SYS.1.5 Virtualisation

Every administrator of virtual IT systems MUST know how virtualisation affects the IT systems and applications in operation. The access rights of administrators regarding virtual IT systems MUST be reduced to those actually required.

It MUST be ensured that the network connections necessary for virtual IT systems are available in the respective virtual infrastructure. It MUST also be checked whether the isolation and encapsulation requirements of virtual IT systems and the applications operated on them are being met. Furthermore, the virtual IT systems used MUST meet the requirements at hand regarding availability and data throughput. During live operations, the performance of virtual IT systems MUST be monitored.

Guest systems MUST NOT access the devices and interfaces of a virtualisation server. However, if such a connection is necessary, it MUST be allocated exclusively. It MUST ONLY be established for the necessary duration by the administrator of the host system. Binding rules MUST be specified in this regard.

Virtual IT systems SHOULD be configured and protected according to the respective organisation's security policy.

It MUST be ensured that existing security mechanisms (e.g. firewalls) and monitoring systems cannot be bypassed by virtual networks. It MUST also be ensured that virtual IT systems connected to several networks cannot be used to establish undesired network connections.

Network connections between virtual IT systems and physical IT systems and for virtual firewalls SHOULD be configured in accordance with the security policies of the organisation in question.

All administration and management access to management systems and host systems MUST be restricted. It MUST be ensured that it is not possible to access administration interfaces from untrustworthy networks.

In order to administer and monitor virtualisation servers or management systems, protocols that are considered secure SHOULD be used. If insecure protocols are nevertheless used, a separate administration network MUST be used.

The operating condition, usage, and network connections of virtual infrastructures MUST be logged continuously. If capacity limits are reached, virtual machines SHOULD be moved. In addition, the corresponding hardware SHOULD be expanded, if applicable. Monitoring MUST also be conducted to ensure that virtual networks have been assigned properly to the respective virtual IT systems.

The system time of all virtual IT systems in production use MUST always be synchronous.

The structure of a virtual infrastructure SHOULD be planned in detail. In this process, the applicable rules and policies for operating IT systems, applications, and networks (including storage networks) SHOULD be taken into consideration. If several virtual IT systems are operated on a virtualisation server, conflicts regarding the protection requirements of the IT systems SHOULD be ruled out. Moreover, the tasks of the individual administrator groups SHOULD be defined and clearly separated. The employees responsible for operating specific components SHOULD also be defined.

The network structure for virtual infrastructures SHOULD be planned in detail. It SHOULD also be checked whether a separate network must be established and used for certain virtualisation functions (such as live migration). The network segments that need to be set up (e.g. management networks, storage networks) SHOULD be planned. It SHOULD be determined how the network segments can be safely separated and protected from each other. Here, it SHOULD be ensured that the production network is separated from the management network (see SYS.1.5.A11 Administration of the Virtualisation Infrastructure Using a Separate Management Network). The availability requirements for the network in question SHOULD also be met.

For virtualisation servers and virtual IT systems, processes for commissioning, inventory, operation, and decommissioning SHOULD be defined and established. The processes SHOULD be documented and updated at regular intervals.

If the use of such virtual IT systems is planned, the virtualisation functions that may be used by the virtual IT systems SHOULD be defined. Test and development environments SHOULD NOT be operated on the same virtualisation server as virtual IT systems in production use.

A virtualisation infrastructure SHOULD only be administered using a separate management network (see NET.1.1 Network Architecture and Design). The available security mechanisms of the management protocols used for authentication, integrity assurance, and encryption SHOULD be activated. All insecure management protocols SHOULD be disabled (see NET.1.2 Network Management).

Based on the tasks and roles defined in the planning phase (see SYS.1.5.A8 Planning a Virtual Infrastructure), a rights and role concept SHOULD be drawn up and implemented for administrating virtual IT systems and networks on virtualisation servers and in the management environment. All components of the virtual infrastructure SHOULD be integrated into a central identity and access management system. Administrators of virtual machines SHOULD be differentiated from administrators of the virtualisation environment at hand. They SHOULD be assigned different access rights.

Furthermore, the management environment SHOULD be able to group virtual machines for appropriate structuring. The roles of the administrators SHOULD be assigned accordingly.

The hardware used SHOULD be compatible with the virtualisation solution used. Here, it SHOULD be ensured that the manufacturer of the virtualisation solution will also offer support for the hardware operated for the scheduled period of deployment.

Uniform configuration standards SHOULD be defined for the virtual IT systems used. The virtual IT systems SHOULD be configured in accordance with these standards. The configuration standards SHOULD be regularly reviewed and amended if required.

If virtual IT systems with different protection needs are operated jointly on the same virtualisation server, it SHOULD be ensured that the virtual IT systems are encapsulated and isolated sufficiently. The network separation of the virtualisation solution used SHOULD be sufficiently secure, as well. If this is not the case, further security safeguards SHOULD be identified and implemented.

The functions for copying and pasting information between virtual machines SHOULD be disabled.

The operating condition of the virtual infrastructure in question SHOULD be monitored. Among other things, it SHOULD be checked whether sufficient resources are still available. The shared resources of a virtualisation server SHOULD also be checked for conflicts.

Furthermore, it SHOULD be ensured that the configuration files of the virtual IT systems are regularly checked for unauthorised modifications.

If changes are to be made to the configuration of the virtualisation infrastructure, they SHOULD be checked and tested prior to being implemented.

Regular audits SHOULD be carried out to check whether the actual state of the virtual infrastructure in question corresponds to the state defined in the respective planning. There SHOULD also be regular audits to check whether the configuration of the virtual components complies with the specified standard configuration. The audit results SHOULD be documented in a transparent manner. Deviations SHOULD be eliminated.

Virtual infrastructures SHOULD be designed for high availability. All virtualisation servers SHOULD be consolidated in clusters.

For virtual IT systems, features for overbooking resources SHOULD be disabled.

The virtualisation server in question SHOULD be hardened. In order to further isolate and encapsulate virtual IT systems from each other and from the virtualisation server, mandatory access controls (MACs) SHOULD be used. The IT system on which the management software is installed SHOULD also be hardened.

All interfaces and communication channels that make it possible for a virtual IT system to request and obtain information about the host system SHOULD be disabled or suppressed. Furthermore, only the virtualisation server SHOULD be able to access its resources. Virtual IT systems SHOULD NOT share pages of the main memory.

The snapshot feature SHOULD be disabled for all virtual IT systems.

Direct access to the emulated consoles of virtual IT systems SHOULD be reduced to a minimum. The virtual IT systems SHOULD be controlled via the network whenever possible.

A public key infrastructure (PKI) SHOULD be used for certificate-protected communication between the components of a given IT infrastructure.

Virtualisation software certified as EAL4 or higher SHOULD be used.

All virtual IT systems SHOULD be encrypted.