Review of NIST Publication SP 800-125 "Guide to Security for Full Virtualization Technologies"

Ruslan Rakhmetov, Security Vision

Virtualisation technologies have been widely used in the last 15 years, but the virtualisation principle itself was developed 50 years ago by IBM, and the principles laid down back then are still at the heart of modern virtualisation systems. Today almost all IT/IS specialists are actively working with one or another means of virtualisation, and the reason for this is clear: virtualisation allows to use hardware computing resources more rationally, placing on one physical server several virtual machines, often working with different types of operating systems, and adding a new level of abstraction in virtualisation allows to ‘decouple’ hardware and software platforms, which brings additional stability of operation and simplifies administration However, the application of additional technologies often involves certain threats to information security, which requires the updating of organisational and technical protection measures to minimise the associated cyber risks. NIST SP 800-125, Guideto Security for Full Virtualisation Technologies, provides recommendations for improving the cybersecurity of virtual infrastructure, including securing all components of the virtualisation platform, managing administrative access, securing the hypervisor, and planning to secure all virtual components before deployment. In addition to this publication, NIST has developed NIST SP 800-125A, Security Recommendations for Server-based Hypervisor Platforms, which describes basic hypervisor security features without reference to specific architectures or platforms, and NIST SP 800-125B, ‘Secure Virtual Network Configuration for Virtual Machine (VM) Protection,’ which describes techniques for network segmentation, network redundancy, firewall traffic control, and virtual network monitoring for virtual infrastructure cybersecurity. We'll talk about them in the current publication.

NIST SP 800-125 focuses on protecting full virtualisation, full virtualisation, which is different from application virtualisation, application virtualisation (for example, virtualisation using the Java Virtual Machine or running certain applications in a sandbox) or operating system virtualisation, operating system virtualisation (for example, using containerisation technologies). With full virtualisation, a hypervisor (or virtual machine monitor) is used to manage the guest OS. The hypervisor can be installed directly on the hardware platform (so-called bare metal virtualisation, e.g. virtualisation via VMware ESXi) or on the host OS (e.g. virtualisation via Microsoft Hyper-V). The bare metal virtualisation option can be considered more preferable from an IS perspective, as the use of the host OS option adds a new intermediate layer and a new target for attack - in a cyber attack on the host OS, attackers can exploit a wider range of vulnerabilities, as the host OS is in many cases a generic OS with additional features and characteristic vulnerabilities, and specialised OSs for bare metal virtualisation give attackers a smaller attack surface due to the lack of redundant functionality.

The main challenges for cybersecurity of virtualised systems are the task of protecting guest OS images and guest OS RAM data, isolating guest systems from each other, securing network traffic between virtual systems, and the task of protecting against attacks from a compromised hypervisor that gives attackers access to all guest OSes it manages and their corresponding data. It should also be noted that the convenience of creating snapshots of guest OSes and distributing the finished virtual machine images can be overshadowed by the danger that the replicated image or snapshot of the guest OS contains malicious code that has previously infected the replicated system and thus will spread to other systems.

NIST SP 800-125 provides recommendations for improving the cybersecurity of virtual environments, including the following recommendations for securing hypervisors:

1. Timely installation of vendor updates for hypervisors;
   
2. Restricting administrative access to hypervisor control interfaces with cryptographic protection of data channels in a dedicated network segment;
   
3. Time synchronisation in the virtual infrastructure with a trusted source;
   
4. Disconnecting unused physical hardware from host systems, including drives and network adapters;
   
5. Disabling clipboard services and file copy functionality between guest systems and the host OS;
   
6. Utilising hypervisor-level security monitoring of guest OSes to improve the reliability of the data received;
   
7. Use of systems for monitoring the activity of data exchange between guest OSes by analogy with the control of network flows between subnets in the physical infrastructure;
   
8. Monitoring the security of the hypervisor itself using integrity control and log analysis tools.

To ensure the security of guest OSes, NIST SP 800-125 suggests that the following measures be implemented:

1. Implementing security measures recommended for conventional physical systems (access control, auditing, connection control, etc.);
   
2. Installing guest OS updates in a timely manner;
   
3. Ensuring that virtual discs are backed up in accordance with the backup regulations for physical systems;
   
4. Disconnecting unused virtual devices from host systems, including drives and network adapters;
   
5. Using separate accounts for each guest OS;
   
6. Controlling the matching of guest OS virtual devices to physical devices at the host system level.

The authors of NIST SP 800-125 recommend following the following steps when configuring and cybersecuring a virtual infrastructure:

1. Initialisation: identifying the need to virtualise the existing infrastructure, describing a model of the future virtual environment, creating a high-level strategy for implementing virtualisation systems, developing a policy for the use of virtualisation tools, identifying target platforms and applications to move to virtualisation, and describing the functional and business requirements for the virtualisation solution.
   
2. Planning and development: defining the technical requirements and characteristics of the virtualisation solution and related components, including authentication and cryptographic protection methods, and subsequent procurement of the solution.
   
3. Implementation: configuring the hardware to meet operational and IS requirements, installing and testing the prototype, and putting it into productive use. This stage also includes reconfiguration of information security tools and connection of new IS systems to control the virtual infrastructure being created.
   
4. Operation and support: performing cyber security tasks in the virtual infrastructure, including auditing logs, detecting cyber attacks, and responding to cyber incidents.
   
5. Decommissioning: when abandoning and decommissioning a virtualisation system, you should be concerned about retaining information from the system, cleaning up drives, and properly disposing of hardware and systems.

In addition to NIST SP 800-125, NIST SP 800-125A, Security Recommendations for Server-based Hypervisor Platforms, has been released, which describes basic hypervisor security features:

1. Isolating virtual machine processes using hypervisor hardware features, restricting and controlling direct virtual machine access to hardware components;
   
2. Controlling access to hardware devices using emulation, paravirtualisation, device forwarding or using virtualisable hardware components;
   
3. Execution of some commands (called hypercalls) from guest OSes directly by the hypervisor itself (only applicable to hypervisors with paravirtualisation);
   
4. Virtual machine lifecycle management, including virtual machine image creation and management, virtual machine state control (start, pause, stop), virtual machine migration and monitoring, administrator access management, and IS policy enforcement;
   
5. Hypervisor platform management: configuring the hypervisor itself and virtualisation software, including installing virtual machines on the hypervisor, creating and maintaining hypervisor clusters, and managing virtual networking on the hypervisor.

In addition to NIST Publication SP 800-125, NIST SP 800-125B, Secure Virtual Network Configuration for Virtual Machine (VM) Protection, was also released, which describes the following network security practices as they apply to virtual infrastructures:

1. Network segmentation: isolating virtual hosts, using virtual switches and firewalls, using VLANs (virtual LANs), using overlay virtual networks to increase scalability and flexibility;
   
2. Providing network redundancy by creating a group of network adapters on a virtualised host;
   
3. Traffic control using firewalls: using physical firewalls, virtual firewalls at the subnet level, virtual firewalls at the hypervisor kernel level;
   
4. Virtual network monitoring to ensure cybersecurity of the virtual infrastructure, using virtual network adapters with traffic mirroring or virtual switches to send traffic to a dedicated port for monitoring.