-: So, now that I scared you with all of the threats
that exist against virtual machines,
let's talk about how we can best secure them.
Most of the things that we need to do
to secure a virtual machine are very similar
to things we need to do to secure a regular
physical server too.
This includes things like updating your operating system
in your applications.
Also, you need to ensure that each virtual machine
has a good antivirus solution installed,
with its own software firewall, good strong passwords
and good policies, and all of the other security features
that we're going to discuss throughout this course.
For this lesson, let's focus specifically
on how to secure virtual machines though.
First, remember that the hypervisor, whether it's a type one,
type two, or application containerization based model,
needs to be updated and secured
whenever the manufacturer releases a new security patch.
For example, if an exploit has been discovered, then you can
now conduct a VM escape against VMware,
you can be certain that a company like VMware is going to
quickly release a patch to fix this critical vulnerability.
Next, you want to ensure that you limit the type of connections
that is existing between the virtual machine
and the physical machine.
This can be represented by a virtualized network card,
or even as network shares,
as I'm going to demonstrate in the next lesson.
Remember, if a virtual machine gets infected with malware,
it should remain isolated from all the other virtual machines
hosted by the same hypervisor,
but only if you implement your configurations
for isolation correctly.
Just like a physical server, anytime there is a connection
between a virtual machine and a shared resource,
something like a network file server,
this is an opportunity for data to be passed between
the different virtual machines,
and this would break down the isolation
that you may be achieving.
Just like we discussed back in handling our operating
systems, we want to minimize and remove any features that
are not needed to support our operations.
When dealing with a virtual machine,
remember that hardware is emulated and it can be removed
just like a piece of software would be under a normal machine.
If you don't your virtual machine to have an emulated floppy
disk or CD drive, for example,
you can simply remove those features.
This, in turn, will minimize your text surface
and remove potential vulnerabilities.
All of your virtual machines are hosted on physical
computers or servers.
And so, if you have many virtual machine residing
on a same physical server,
and an attack is able to compromise
one of those virtual machines,
they may be able to force it to use a large amount of
physical server resources.
If they do, this can affect the other virtual machines hosted
on that same server.
In fact, this could result in a denial of servers for one or more
of the virtual machines being hosted.
To minimize this threat, you should consider spreading out
your virtual machines among several physical servers,
instead of relying on one single physical server to host
every single virtual machine.
As a system administrator,
it's also important to keep track of your virtual machines
and where they are being deployed.
Each virtual machine represents a full operating system
and therefore, you have to ensure you're doing proper
patch management
to make sure all of these virtual machines stay up-to-date.
Additionally, it becomes common for Virtualization Sprawl
to occur within an organization.
Virtualization Sprawl refers to when virtual machines are
created, used, and deployed without proper oversight
governance or management by the system administrators.
Because virtual machines only exist
as a file on some server,
it's really easy to lose track of them.
And you'll not remember where you virtually
deployed them all.
And when it comes time to update them or retire them,
you sometimes just lose track.
Finally, it's important to enable encryption of the file that
hosts the virtual machines as well.
In the next lesson, I'm going to demonstrate how easy it is
to encrypt your virtual machine files to keep them safe
from prying eyes on the server.
This will make sure that when you're deploying them
and using them in your network,
everything remains safe and confidential.