Virtualization is the process of creating a virtual, representation of an entity, such as virtual applications, servers, storage and networks. It is the single most effective way to reduce Technology expenses by reducing hardware footprint while boosting efficiency and agility for all size businesses. However, good as it is, virtualization can create a single point of failure if poor implementation introduces a security flaw to the system. In this post, I will be taking you on a journey into auditing virtualization.
Objective
This virtualization audit is designed to review critical controls that protect the confidentiality, integrity, or availability (CIA) of the environment.
Scope
Management of the Hypervisor virtual environment
so let’s begin…..
Request for and document the architecture of the virtualization environment. This should include the hardware and supporting network infrastructure.
The team responsible for managing virtualization should maintain documentation illustrating the virtualization architecture and how it interfaces with the rest of the environment. Documentation should include supported systems, management systems, and the connecting network infrastructure. This information will be used by the auditor to help interpret the results of subsequent audit steps.
a) Discuss and review existing documentation with the administrator.
b) Verify that document structure and management are aligned with corporate standards.
c) Physically verify the entire environment including management, storage, and network components to ensure they are properly documented.
Obtain the software version of the hypervisor and compare with policy requirements.
Review the software version to ensure that the hypervisor is in compliance with policy. Note that older software may have reliability, performance, or security issues that can increase the difficulty in managing the virtualization platform(s). Additionally, different software versions may increase the scope of the administrator’s responsibilities as he or she attempts to maintain control over the different hypervisors and their feature, control, and administration differences.
a) Work with the administrator to obtain this information from the system and review vendor documentation.
b) Ensure that the software is a version the vendor continues to support and does not contain widely known and patchable vulnerabilities that would bypass existing controls.
c) Also verify that the currently running version does not contain performance or reliability issues that would affect your environment. d) Review any mitigating factors with the administrator, such as issues that have not been fixed but are not applicable to the environment.
Verify that policies and procedures are in place to identify when patches are available and to evaluate and apply applicable patches.
Most virtualization vendors have regularly scheduled patch releases. The virtualization administrator should be prepared for the scheduled releases so that he/she can plan appropriately for testing and installation of the patches. If all the patches are not installed, widely known security vulnerabilities or critical performance issues could exist.
a) Interview the administrator to determine who reviews advisories from vendors, including timely notifications about new vulnerabilities and zero-day attacks.
b) Request for steps taken to prepare for the patches, and how the patches are tested before being applied to the production systems.
c) Request for documentation of previous patching cycle id any.
d) Obtain as much information as possible about the latest patches through conversations with the administrator and review of vendor documentation and determine the scope of the vulnerabilities addressed by the patches.
e) Compare the available patches with the patches applied to the hypervisor.
f) Talk with the administrator about steps taken to mitigate potential risk if the patches are not applied in a timely manner.
Determine what services and features are enabled on the system and validate their necessity with the system administrator.
Unnecessary services and features increase risk exposure to misconfigurations, vulnerabilities, and performance issues.
a) Work closely with the virtualization administrator to discuss enabled services and their applicability to the environment.
b) Review and evaluate procedures for assessing vulnerabilities associated with necessary services and features and keeping them properly configured and patched.
Review and evaluate procedures for creating administrative accounts and ensuring that accounts are created only when a legitimate business need has been identified.
Effective controls should govern account creation and deletion. Inappropriate or lacking controls could result in unnecessary access to system resources, placing the integrity and availability of sensitive data at risk.
a) Interview the system administrator, and review account-creation procedures. This process should include some form of verification that the user has a legitimate need for access.
b) Take a sample of accounts and review evidence that they were approved properly prior to being created. Alternatively, take a sample of accounts and validate their legitimacy by investigating and understanding the job function of the account owners.
c) Review the process for removing accounts when access is no longer needed. Human resources department is required to play a key role in providing information on terminations and job changes.
d) Ascertain that a process is in place to include a periodic review and validation of active accounts by the system administrator and/or other knowledgeable managers.
e) Obtain a sample of accounts and verify that they are owned by active employees and that each employee has a legitimate business requirement for administrative access.
Ensure appropriate management of provisioning and de-provisioning of new virtual machines are in place. This should also include appropriate operating system and application licenses.
Written policies should govern the process used to create new virtual machines, manage users, and allocate software licenses. The ease of spinning up new servers for development and testing has created a new challenge for managing hardware and license resources.
Policies or procedures should also exist for “cleaning up” or removing virtual machines, rights, and licenses that are no longer needed when a project is completed. Failure to manage virtual host allocation could unnecessarily expend virtualization capacity and software licenses.
Virtual machines should be accountable to specific groups or users. Failure to govern rights management may allow users that should no longer have access to hosts to maintain inappropriate levels of access.
a) Discuss policies and procedures for provisioning and de-provisioning new hosts and accounts with the virtualization administrator, including license allocation, user management, and host ownership.
b) Obtain the tools used to manage this process.
