Secure design principles

While virtualisation aims to provide separation between virtual instances, this protection is not perfect. There have been virtual machine escape vulnerabilities which allow one virtual instance to interact with another or the underlying virtualisation platform. There have also been examples of vulnerabilities can cause a denial of service on the virtualisation platform, thus impacting all the virtualised instances on the platform.

Given this, it may not be appropriate to host virtual instances with widely differing risk profiles and impacts of compromise on the same virtualisation platform. For example, a virtualised system running a cyber-physical system such as an industrial control process alongside a system connected directly to the internet hosting a web server.

If there is a requirement to share a virtualisation platform in this manner, additional controls will be required to manage the additional risks. An example would be disabling the virtual instance to virtualisation platform communication channels to reduce the attack surface, but this will also disable functionality.

Once you have understood how you will use virtualisation, and the systems that share the virtualisation platform, you can determine the risk and impact of compromise

If virtualisation is being used to host systems of the same risk profile and impact of compromise, you will be able to use the full and rich functionality of the virtualisation platform. This is the case when virtualisation is being used to consolidate resources or improve ease of administration.

This is especially key when building services on top of virtualisation platforms provided by external parties, such as cloud services.

Virtualisation may be present in multiple components in different forms throughout their infrastructure, from compute through to storage and networking. You may not be aware that these components are virtualised, or that you are sharing resources with multiple users.

One example of a resource sharing scenario is Software Defined Networking, often deployed in data centres. To the end user, it appears they have a private network. In fact, they are sharing it with multiple tenants of the same data centre.

Work with your supplier to understand the technology they use and determine if it's appropriate for your system. Use the Supply chain security guidance to inform your discussion and help with your assessment.

Virtualisation can be useful for hosting legacy and obsolete systems. However, if these systems lack security features or have vulnerabilities, this will not be changed by virtualising them. These weaknesses could still be used by an attacker.

Virtualisation of obsolete systems can help to segregate them from the rest of your infrastructure, but a compromised virtual instance could be used to launch an attack against other virtual instances, or the underlying virtualisation platform.