Information Security & compliance issues in Virtualized Environments; presented at CSI 2009

1. Compliance Challenges in Virtualized Environments

2. Compliance to best practice and industry standards is challenging for new technologies like virtualization Compliance in Virtualized Environments Compliance Standards Assurance of Control Objectives Prescription of Control Implementations

3. New technologies introduce new components and processes causing conflict with existing control prescriptions Each server must only have one primary function.[§ 2.2.1, Payment Card Industry (PCI) Data Security Standard Self-Assessment Questionnaire D and Attestation of Compliance All other Merchants and all SAQ-Eligible Service Providers Version 1.2 October 2008, v1.2] Key components should be protected by segregating the critical applications from the other applications and information.[CI2.1.4(a), The Standard of Good Practice for Information Security] Utility programs are programs that may be able to override system and application controls. They should be restricted and controlled. If these system utilities are not needed, they should be disabled or removed.[§ 11.5.4, ISO/IEC 27002-2005 Code of practice for information security management] Compliance in Virtualized Environments

4. Security boundaries within process and technical domains are still being defined and designed for virtualization What consistent best practice exists for virtualized image management? Are there varying levels of granularity regarding access control within different virtualization technologies? Compliance in Virtualized Environments

5. Virtualized PCI Application Domain Model Relationship Scenarios S1. Untrusted users publicly enter PCI information S2. / S2a. Servers transfer PCI info to provider (S2a. Telephone) S3. Remote locations access applications containing PCI Information S6. Staff access PCI application from LAN/WAN S7. Staff access management interfaces of physical and virtual guests and hosts S9.Staff access management interfaces of the routers/switches S11. Data is transferred between the Web-facing PCI Servers and internal PCI database servers

6. What do we want to be compliant with? HIPAA, PCI, SOX, GLB, NERC, CFR Do the high level objectives of the compliance standard conflict with virtualization? Does the regulating body allow for interpretation of the standards? Who has the regulating body assigned to attest to the compliance of the standards? Compliance in Virtualized Environments

7. What specific control objectives are impacted by virtualization? (Improved?) Process and environment classification (NERC CIP-003-1 R4.2) Extension of information asset classification(HIPAA 164.308(a)(7)(ii)(E)) Log Monitoring & Tracking (PCI 4.2 (v1.1)) System boundary definition (NIST 800-53) Are there specific control implementations in conflict? Least Privilege implementation issues Lockout Procedure By-pass Compliance in Virtualized Environments

8. What design & service management issues in virtualization are related to compliance? Business Continuity Management Security Audit & Assurance Levels Change Control Implementations Security Domain / Boundary Control Access Control & Privilege Administration Security Operation Schedule Management Compliance in Virtualized Environments

10. Will “complex” virtualization management components (HA, DRS, Vmotion or VCB) be used in the environment?

12. Example LogicalDiagram (Better)

14. What do systems currently hosted in the ESX environment do?

15. Does a logical deployment diagram for PCI systems exist?

16. Will HA, DRS, Vmotion or VCB be used in this environment?

17. Are there change management policies in place for system management?

19. How is ESX/VCenter user administration performed? Formally documented?

20. What security measures are place to avoid copying/pasting or adding of devices to the virtual guests?

21. Are templates being used for deploying guests? If so, what security measures are being used for template creation?

22. What system logging policies exist; How is logging deployed within the ESX architecture?

26. What roles and permissions are used/disabled in VC?

27. Is the VC computer placed in a separate management network?

28. Where does the VC database reside and what method of authentication is used on this database?

29. What security practices have been applied to secure the database?

31. Increased complexity

32. Increase in exposure to:

33. Technical misconfiguration

34. Central points of access / collusion for staff

36. Experts disagree on effectiveness of controls and implementations

38. Understand your virtualization security architecture