructure Library.

Achieving Pervasive Performance Management

Automating the Generation and Secure Distribution of Excel Reports

Reduce risk, gain agility. See how Progress can help your business.

Improve ROI, lower TCO and reduce energy consumption.

Introducing the new HP ProLiant G6 server family

 
 
RESOURCE CENTER