We previously talked about using
Virtual Machines or VMs for testing.
Now we’re going to go through using VMs
for creating separate security domains
and forcing isolation
and compartmentalization with them.
VMs are a kindof sandbox
and are an excellent tool
for implementing isolation
and compartmentalization
to reduce risk,
impact and to control an attacker.
They’re also a great tool for establishing isolation
and compartmentalization for aliases,
as discussed in the section on Op Sec.
You must have some sort of isolation
and compartmentalization for aliases,
whether that be virtual for a virtual machine
or physical.
Virtualization provides security
because it reduces the interfaces
between the security domains
while allowing security domains
to exist and communicate
through those interfaces.
Security domains that just exist in isolation
have limited use
as they have nothing that they can communicate with.
They do have their purpose,
but it’s a limited use case.
So we use virtualization
because it reduces those
interfaces between the security domains
while still allowing the domains to exist
and communicate through those interfaces.
Hopefully, you set up the test environment,
have been going through the course and
testing various things out.
So you should now be familiar with VMware
and/or VirtualBox,
these are the Type 2, hosted hypervisors.
The hypervisor is installed
on the operating system that you have.
The main Type 2 hosted hypervisors are
VirtualBox, as we’ve mentioned.
There’s a VMware player and the workstation.
VMware also has something called VMware Fusion,
which is for Mac.
There’s something called Parallels desktop
which is for Mac.
There’s also Vagrant, VPC,
and Citrix desktop player,
which is for Windows and Mac.
I recommend VirtualBox for security,
privacy and anonymity, as it’s free.
So there is no money trail
if non-attribution is important to you.
Also, VirtualBox has snapshots.
VMware doesn’t have snapshots
on the free version.
Snapshots are a useful security feature
to return back to a known good state.
Snapshots enable you to make a permanent backup
of the entire virtual machine
and then restore back to that virtual machine.
So it’s a useful feature for security
to return back to a known good state, as I said.
So that’s the Type 2 hypervisors
which you should be reasonably familiar with,
with your use of VirtualBox or VMware.
Now there’s the Type 1 native hypervisors,
also called bare metal hypervisors.
There is no host operating system.
In fact, the hypervisor is really
the host operating system.
Common Type 1 native bare metal hypervisors
include VMware, ESX and ESXi.
There’s also Oracle VM Server,
Microsoft’s got its HyperV product,
and there’s also the free and open sources XenServer.
Type 1 hypervisors have the advantage of being faster
and probably more secure,
as there is a reduced attack surface.
There’s no operating system that their sat on
that can be attacked.
You might set up a
Type 1 hypervisor on a server on your network,
or remotely in the cloud to escape
an adversary’s sphere of influence
that host virtual machines for you.
I like using XenServer which is free.
I have a XenServer on my local network
which hosts many of my virtual machines,
and you can install XenServer
just like any other operating system.
You can even install XenServer
in a VirtualBox if you want to
play around with it and see how it works.
Simply download the ISO
and install it like any other operating system.
And that’s what the interface looks like.
It’s very similar to VirtualBox and VMware.
It’s just dedicated on its own server.
Other than Type 1 and Ty pe 2,
there’re also hybrid
hypervisors that effectively
convert the host operating system to a Type 1 hypervisor.
That might also be of interest to you
because you can use it for security,
for isolation
and compartmentalization.
First is KVM or Kernel Virtual Machine.
It’s an open source, fast,
GPL-licensed hypervisor that
comes with GNU Linux OS.
And other than VirtualBox and Xen,
I can also recommend this
as a virtual machine for Linux.
But do make sure you use it
with Virtual Machine Manager,
which is a front-end GUI for KVM,
making it simpler and easier to use.
And that looks like this and as you can see, it’s
pretty similar to VMware and VirtualBox.
And then when you want to see the settings for the virtual machines,
again it’s pretty similar to VMware and VirtualBox.
You can see all your various options
for setting up the virtual machine.
If you’re considering using KVM,
here’s a guide for Debian Jessie,
you can see it’s not too difficult.
