Seven New Rules to Keep One Hypervisor Hack from Taking Down Everything — Virtualization Review

In-Depth

Seven New Rules to Keep One Hypervisor Hack from Taking Down Everything

Securing every virtual machine won’t save an organization whose attackers take control of the hypervisor underneath them.

That was the central message from Joey D’Antoni, Principal Consultant, DCAC, during “Securing Today’s Virtual Infrastructure: Best Practices, Modern Strategies, New Threats,” the opening session of the Oct. 27 The New Rules of Virtualization Security Summit. It’s being made available for on-demand replay thanks to the sponsor, Rubrik, which also presented at the event..

Before outlining seven rules, D’Antoni described three pressures reshaping virtualization security: migrations driven by VMware licensing changes, attackers targeting the hypervisor and management plane, and hybrid environments with more consoles, identities and patching requirements. Running two platforms during a migration also means maintaining two sets of security controls, sometimes with limited expertise in the replacement platform.

He illustrated the danger with an attack sequence that begins with a help desk credential reset, moves through Active Directory into vCenter, and ends with stolen domain-controller data and encrypted VM files. The point: legitimate administration features can become an…