-: The newest type of virtualization
that's becoming popular in our networks
is known as container based virtualization
also known as containerization.
This type of virtualization is much more focused
on servers instead of the end user, though.
With this type of virtualization,
the operating system kernel is shared across
multiple virtual machines, but the user space
for each virtual machine is uniquely created
and managed.
Containerization is a type of virtualization
that's applied by a host operating system to provision
an isolated execution environment for an application.
Containerization is considered fairly secure
because it enforces resource segmentation
and separation at the operating system level.
Now containerization is commonly used
with Linux servers and some examples
of this container based virtualization
include things like, Docker, Parallels Virtuozzo
and OpenVZ project.
Now, what does containerization really look like?
Well, you have a piece of hardware
and then on top of that hardware, you have a Host OS,
usually Linux, and then you have a container manager.
Something like Kubernetes or Docker or something like that.
Now this container manager is going to be used to create
different containers that contain different applications.
In this case, I have three containers.
I have the first environment, which is based
on the kernel of the host OS, in this example,
a Linux system that's being used.
And so we have container one running Linnux
and it contains some applications there.
Now container two can do the same thing
and container three can do the same thing.
Since all three containers are sharing the same
host operating system files.
This takes a lot less resources
than doing pure virtualization using virtual machines.
Like we talked about with virtualization.
If we instead use individual virtual machines,
each one would need its own copy of an operating system.
And that could be 8 to 10 gigabytes for each one.
But with containers,
we can all share the same operating system.
So containerization uses a lot less storage base
and takes a lot less processing power.
This is the real benefit of using something like a container
from an operational perspective.
Now, because these containers are logically isolated.
They can't actually interface with each other.
If I wanted to have two containers talk,
I actually have to connect them through a virtual network
and do the right routing and switching
to allow them to talk.
By default, they have no way of talking to each other
and this is a great thing from a security standpoint
because we have this segmentation.
Now, here's your big warning when it comes to dealing
with containers.
If an attacker compromises the host OS underneath
for example, that Linux operating system
I was just discussing, guess what's happening?
Well, this attack now has access to all of the containers
in their data, because that one operating system
is used by all of the containers being hosted.
This is one of the biggest vulnerabilities
when you use containers.
I can have a container system that's running
50 different servers right now.
And each of these is running different servers
and services using containerization.
But if somebody is able to get to that one server
underneath that Linux operating system, they now have access
to all 50 of those hosted servers and all of their data.
Another risk to consider is how your containers
and other virtual machines are actually going to be hosted.
Once we begin to rely on virtualization and cloud computing,
it becomes very important to recognize
that our data might be hosted on the same physical server
as another organization's data.
By doing so, we introduce some vulnerabilities
into the security of our systems.
First, if the physical server crashes due to something
one of the other organizations is doing
it can actually affect all
of the organizations on that same server.
Similarly, if one organization is not maintaining
the security of their virtual environments,
they're being hosted on that physical server,
there is a possibility that an attacker can utilize
that to the detriment of all the other organizations
hosted on that same server.
Just as there are concerns when interconnecting our networks
with somebody else's, there's also concerns
with hosting multiple organizations' data
on the same physical server.
It's important for us to properly configure, manage
and audit user access to the virtual machines
that are being hosted on those servers.
Also, we want to make sure we ensure that our virtual machines
have the latest patches, antivirus, animwire
and access control in place.
In order to minimize the risk
of having the physical servers resources being overwhelmed,
it's always a good idea to set up our virtual machines
with proper failover, redundancy and elasticity.
By monitoring network performance
and the physical servers resources,
we should be able to balance the load across
several physical machines instead of relying
on just a single one.
Another vulnerability that might be exploited
by an attacker is when we use the same type
of hypervisor across all of our virtual machines.
So for example, if our organization relies solely
on VMware's ESXi hypervisor
and a new exploit is created for that hypervisor,
well an attacker could use that against all of our systems.
So, if it's successful on one of our servers
they're likely going to try it on the rest of our servers.
And if all of our servers use that same platform
in this case, VMware's ESXi, this vulnerability
could be exploited across our entire organization.
The challenge with this though, is that again
if we utilize multiple hypervisor platforms
our support costs and our training requirements
are also going to increase.
Most organizations for this reason do choose to use
a single platform, but at least they're making
a measured risk decision when they do that.
To mitigate that risk, the organization should utilize
proper configurations, ensure the hypervisor
always remains patched and up to date
and only accessible through a secure management interface,
as well as, tightly controlling access control.
Now, these are some of the things you must consider
when you start faring out if you're going to virtualize
your systems and migrate them to an on-premise
or cloud-based solution.
First, are you going to virtualize?
If so, are you going to use traditional virtual machines
or are you going to use containerization?
What is the risk versus reward here?
There's a balancing act that you have to do.
It's a business decision
and it's also a cyber security decision.
And so you're going to have to measure these things
and decide what is best to select for your organization
and its particular use cases.