2.1 Protect virtualised systems as you would non-virtualised systems
A virtualisation platform doesn't inherently protect the virtual instances running on it from compromise. The purpose of the platform is to allow multiple virtual components to run simultaneously and provide separation between them.
You should apply security controls to a virtualised system just as you would non-virtualised systems. This will help prevent compromise of the targeted virtual instance and onward compromise of other virtual instances on the same platform.
2.2 Continually update virtual instances and virtualisation platforms
Virtualising an unpatched system doesn’t reduce the risk of it being compromised. Therefore, updates should be applied to the virtual instance software when they become available.
Virtualisation can be used to streamline your update methodology. For example, a virtual reference system could be run to test updates before being applied to a production system. Also, snapshots could be taken of a system before applying a patch, providing you with the ability to roll back changes if needed.
The design of your system should ensure that each component can be easily updated, use virtualisation features such as automatic failover to provide the flexibility to enable this.
Carefully consider how the virtualisation platform can be updated and maintained without impacting the virtual instances running on it. Updating the underlying platform shouldn't impact operations or users.
An attacker with access to your administration console, or management infrastructure, can control the configuration of your virtualisation platform and all the virtual instances running on it.
Ensure that only a limited number of people, with a specific need, have access to the administration console. Make sure the administration console is sufficiently protected, using controls such as network segregation, strong password policy, multi-factor authentication and role-based access control.
Network accessible administration interfaces should only accept connections from authorised management infrastructure, which is segregated from normal system infrastructure.
2.4 Understand communication channels between virtual instances and the virtual platform
Many virtual platforms provide communication channels between virtual instances and to the virtual platform itself.
Rich functionality of the virtual platform is often enabled using these communication channels and so often it's desirable to use them.
Ensure you understand the implications of using these communication paths and assess the risk versus benefit balance. These interfaces provide a route to the virtualisation platform, which an adversary could potentially exploit to move laterally between instances, or down to the virtualisation platform itself.
When using them configure as per the best practice guidance provided by the virtual platform documentation.
