VMs make it trivial to create a new image so unnecessary images may be created and run with attendant physical and electronic security issues. For example, there is the potential for a proliferation of disk images, which is a condition known as sprawl. The point is that the convenience of VMs contributes to information security risk. It is estimated that 60% of VMs in production might be considered less secure than their physical counterparts as a result of neglecting to use traditional security measures that would likely prevent most attacks on VMs. This situation appears to be supported by available statistics. VMs are known for their ease of use, and extreme convenience might enhance vulnerability since basic precautions that are routinely implemented on physical machines might be neglected. However, information theft does not require the physical removal of anything these days. It is difficult but not impossible to steal a physical server or other substantial hardware resource from a physically secured data center assuming the spectrum of traditional security controls is implemented.

The vulnerability to theft of a physical object from a properly secured data center is likely to be low. There are certainly other vulnerabilities inherent to virtual environments that should be understood by information security personnel. The point is to show how physical security and physical access is relevant to virtualized environments because of the inherent concentration of risk. The focus here will be on VM attack vectors that are facilitated by physical security vulnerabilities or have a physical component.

However, what are the security implications of virtualization?Įxcellent technical reviews of attack vectors targeting virtual technology are available online and are principal sources of information in the following discussion. It is clear that increased efficiency is a by-product of a virtualized environment.

Young, in Information Security Science, 2016 Virtualization and Physical Security Risk

Nirlauncher mirror