4.1 - Virtualization Services

Virtualization and Hypervisors

  • Definition of Virtualization

    • Virtualization is the creation of a virtual version of a device or resource, such as an operating system, server, storage device, or network.

  • Role of Hypervisor

    • The hypervisor, or Virtual Machine Manager, is the software that manages interactions between virtual machines (VMs) and the physical system it operates on.

    • It allocates CPU cycles, memory, and networking resources to each VM while keeping these resources isolated from each other.

Types of Hypervisors

  • Type 1 Hypervisor (Bare Metal Hypervisor)

    • Runs directly on the hardware without a host operating system.

    • Examples:

    • VMware's ESXi

    • Microsoft's Hyper-V

  • Type 2 Hypervisor (Hosted Hypervisor)

    • Runs as software on top of an existing operating system.

    • Examples:

    • VMware Workstation

    • Oracle VirtualBox

    • Parallels Desktop

    • The primary operating system manages the hardware and the hypervisor runs alongside it.

Operation of Hypervisors

  • Block Diagram of Hypervisor Architecture

    • Bottom Level: Physical hardware

    • Middle Level: Hypervisor

    • Top Level: Virtual Machines (each with its own guest OS and applications)

  • Resource Allocation

    • VMs require sufficient resources:

    • Enough CPU cycles

    • Enough memory

    • Sufficient storage drive space for complete OS installations and applications.

Virtualization Technology in CPUs

  • Intel Virtualization Technology (VT)

    • A feature in Intel processors designed to increase performance in virtualized environments.

  • AMD Virtualization (AMD-V)

    • A similar technology in AMD processors that facilitates virtual machine operation.

Networking Configurations in Hypervisors

  • Virtual Machine Networking Control

    • Hypervisors can determine the interaction rules for VMs with external devices:

    • Shared Network Address: Hypervisor manages an IP subnet distinct from the physical network and uses network address translation (NAT) for communication outside the hypervisor scope.

    • Bridged Network Address: VMs act as if they are duplicate devices on the local network without needing NAT.

    • Private Network Address: VMs can only communicate with themselves and select other devices, enhancing security.

Security Considerations in Virtualized Environments

  • VM Escape Vulnerability

    • A significant security concern where malware on one VM could exploit flaws in the hypervisor to access data on another VM.

    • Although no major security breaches related to VM escape have been reported, it remains a focus for developers.

  • Security Measures

    • Each VM should be treated as an independent operating system.

    • Traditional security controls apply:

      • Firewalls installed

      • Anti-malware software configured

      • Operating systems hardened similarly to standalone devices.

  • Risks with Downloaded VMs

    • Caution is advised as attackers may embed malware in VMs intended for public use, leading to infections if a user downloads it without scrutiny.

Virtual Desktop Infrastructure (VDI)

  • Concept

    • Virtual Desktop Infrastructure allows desktops to operate as virtual machines hosted on separate devices or cloud environments.

    • Users require minimal local resources (keyboard, mouse, display) because processing occurs remotely.

  • Desktop as a Service (DaaS)

    • A variant of VDI where the service is provided over the cloud, enhancing resource efficiency on local devices.

Application Containerization

  • Definition

    • A method of virtualization that packages applications in separate containers that share a single host operating system, reducing overhead compared to traditional VMs.

  • Characteristics of Application Containers

    • Each application runs in its own isolated environment without interference from other containers, unless explicitly configured.

    • Containers are lightweight, portable, and quickly transferable between devices.

  • Comparison with Virtual Machines

    • Traditional VMs require individual guest OS installations leading to increased overhead.

    • Application containers rely on a single host OS, simplifying management (only one OS needs updating/maintenance).

  • Containerization Software

    • Docker is a popular platform for managing application containers.

    • Each application container is built to run on a specific type of host OS (e.g., Windows, Linux).

  • Limitations

    • Containers generally cannot run under diverse OS environments simultaneously in the same system. Unlike VMs, which can run different OS versions independently.