 "Full Virtualisation Security Guidelines Released")
In what could be an answer to the virtualisation related security woes of organizations, The National Institute of Standards and Technology (NIST), has come out with the final version of its recommendations for securely configuring and using full computing virtualisation technologies. The security recommendations are contained in the “Guide to Security for Full Virtualisation Technologies”. The draft report was issued for public comment in July 2010. NIST is a U.S. Department of Commerce agency working with industry to develop and apply technology, measurements, and standards.
The guide describes security concerns associated with full virtualisation technologies for server and desktop virtualisation and provides recommendations for addressing these concerns. Most existing recommended security practices also apply in virtual environments and the practices described in this document build on and assume the implementation of practices described in other NIST computer security publications.
“Full virtualisation” provides a complete simulation of underlying computer hardware, enabling software to run without any modification. Because it helps maximize the use and flexibility of computing resources—multiple operating systems can run simultaneously on the same hardware—full virtualisation is considered a key technology for cloud computing, but it introduces new issues for IT security.
For cloud computing systems in particular, full virtualisation can increase operational efficiency because it can optimize computer workloads and adjust the number of servers in use to match demand, thereby conserving energy and information technology resources.
The guide is intended for system administrators, security program managers, security engineers and anyone else involved in designing, deploying or maintaining full virtualisation technologies. The guide’s recommendations for the organisations include:
• Secure all elements of a full virtualisation solution and maintain their security
• Restrict and protect administrator access to the virtualisation solution
• Ensure that the hypervisor, the central program that runs the virtual environment, is properly secured
• Carefully plan the security for a full virtualisation solution before installing, configuring and deploying it
NIST SP 800-125, “Guide to Security for Full Virtualisation Technologies” may be downloaded from .