6.0.3

n
Prevent Virtual Machines from Taking Over Resources on page 220
When one virtual machine consumes so much of the host resources that other virtual machines on the
host cannot perform their intended functions, a Denial of Service (DoS) might occur. To prevent a
virtual machine from causing a DoS, use host resource management features such as seing Shares
and using resource pools.
n
Disable Unnecessary Functions Inside Virtual Machines on page 221
Any service running in a virtual machine provides the potential for aack. By disabling unnecessary
system components that are not necessary to support the application or service running on the system,
you reduce the number of components that can be aacked.
General Virtual Machine Protection
A virtual machine is, in most respects, the equivalent of a physical server. Employ the same security
measures in virtual machines that you do for physical systems.
Follow these best practices to protect your virtual machine:
Patches and other
protection
Keep all security measures up-to-date, including applying appropriate
patches. It is especially important to keep track of updates for dormant
virtual machines that are powered o, because it can be easy to overlook
them. For example, ensure that anti-virus software, anti-spy ware, intrusion
detection, and other protection are enabled for every virtual machine in your
virtual infrastructure. You should also ensure that you have enough space for
the virtual machine logs.
Anti-virus scans
Because each virtual machine hosts a standard operating system, you must
protect it from viruses by installing anti-virus software. Depending on how
you are using the virtual machine, you might also want to install a software
rewall.
Stagger the schedule for virus scans, particularly in deployments with a large
number of virtual machines. Performance of systems in your environment
degrades signicantly if you scan all virtual machines simultaneously.
Because software rewalls and antivirus software can be virtualization-
intensive, you can balance the need for these two security measures against
virtual machine performance, especially if you are condent that your virtual
machines are in a fully trusted environment.
Serial ports
Serial ports are interfaces for connecting peripherals to the virtual machine.
They are often used on physical systems to provide a direct, low-level
connection to the console of a server, and a virtual serial port allows for the
same access to a virtual machine. Serial ports allow for low-level access,
which often does not have strong controls like logging or privileges.
Use Templates to Deploy Virtual Machines
When you manually install guest operating systems and applications on a virtual machine, you introduce a
risk of misconguration. By using a template to capture a hardened base operating system image with no
applications installed, you can ensure that all virtual machines are created with a known baseline level of
security.
You can use templates that can contain a hardened, patched, and properly congured operating system to
create other, application-specic templates, or you can use the application template to deploy virtual
machines.
Chapter 7 Securing Virtual Machines
VMware, Inc. 219