Antivirus Policies Remain Contradictory for VMware ESX and ESXi

Have you read your security policy today? Does it take virtualization into account?

In a previous blog I mentioned that the Defense Information Security Agency (DISA)’s Security Technical Implementation Guide (STIG) had an interesting reason for not running antivirus on the Service Console of ESX. The reason was that the Unix-based antivirus tool recommended in the STIG won’t install properly on ESX. There are performance issues and the potential for false positives as well.

Many security policies require that some form of antivirus be run on any system attached to the network unless that system happens to be an appliance.

That presents an interesting picture of its own for VMware infrastructure administrators. VMware ESXi is considered to be an appliance, but VMware ESX is not.

However, I happen to believe that they are both hybrid devices that combine network, storage, and compute resources into one system; sort of a combination of appliance and operating system.

This causes interesting issues with the written security policies that often dictate no multi-homed machines unless it is a switch, router, etc. Well since VMware ESX and ESXi both contain a switch rather than a bridge, do both fall under that rule?

By the same token, it is a compute resource and many security policies dictate that these must contain some form of antivirus, antispyware, and other protection tools.

Because of the differentiation over what is or is not an appliance, ESXi and ESX are treated differently. I think they should be treated the same. (As the management console for VMware ESXi should be secured using many of the same techniques for VMware ESX.)

In either case, running antivirus tools from the management appliances for ESX and ESXi is frowned upon by the virtualization experts for several reasons.