- [Instructor] Virtualization is taking
data centers by storm.
Between public and private cloud computing,
a significant portion of the world's servers
are now virtualized.
Virtualization technology allows
multiple guest operating systems to run
on a single hardware platform.
This provides tremendous flexibility,
the portability of systems among hardware,
and the cost effective sharing of hardware resources.
Now, let's take a look at the host security issues
that you'll need to tackle in a virtualized environment.
One of the most powerful tools
granted by a virtualization platform
is the ability to quickly and easily snapshot systems.
Since a virtualized system doesn't have any actual hardware,
all it is is a file stored on a disk.
You can make a copy of that file just as you would
any other file and quickly have a copy of the entire system
that you can spin up as a new server.
Let me give that a try.
I'm running the Parallels virtualization platform on my Mac.
As you can see here, I have the guest machine installed
that runs the Ubuntu operating system.
Right now, it's shut down, but I can just click on it
to make it boot up.
I go ahead and type in my password.
And you get placed at the desktop just as if this computer
were right in front of me.
As you see here, I have a full-featured operating system
running inside a window on my Mac.
Ubuntu has no idea that it's inside this environment
on my Mac and I can interact with it just as I would
a normal Ubuntu system.
For example, I can open up Firefox here
and browse the web just as I would on a normal system.
One of the other things I can do is take a snapshot
of the system pretty easily.
I just go up here to the Actions menu
and click Take a Snapshot.
I can give the snapshot a name.
I'll just stick with this default snapshot one.
And Parallels pauses a moment to take a snapshot
of the system.
If now I go up to Actions and click Manage Snapshots,
you can see that there's a snapshot that I've taken.
If I want to, I can go ahead and right-click on this
and create a new linked clone.
This would create a brand new guest operating system
based upon the snapshot that I had already taken.
That's how easy it is
to manage snapshots with virtualization.
Security professionals often use virtualization technology
as a security tool.
First, security professionals often have the need
to experiment with dangerous or untrusted software
to determine the risk that it may pose to the organization.
Sandboxing uses virtualization to do this in an easy manner.
Security professionals can simply create
an isolated virtual machine that has no access
to the network or other resources,
and then use that sandbox to perform their evaluation.
When they're finished, they can simply destroy
the virtual machine without having any impact
on the rest of the network.
They can use this same process for security control testing
without affecting production systems.
For example, if administrators want to evaluate
the effectiveness of a security control,
they can simply snapshot a system
and then perform their testing on that snapshot offline.
They can experiment with different settings,
install security tools, and perform other actions
that might be disruptive on a production server
without having any effect on the real environment.
Once they implement and test the controls
in a sandboxed environment,
they can then either move the sandbox system to production
or replicate the security settings
in the sandbox environment.
Virtualization also makes host elasticity easy.
Elasticity means that a system can expand and contract
as needed to meet changing business requirements.
This can happen on a server or service basis
and elasticity can apply to CPU, memory, and/or storage.
For example, let's shut down my Ubuntu virtual machine.
Now, we can go ahead and take a look
at the configuration settings.
If I want to change the number of CPUs
or the amount of memory available to the system,
I can simply click on Hardware, CPU & Memory,
and just change these settings right here.
Increase of the number of CPUs, add a little bit of memory.
And the next time I start the system, it will get
those resources from the underlying hardware platform.
This makes it easy to move resources between systems
as needs change.
Elasticity can also support different services.
If I have a snapshot of a web server, for example,
I can then use that snapshot to create copies
of the web server and load balance requests among them
to meet rising demand.
When demand shrinks, I can simply kill off
some of those extra servers
and use that capacity for something else.
Virtualization solutions allow more than
just the pooling of CPU and memory resources.
Through virtual storage area networks or virtual SANs,
organizations can pool storage resources as well,
allowing the dynamic allocation and reclamation of storage
by virtual machines as needed.
Security professionals should take care to ensure
that virtual SAN storage pools cover systems
of similar security levels to avoid the accidental
or intentional leakage of information
through reallocated storage.
One last security note on virtualization.
You need to manage the patching of guest operating systems
the same way you do a normal operating system
installed on hardware.
All of the same operating system controls
apply in this environment,
but you also have something new to worry about.
You need to patch the virtualization platform as well.
I'm going to go ahead
and close out of this Ubuntu virtual machine
and return to the Parallels menu.
When I click on Parallels Desktop
and then check for updates,
you can see that there is a patch available for Parallels
that I can also apply.
When you're running a virtualization environment,
you must remember to patch the virtualization platform's
hypervisor just as you would
the operating system and applications.
Virtualization introduces a variety of new security concerns
that administrators must pay attention to
when operating in a virtualized environment.