MTU Library Catalogue

Syndetics cover image
Image from Syndetics

VMware vSphere and virtual infrastructure security : securing the virtual environment / Edward L. Haletky.

By: Haletky, Edward [author.].
Material type: materialTypeLabelBookPublisher: New Jersey : London : Pearson Education ; Prentice Hall, 2009Description: xxx, 521 pages : diagrams, tables ; 23 cm.Content type: text Media type: unmediated Carrier type: volumeISBN: 9780137158003; 0137158009.Subject(s): VMware vSphere | Virtual computer systems -- Security measures | Cloud computing | Computer securityDDC classification: 005.8
Contents:
What is a security threat? -- Holistic view from the bottom up -- Understanding VMware vSphereTM and Virtual Infrastructure Security -- Storage and Security -- Clustering and Security -- Deployment and management -- Operations and Security -- Virtual Machines and Security -- Virtual Networking Security -- Virtual Desktop Security -- Security and VMware ESX -- Digital Forensics and Data Recovery -- Conclusion: Just the beginning: The future of Virtualization Security.

Enhanced descriptions from Syndetics:

Complete Hands-On Help for Securing VMware vSphere and Virtual Infrastructure by Edward Haletky, Author of the Best Selling Book on VMware, VMware ESX Server in the Enterprise

As VMware has become increasingly ubiquitous in the enterprise, IT professionals have become increasingly concerned about securing it. Now, for the first time, leading VMware expert Edward Haletky brings together comprehensive guidance for identifying and mitigating virtualization-related security threats on all VMware platforms, including the new cloud computing platform, vSphere.

This book reflects the same hands-on approach that made Haletky's VMware ESX Server in the Enterprise so popular with working professionals. Haletky doesn't just reveal where you might be vulnerab≤ he tells you exactly what to do and how to reconfigure your infrastructure to address the problem.

VMware vSphere and Virtual Infrastructure Security begins by reviewing basic server vulnerabilities and explaining how security differs on VMware virtual servers and related products. Next, Haletky drills deep into the key components of a VMware installation, identifying both real and theoretical exploits, and introducing effective countermeasures.


Coverage includes

* Viewing virtualization from the attacker's perspective, and understanding the new security problems it can introduce

* Discovering which security threats the vmkernel does (and doesn't) address

* Learning how VMsafe enables third-party security tools to access the vmkernel API

* Understanding the security implications of VMI, paravirtualization, and VMware Tools

* Securing virtualized storage: authentication, disk encryption, virtual storage networks, isolation, and more

* Protecting clustered virtual environments that use VMware High Availability, Dynamic Resource Scheduling, Fault Tolerance, vMotion, and Storage vMotion

* Securing the deployment and management of virtual machines across the network

* Mitigating risks associated with backup, performance management, and other day-to-day operations

* Using multiple security zones and other advanced virtual network techniques

* Securing Virtual Desktop Infrastructure (VDI)

* Auditing virtual infrastructure, and conducting forensic investigations after a possible breach

informit.com/ph www.Astroarch.com

Includes bibliographical references and index.

What is a security threat? -- Holistic view from the bottom up -- Understanding VMware vSphereTM and Virtual Infrastructure Security -- Storage and Security -- Clustering and Security -- Deployment and management -- Operations and Security -- Virtual Machines and Security -- Virtual Networking Security -- Virtual Desktop Security -- Security and VMware ESX -- Digital Forensics and Data Recovery -- Conclusion: Just the beginning: The future of Virtualization Security.