The packages are available in the repository.
Simply install them and give it a try.
It works with Whonix,
which is a security-based operating system
we’re going to talk about shortly. So if you want to use Whonix,
you might well be using it with KVM
if you’re using Linux. But as I said,
we’ll discuss that shortly.
There are quite a few Linux VMs.
KVM probably is the main one
as it does come with GNU Linux OS,
but a couple of others worth a mention
is OpenVZ which is a container based virtualization,
and also Linux Containers
which, as the name suggests, is another container-based
virtualization application.
FreeBSD uses a mechanism they call jails,
which are independent environments
implemented via operating system-level virtualization,
wherein each jail is a virtual environment with its own files,
processors, and user accounts
and bound to a different IP address.
And each jail is completely sealed off from the other.
If you use FreeBSD, you will be aware of it already, I’m sure.
This works very effectively as an isolation and compartmentalization security control.
Anyone familiar with Oracle Solaris will know that there’s a similar concept
which they refer to as Zones.
I’ve worked with those at some banks,
but Solaris is not a very used operating system at the moment.
Finally, there is Docker which is quite the buzzword at the moment.
To explain what Docker is, let me show you this diagram.
If you think about VM hypervisors such as HyperV,
KVM and Xen,
they’re all based on emulating virtual hardware.
That means they’re heavy, relatively,
in terms of system resources.
Docker containers, however, use shared operating systems.
That means they are much more efficient
than hypervisors in system resourced terms.
Instead of virtualizing hardware, containers rest on top
of a single Linux instance,
meaning you have a small capsule containing your applications.
Docker’s becoming very popular for businesses because of this.
It enables virtualization with lower system requirements.
So Docker’s another option for isolation, but it is mostly implemented server side.
Solaris’ Zones works very similar to this.
You can also get what is called a Virtual Appliance.
Here are examples from TurnKey Linux,
a service I use and highly recommend.
They integrate with Amazon web services and you can deploy
virtual servers in, literally, seconds.
So let me give you an example.
Maybe you want to run a VPN server, an open VPN server in the cloud
via Amazon web services.
With a pre-configured virtual application,
the time and skill to do it is vastly reduced.
You’re able to select the virtual appliancethat you want to use,
in this case OpenVPN,
and quickly and easily deploy a full virtual server
with operating system and OpenVPN
within minutes based on this virtual appliances configuration.
Or maybe you want a domain controller to authenticate local network users.
You can take this and install it on VirtualBox or a dedicated XenServer
you’ve got a local domain controller that’s already set up and configured.
You’ll obviously need to configure it a little bit for your environment,
but it’s there, pre-made.
You do of course have to trust
TurnKey that they’re not backdoored it in some way,
but in the same light, we have to trust all operating systems
and applications, as well as virtual appliances.
We’ll talk more on TurnKey Linux later in other sections.
This is Wikipedia’s page comparing all the platform virtualization software
and there is loads of them,
as you can see here.
So that’s a useful link to see what’s out there.
What I’ve covered is what I see as the best,
but there are many, many alternatives.
Moving away from dedicated virtual machines,
it’s inevitable that operating systems will move to using virtualization
as part of its core security.
Windows 10 has made that move already.
Windows 10 Device Guard uses hardware technology and virtualization
to isolate the decision-making functions
from the rest of the operating system,
which helps provide protection from attackers
or malware that have managed to gain admin rights.
Type 1 hypervisor technology that is used to run virtual machines
in Microsoft HyperV is used to isolate
core Windows services into a virtualization-based
protected container.
These hardware-protected containers are guarded by the IOMMU
and other mechanisms within the CPU.
So you can see that Windows 10
has taken quite a leap into security through isolation
compartmentalization by implementing
this Windows 10 Device Guard.
This will make Windows 10 harder to compromise.
And I talk more on Device Guard in its own section,
but it’s obviously worth mentioning in this section on virtual machines
as that is where operating systems core security functionality,
I believe, is moving towards.