Mitigation-page

MID-021: VM Hardening

Mitigation Tier: Foundational

Description

Virtual Machines (VMs) provide programs with execution environments that are separated from the rest of the system, providing useful security properties (seen in MID-022 - Segmentation Through Hardware-assisted VMs). To help ensure that those guarantees are maintained, the hypervisor’s attack surface accessible from within a VM should be minimized.

VM platforms often offer a variety of virtual hardware devices and APIs to access other hypervisor-provided resources and services to ease tasks like sharing data into and out of a VM. A threat actor that has thoroughly compromised the operating systems resident in a guest VM can access these interfaces and attempt to exploit any vulnerabilities to escalate once again into the hypervisor’s privilege level. Restricting virtual hardware and hypervisor service access to the minimum required by each guest VM reduces the likelihood of a compromise spreading from laterally to other VMs or into the hypervisor.

IEC 62443 4-2 Mappings

  • CR 7.7 – Least functionality

References

[1] vmware. “VMware Infrastructure 3 Security Hardening.” vmware.com. Accessed: Aug. 28, 2024. [Online.] Available: https://www.vmware.com/pdf/vi3_security_hardening_wp.pdf

[2] M. Jha. “Hardening Virtual Machine Security.” vstellar.com. Accessed: Aug. 28, 2024. [Online.] Available: https://vstellar.com/2017/12/hardening-virtual-machine-security/

[3] RedHat. “Chapter 4. sVirt.” redhat.com. Accessed: Aug. 28, 2024. [Online.] Available: https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/7/html/virtualization_security_guide/chap-virtualization_security_guide-svirt