"Addressing the Security Challenges of Virtualization" Webcast: Recording and Q&A
Jack Daniel, Tenable customer Russell Butturini, and I recently presented the "Addressing the Security Challenges of Virtualization" webcast. This was part 2 in the “Vulnerabilities Exposed” webcast series, and there will be 2 more sessions delivered before the end of the year.
If you missed the webcast or would like to re-watch it, view the recording.
Q&A
Here are responses to the top questions we received during the webcast.
Will the slides be available for download?
- Yes, click here to view the presentation slides.
If they access the virtualization layer, can they have access to the SAN as well?
- If an attacker were to gain access to the hypervisor level, they would not necessarily have access to the storage where virtual machines live. However, if an attacker gains access to the storage array, they could make copies of the virtual hard drives and gain access to your data.
Does encrypting your VMDKs (Virtual Machine Disks) make any difference in protecting your data in the event of a VM escape attack?
- VMware does have support for native encryption, and this would help defend against attackers after your data in a virtual environment.
PVS may cover some of the App-V surface, but a scenario where that falls apart is when a malicious PDF is downloaded, and they open the PDF which runs virtual Adobe. Reader is not accessing the Internet at that point. Is there anything on the Nessus roadmap that will allow you to enumerate the idle packages that are waiting to be requested so you can fix the problem upstream? They are just exe/dll's on shares, so auditing the static package would be a big win.
- We are exploring many approaches to enhancing our malicious process and malicious content detection capability, but we do not have any specific commitments on the roadmap at this time.
Do you support Virtual Box, Hyper-V, and XenServer?
- See our Nessus 5.0 and Scanning Virtual Machines document for more information.
- Nessus offers support for Oracle VirtualBox (formerly Sun VirtualBox) in the form of remote checks for any platform and local credentialed plugin checks when installed on Microsoft Windows. Since VirtualBox is included in many OS distributions, Nessus also offers a variety of local credentialed checks specific to Debian, FreeBSD, Gentoo, Mandriva, and SuSE.
- Nessus currently offers remote support for Citrix XenServer, specifically several detection plugins for XenServer and associated services. Tenable plans to add support for local, credentialed checks this year, as well as compliance audits that are currently under development.
- Nessus has support for auditing Microsoft Hyper-V technology. Remotely, via API, Nessus can detect and enumerate virtual machines, as well as use several Microsoft Security Bulletin-based plugins to test for known vulnerabilities.
Which version of VMware vSphere and vCenter are supported?
- Supported versions are ESXi 4.x/5.x and vCenter 4.x/5.x. See here for more details.
In the new NIST Cyber Security Framework (draft), a lot of weight is being given to SANS 20 Critical Security Controls (CSCs). When you talk standards, are these controls incorporated?
- Tenable developed a SANS Top 20 dashboard, and we are always updating our audit policies. Click here for more information on Tenable's support of the SANS 20 CSCs.
What kind of throughput can PVS handle?
- PVS has 1-2Gb/s throughput using standard hardware. We are currently developing 10Gb/s support for PVS.
The virtualization of the hardware and OS is still tangible, and one can still enumerate them as though they were physical devices and OSes by way of IP. How is Nessus approaching a rapidly shrinking/centralizing application footprint with application virtualization (re: App-V, Citrix Apps). The application only exists in memory, and on demand, which makes scanning difficult or impossible at the "end node" virtual or physical.
- PVS can help detect vulnerable applications as they communicate on the network. Beyond that, we are exploring ways to integrate with evolving technologies, such as software-defined networking to get better visibility into dynamic environments, but have no specific features on the roadmap at this time.
Tenable Virtualization Resources
- Blog Post: Scanning and Patch Auditing VMware Using Nessus
- Blog Post: Nessus VMware/vSphere vCenter Audits
- Data Sheet: Security Monitoring for the vSphere Infrastructure
- Documentation: Nessus 5.0 and Scanning Virtual Machines
- Whitepaper: Extending Vulnerability Management to Virtualized Infrastructures and Cloud Computing
- Webcast: Managing Vulnerabilities in Virtualized and Cloud-based Deployments
"Vulnerabilities Exposed" Webcast Part 3 – BYOD/Mobile
The next webcast will be held on October 22nd at 2 pm EDT, and we'll discuss how to handle BYOD/mobile threats before they cause loss and disruption. Hope you can join us.
Related Articles
How A CNAPP Can Take You From Cloud Security Novice To Native In 10 Steps
May 23, 2024Context is critical in cloud security. In a recent RSA presentation, Tenable's Shai Morag offered ten tips for end-to-end cloud infrastructure security.
Logs of Our Fathers
September 22, 2009<p>At USENIX in Anaheim, back in 2005, George Dyson treated us to a fantastic keynote speech about the early history of computing. You can catch a videotaped reprise of it <a href="http://www.ted.com/talks/lang/eng/george_dyson_at_the_birth_of_the_computer.html" target="_blank">here, on the TED site</a>. I highly recommend it - there's lots of interesting and quirky stuff. I managed to talk him into giving me a copy of his powerpoint file, and subsequently tracked him down and am re-posting this material with his permission.</p> <h3>November, 1951 </h3> <p style="TEXT-ALIGN: center"><a href="http://www.ranum.com/security/computer_security/papers/ur-syslogs/first_syslog.jpg" target="_blank"><img border="0" height="375" src="http://www.ranum.com/security/computer_security/papers/ur-syslogs/t/first_syslog.jpg" width="500" /></a> <br /><strong>Machine Log #1</strong></p>
ShmooCon 2009 - Playing Poker for Charity
February 12, 2009Tenable sponsored a booth at this year's ShmooCon and ran a Texas Hold'em table to help raise money for the Hackers for Charity organization. We raised close to $400 from conference attendees ...
Securing Financial Data in the Cloud: How Tenable Can Help
November 4, 2024Preventing data loss, complying with regulations, automating workflows and managing access are four key challenges facing financial institutions. Learn how Tenable can help.
Cybersecurity Snapshot: Apply Zero Trust to Critical Infrastructure’s OT/ICS, CSA Advises, as Five Eyes Spotlight Tech Startups’ Security
November 1, 2024Should critical infrastructure orgs boost OT/ICS systems’ security with zero trust? Absolutely, the CSA says. Meanwhile, the Five Eyes countries offer cyber advice to tech startups. Plus, a survey finds “shadow AI” weakening data governance. And get the latest on MFA methods, CISO trends and Uncle Sam’s AI strategy.
FY 2024 State and Local Cybersecurity Grant Program Adds CISA KEV as a Performance Measure
October 31, 2024The CISA Known Exploited Vulnerabilities (KEV) catalog and enhanced logging guidelines are among the new measurement tools added for the 2024 State and Local Cybersecurity Grant Program.
- Conferences
- Events
- Nessus
- Passive Network Monitoring
- SecurityCenter
- Virtualization
- Vulnerability Management