Table of contents provided by Syndetics

  • 1 What Is a Security Threat? (p. 1)
  • The 10,000 Foot View without Virtualization (p. 2)
  • The 10,000 Foot View with Virtualization (p. 4)
  • Applying Virtualization Security (p. 5)
  • Definitions (p. 10)
  • Threat (p. 11)
  • Vulnerability (p. 11)
  • Fault (p. 11)
  • The Beginning of the Journey (p. 12)
  • 2 Holistic View from the Bottom Up (p. 15)
  • Attack Goals (p. 16)
  • Anatomy of an Attack (p. 17)
  • Footprinting Stage (p. 17)
  • Scanning Stage (p. 17)
  • Enumeration Stage (p. 19)
  • Penetration Stage (p. 21)
  • Types of Attack (p. 23)
  • Buffer Overflows (p. 23)
  • Heap Overflows (p. 31)
  • Web-Based Attacks (p. 33)
  • Layer 2 Attacks (p. 41)
  • Layer 3 Nonrouter Attacks (p. 46)
  • DNS Attacks (p. 47)
  • Layer 3 Routing Attacks (p. 49)
  • Man in the Middle Attack (MiTM) (p. 51)
  • Conclusion (p. 57)
  • 3 Understanding VMware vSphere TM and Virtual Infrastructure Security (p. 59)
  • Hypervisor Models (p. 59)
  • Hypervisor Security (p. 60)
  • Secure the Hardware (p. 61)
  • Secure the Management Appliance (p. 62)
  • Secure the Hypervisor (p. 63)
  • Secure the Management Interfaces (p. 81)
  • Secure the Virtual Machine (p. 89)
  • Conclusion (p. 89)
  • 4 Storage and Security (p. 91)
  • Storage Connections within the Virtual Environment (p. 92)
  • Storage Area Networks (SAN) (p. 93)
  • Network Attached Storage (NAS) (p. 95)
  • Internet SCSI (iSCSI) Servers (p. 96)
  • Virtual Storage Appliances (p. 96)
  • Storage Usage within the Virtual Environment (p. 97)
  • VM Datastore (p. 98)
  • Ancillary File Store (p. 98)
  • Backup Store (p. 99)
  • Tape Devices (p. 100)
  • Storage Security (p. 102)
  • Data in Motion (p. 103)
  • Data at Rest (p. 104)
  • Storage Security Issues (p. 104)
  • VCB Proxy Server (p. 104)
  • SCSI reservations (p. 106)
  • Fibre Channel SAN (Regular or NPIV) (p. 108)
  • iSCSI (p. 110)
  • NFS (p. 111)
  • CIFS for Backups (p. 112)
  • Shared File Access over Secure Shell (SSH) or Secure Copy Use (p. 113)
  • FTP/R-Command Usage (p. 115)
  • Extents (p. 115)
  • Conclusion (p. 116)
  • 5 Clustering and Security (p. 117)
  • Types of Clusters (p. 117)
  • Standard Shared Storage (p. 118)
  • RAID Blade (p. 122)
  • VMware Cluster (p. 123)
  • Virtual Machine Clusters (p. 125)
  • Security Concerns (p. 125)
  • Heartbeats (p. 127)
  • Isolation (p. 133)
  • VMware Cluster Protocols (p. 140)
  • VMware Hot Migration Failures (p. 141)
  • Virtual Machine Clusters (p. 142)
  • Management (p. 143)
  • Conclusion (p. 145)
  • 6 Deployment and Management (p. 147)
  • Management and Deployment Data Flow (p. 148)
  • VIC to VC (Including Plug-Ins) (p. 148)
  • VIC to Host (p. 152)
  • VC webAccess (p. 153)
  • ESX(i) webAccess (p. 154)
  • VI SDK to VC (p. 154)
  • VI SDK to Host (p. 156)
  • RCLI to Host (p. 156)
  • RCLI to VC (p. 156)
  • SSH to Host (p. 156)
  • Console Access (p. 157)
  • Lab Manager (p. 157)
  • Site Manager (p. 157)
  • LifeCycle Manager (p. 158)
  • AppSpeed (p. 158)
  • CapacityIQ (p. 158)
  • VMware Update Manager (p. 158)
  • Management and Deployment Authentication (p. 158)
  • Difference Between Authorization and Authentication (p. 159)
  • Mitigating Split-Brain Authorization and Authentication (p. 162)
  • Security of Management and Deployment Network (p. 184)
  • Using SSL (p. 184)
  • Using IPsec (p. 189)
  • Using Tunnels (p. 189)
  • Using Deployment Servers (p. 190)
  • Security Issues during Management and Deployment (p. 191)
  • VIC Plug-ins (p. 192)
  • VMs on the Wrong Network (p. 193)
  • VMs or Networks Created Without Authorization (p. 194)
  • VMs on the Wrong Storage (p. 195)
  • VMs Assigned to Improper Resource Pools (p. 196)
  • Premature Propagation of VMs from Quality Assurance to Production (p. 196)
  • Physical to Virtual (P2V) Crossing Security Zones (p. 196)
  • Conclusion (p. 198)
  • 7 Operations and Security (p. 199)
  • Monitoring Operations (p. 199)
  • Host Monitoring (p. 200)
  • Host Configuration Monitoring (p. 202)
  • Performance Monitoring (p. 203)
  • Virtual Machine Administrator Operations (p. 204)
  • Using the Wrong Interface to Access VMs (p. 204)
  • Using the Built-in VNC to Access the Console (p. 205)