Note: Several tools help manage this process, particularly in development environments where server sprawl tends to become a problem. An example is VMware’s Lab Manager which allows the provisioning administrator to set time limits for how long a virtual machine can be active. Lab Manager provides a control that protects the virtualization resources from becoming overrun with virtual machines that consume resources from the virtual hosts that really need those resources.
Evaluate how hardware capacity is managed for the virtualized environment to support existing and future business requirements.
Business and technical requirements for virtualization can change quickly and frequently, driven by changes in infrastructure, business relationships, customer needs, and regulatory requirements. The virtualization hardware and infrastructure must be managed to support existing business needs and immediate anticipated growth. Inadequate infrastructure places the business at risk and may impede critical business functions that need more hardware capacity.
a) Virtual machine capacity is managed by the hypervisor to allocate a specific amount of storage, processor, and memory to each host. Verify that capacity requirements have been documented and that customers have agreed to abide by them.
b) Capacity allocation may directly affect performance. Review processes for monitoring capacity usage for storage, memory, and processing, noting when they exceed defined thresholds.
c) Evaluate processes in place for responding and taking action when capacity usage exceeds customer-approved thresholds.
d) Discuss the methods used to determine present virtualization requirements and anticipated growth.
e) Review growth plans with the administrator to verify that the hardware can meet the performance requirements, capacity requirements, and feature requirements to support infrastructure and business growth
Evaluate how performance is managed and monitored for the virtualization environment to support existing and anticipated business requirements.
Virtualization performance of the infrastructure as a whole and for each virtual machine is driven by several factors, including the physical virtualization media, network, data size, CPU, memory, storage architecture, and a host of other factors. Inadequate virtualization infrastructure places the business at risk of losing access to critical business applications. It’s possible to have adequate capacity but incorrectly configured and under-performing virtual machines.
a) Verify that regular periodic performance reviews of the processor, memory, and bandwidth loads on the virtualization architecture are performed to identify growing stresses on the architecture. A common performance measurement for virtual environments is based on Input/Output Operations Per Second (IOPS).
b) Verify that performance requirements have been documented and that customers have agreed to abide by them.
c) Review processes for monitoring performance and noting when performance falls below defined thresholds.
d) Evaluate processes in place for responding and taking action when performance falls below customer-agreed thresholds. Discuss the methods used to determine present performance requirements and anticipated changes.
NOTE: A review of capacity management and performance planning is essential to this audit. Be careful to ensure that the administrator has a capacity management plan in place and verifies that performance needs are appropriate for the organization.
Evaluate the policies, processes, and controls for data backup frequency, handling, and offsite management.
Processes and controls should meet policy requirements, support Business Continuity/Disaster Recovery (BC/DR) objectives and protect sensitive information. Data backups present monumental challenges for organizations, particularly when it comes to the central data repositories in the organization, namely the databases and virtualization platforms. Vendors offer several solutions to manage the frequency, handling, and offsite delivery of data and system backups. The implemented solution should be appropriate to meet the stated goals of the BC/DR plans.
a) Review policy requirements for meeting Recovery Point Objectives (RPOs), which affect how much data might be lost from a disaster, and Recovery Time Objectives (RTOs), which affect how long it will take to restore data after a disaster occurs.
b) Discuss the relative priority to other systems based on business criticality and dependencies.
c) Request for how backups are made and the location where they are stored.
Review and evaluate the security of your remote hypervisor management.
Secure remote hypervisor management protects the hypervisor from remote attacks that might otherwise disrupt the hypervisor or hosted virtual machines. Each of the hypervisors has its own management tools designed to allow remote administration of the hypervisor and virtual machines. Many of these commercial tools can manage other commercial hypervisors in an effort to manage heterogeneous virtual environments seamlessly. Despite their obvious differences, the areas that should be reviewed have some commonalities.
Unused services, accessible APIs, and installed applications may subject the hypervisor to additional attack vectors if a security flaw is discovered. In addition, remote users should be forced to access the system using accounts that can be tied to a specific user for logging and tracking. Unless specifically required and appropriately controlled, network-accessible features should not be enabled. Enable only those components that are necessary and appropriately configured for remote management.
a) Each vendor provides specific security guides for enabling remote management. These security guides are generally easy to read and should be reviewed in detail prior to beginning the audit. The execution of this step consists of a policy review, account permissions review, and a configuration review.
b) Review remote access policies and access methods with the administrator. Verify that all remote access is logged to a system separate from the environment. Question the need for any clear-text communications used for remote access. Identify and validate the appropriateness of administrative accounts that have remote access.
c) Ultimately confirm if the virtualization administrator utilizes a Jump server(Secure Admin Workstation) to perform his administrative task. A jump server is the only system that should be allowed access to the virtualization management server console. It is an isolated system fully secured and performs no other task than to serve as a connection proxy to the virtualization management server console. This allows the administrator to remain secure when Virtual management is concerned.
NOTE: The use of secure protocols is particularly important in a DMZ and other high-risk environments. It is also advisable to use secure protocols for management on internal networks to minimize internal attacks.
Download this Article
[hubspot type=form portal=8577853 id=7196a984-f10a-4711-ba7a-8e2169bebe6e]
