by Edward L. Haletky

Antivirus Policies Remain Contradictory for VMware ESX and ESXi

Aug 25, 20083 mins

Security recommendations change depending on whether they deal with a server or an appliance. How does that mesh with a virtual infrastructure in which both ESX and ESXi play almost identical roles and have similar vulnerabilities?

Have you read your security policy today? Does it take virtualization into account?

In a previous blog I mentioned that the Defense Information Security Agency (DISA)’s Security Technical Implementation Guide (STIG) had an interesting reason for not running antivirus on the Service Console of ESX. The reason was that the Unix-based antivirus tool recommended in the STIG won’t install properly on ESX. There are performance issues and the potential for false positives as well.

Many security policies require that some form of antivirus be run on any system attached to the network unless that system happens to be an appliance.

That presents an interesting picture of its own for VMware infrastructure administrators. VMware ESXi is considered to be an appliance, but VMware ESX is not.

However, I happen to believe that they are both hybrid devices that combine network, storage, and compute resources into one system; sort of a combination of appliance and operating system.

This causes interesting issues with the written security policies that often dictate no multi-homed machines unless it is a switch, router, etc. Well since VMware ESX and ESXi both contain a switch rather than a bridge, do both fall under that rule?

By the same token, it is a compute resource and many security policies dictate that these must contain some form of antivirus, antispyware, and other protection tools.

Because of the differentiation over what is or is not an appliance, ESXi and ESX are treated differently. I think they should be treated the same. (As the management console for VMware ESXi should be secured using many of the same techniques for VMware ESX.)

In either case, running antivirus tools from the management appliances for ESX and ESXi is frowned upon by the virtualization experts for several reasons.

  • antivirus full disk scans will affect performance;
  • VMware ESX/ESXi management appliances provide special use environments where users would not store files, documents, etc.;
  • scanning virtual disk files will produce false positives;
  • the VMware Hypervisor throttles all disk accesses from the management appliances so that reads and writes are very, very slow;
  • there is no current antivirus software for VMware ESXi.

    Security policies will need to be updated to account for VMware ESX or ESXi if this has not already happened.

    Antivirus and multi-homed issues may be just the start of the questions within this all important document, the security policy. When forthcoming VMware VMSafe products are announced by VMware and third parties this will need to be addressed as well. Specifically, an answer to the question “How do you handle the plug-ins for the virtual infrastructure?” must be stated.

    Virtualization expert Edward L. Haletky is the author of “VMWare ESX Server in the Enterprise: Planning and Securing Virtualization Servers,” Pearson Education (2008.) He recently left Hewlett-Packard, where he worked in the Virtualization, Linux, and High-Performance Technical Computing teams. Haletky owns AstroArch Consulting, providing virtualization, security, and network consulting and development. Haletky is also a champion and moderator for the VMware discussion forums, providing answers to security and configuration questions.