  • Virtual Machine Has Crashed (p. 211)
  • Backup Administrator Operations (p. 211)
  • Service Console Backups (p. 212)
  • Network Backups (p. 213)
  • Direct Storage Access Backups (p. 213)
  • Virtual Infrastructure Administrator Operations (p. 214)
  • Using Tools Across Security Zones (p. 214)
  • Running Commands Across All Hosts (p. 215)
  • Management Roles and Permissions Set Incorrectly (p. 216)
  • Conclusion (p. 217)
  • 8 Virtual Machines and Security (p. 219)
  • The Virtual Machine (p. 219)
  • Secure the Virtual Hardware (p. 220)
  • Secure the Guest OS and Application (p. 239)
  • Secure the Hypervisor Interaction Layer (p. 241)
  • Virtual Machine Administration (p. 252)
  • Virtual Machine Creation (p. 253)
  • Virtual Machine Modification (p. 253)
  • Virtual Machine Deletion (p. 254)
  • Conclusion (p. 254)
  • 9 Virtual Networking Security (p. 255)
  • Virtual Networking Basics (p. 256)
  • Basic Connections (p. 256)
  • 802.1q or VLAN Tagging (p. 268)
  • Security Zones (p. 271)
  • Standard Zones (p. 273)
  • Best Practices (p. 277)
  • Virtualization Host with Single or Dual pNIC (p. 278)
  • Three pNICs (p. 280)
  • Four pNICs (p. 284)
  • Five pNICs (p. 289)
  • Six pNICs (p. 295)
  • Eight pNICs (p. 302)
  • Ten pNICs (p. 304)
  • pNIC Combination Conclusion (p. 304)
  • Cases (p. 305)
  • DMZ on a Private vSwitch (p. 305)
  • Use of Virtual Firewall to Protect the Virtualization Management Network (p. 307)
  • VMware as a Service (p. 307)
  • Tools (p. 310)
  • Intrusion Detection and Prevention (p. 310)
  • Auditing Interfaces (p. 311)
  • Conclusion (p. 314)
  • 10 Virtual Desktop Security (p. 315)
  • What Is VDI? (p. 315)
  • Components (p. 316)
  • VDI Products (p. 317)
  • VDM (p. 318)
  • VDM's Place in the Network (p. 318)
  • The VDM Connection Server (p. 319)
  • The VDM Client (p. 319)
  • The VDM Web Access Client (p. 320)
  • The VDM Agent for Virtual Desktops (p. 321)
  • Security Implications (p. 322)
  • VMware View (p. 324)
  • Linked Clones: What Are They and How Do They Change Security? (p. 324)
  • Storage Overcommit (p. 326)
  • Overview of Linked Clones (p. 326)
  • Protecting the VC (p. 328)
  • Offline Desktops (p. 329)
  • SSL in a VDM or View Environment (p. 333)
  • Secure VDI Implementation (p. 338)
  • Secure the Virtual Desktop (p. 341)
  • Conclusion (p. 342)
  • 11 Security and VMware ESX (p. 343)
  • VMware ESXi Hardening Recipe (p. 345)
  • VMware ESX Hardening Recipe (p. 349)
  • Step 1 Root Password (p. 355)
  • Step 2 Shadow Password (p. 355)
  • Step 3 IPtables Firewall (p. 355)
  • Step 4 Lockdown by Source IP (p. 357)
  • Step 5 Run Security Assessments (p. 360)
  • Step 6 Apply Hardening per Assessments (p. 367)
  • Step 7 Additional Auditing Tools (p. 388)
  • Conclusion (p. 394)
  • 12 Digital Forensics and Data Recovery (p. 397)
  • Data Recovery (p. 398)
  • Data Recovery-Host Unavailable (p. 399)
  • Data Recovery-Corrupt LUN (p. 400)
  • Data Recovery-Re-create LUN (p. 406)
  • Data Recovery-Re-create Disk (p. 407)
  • Digital Forensics (p. 408)
  • Digital Forensics-Acquisition (p. 408)
  • Digital Forensics-Analysis (p. 422)
  • Digital Forensics-Who Did What, When, Where, and How? (p. 426)
  • Conclusion (p. 428)
  • Conclusion: Just the Beginning: The Future of Virtualization Security (p. 431)
  • A Patches to Bastille Tool (p. 435)
  • B Security Hardening Script (p. 441)
  • C Assessment Script Output (p. 465)
  • CIS-CAT Output (p. 465)
  • Bastille-Linux Output (p. 470)
  • DISA STIG Output (p. 475)
  • Tripwire ConfigCheck Output (p. 496)
  • D Suggested Reading and Useful Links (p. 499)
  • Books (p. 499)
  • Whitepapers (p. 500)
  • Products (p. 501)
  • Useful Links (p. 502)
  • Glossary (p. 503)
  • Index (p. 507)

Author notes provided by Syndetics

Edward L. Haletky owns AstroArch Consulting, Inc., which specializes in providing virtualization, security, network consulting and development services. He has attained "virtuoso" status on the VMware Discussion Forums for his work answering security and configuration questions. His first book, VMware ESX Server in the Enterprise, has been a consistent VMware bestseller. He formerly served on HP's Virtualization, Linux, and High-Performance Technical Computing teams.