Virtualization, NV, SDN and NFV Security

What it is

Virtualization lets one physical machine run many isolated virtual machines (VMs), each with its own operating system. A hypervisor is the software layer that creates the VMs and shares the hardware between them.

Network virtualization (NV), software defined networking (SDN) and network function virtualization (NFV) apply the same idea to the network. A defender needs to know what each one separates, because the separation point is also the place an attacker will try to cross.

How it works

Virtualization essentials

Type 1 hypervisors are the usual choice in data centers because they generally offer a smaller attack surface and better performance.

Virtualization risks to know:

• VM escape: code in a guest breaks out to the hypervisor or to other guests.
• Hyperjacking: an attacker installs a rogue hypervisor beneath the real operating system.
• VM sprawl: unmanaged VMs that are never patched or retired.
• Snapshot and image exposure: a copy of a VM holds data and credentials, so stolen copies leak them.
• Shared resources: a noisy or malicious guest can starve others, and the management interface becomes a high value target.

Basic defenses are to patch the hypervisor, keep the management network separate and protected by multi-factor authentication, harden guests, restrict who can create or copy VMs, and encrypt VM files.

Network virtualization (NV) security

NV builds logical networks in software on top of shared physical networks. Common building blocks are VLANs, virtual switches, overlays such as VXLAN (which carries Layer 2 frames inside UDP, using a 24 bit segment ID so about 16 million segments are possible), and virtual firewalls.

Security value comes from microsegmentation: placing policy around each workload so that a compromised VM cannot freely reach its neighbors. Traffic that stays inside one host never crosses a physical firewall, so the defender needs virtual firewalls or hypervisor based inspection to see it.

NV security measures:

• Isolate tenants and workloads in separate virtual networks.
• Apply deny by default policy between segments.
• Secure the virtual switch and restrict promiscuous mode.
• Monitor east-west (VM to VM) traffic, not only traffic leaving the data center.

Software defined networking (SDN) security

SDN separates the control plane (decisions) from the data plane (forwarding). A central controller programs the switches.

Because one controller steers the whole network, it is the main target. Threats include compromise of the controller, attacks on its APIs, spoofed or tampered flow rules, denial of service against the controller, and flow table overflow on switches.

Controls: authenticate and encrypt (TLS) the controller to switch channel, use role based access on the northbound API, run redundant controllers, validate flow rules, rate limit new flows, and log every configuration change.

Network function virtualization (NFV) security

NFV replaces dedicated hardware appliances (firewall, load balancer, router, IDS) with software virtual network functions (VNFs) that run on standard servers. The ETSI NFV architecture has three parts.

NFV threats are VNF image tampering, a vulnerable hypervisor, weak isolation between VNFs from different vendors, and an attacked MANO system that controls everything. Controls are signed and verified VNF images, hardened NFVI, strong authentication for MANO, isolation between VNFs, and monitoring of VNF behavior.

A worked example

A company moves its web, application and database tiers onto one virtualization host. All three VMs sit on the same virtual switch, and the database VM can talk to the web VM directly.

A physical firewall never sees this traffic. The fix is microsegmentation with a virtual firewall or distributed policy, so only the application tier can reach the database tier, and the hypervisor management interface sits on a separate protected network.

How the exam asks about this

• "Which hypervisor runs directly on the hardware?" → A Type 1 (bare metal) hypervisor.
• "In SDN, which API connects the controller to the switches?" → The southbound API (for example OpenFlow).
• "Which component of NFV manages and orchestrates VNFs?" → MANO.