6.7

Follow these best practices to protect your virtual machine:
Patches and other
protection
Keep all security measures up-to-date, including applying appropriate
patches. It is especially important to keep track of updates for dormant
virtual machines that are powered off, because it can be easy to overlook
them. For example, ensure that anti-virus software, anti-spy ware, intrusion
detection, and other protection are enabled for every virtual machine in
your virtual infrastructure. You should also ensure that you have enough
space for the virtual machine logs.
Anti-virus scans Because each virtual machine hosts a standard operating system, you
must protect it from viruses by installing anti-virus software. Depending on
how you are using the virtual machine, you might also want to install a
software firewall.
Stagger the schedule for virus scans, particularly in deployments with a
large number of virtual machines. Performance of systems in your
environment degrades significantly if you scan all virtual machines
simultaneously. Because software firewalls and antivirus software can be
virtualization-intensive, you can balance the need for these two security
measures against virtual machine performance, especially if you are
confident that your virtual machines are in a fully trusted environment.
Serial ports Serial ports are interfaces for connecting peripherals to the virtual machine.
They are often used on physical systems to provide a direct, low-level
connection to the console of a server, and a virtual serial port allows for the
same access to a virtual machine. Serial ports allow for low-level access,
which often does not have strong controls like logging or privileges.
Use Templates to Deploy Virtual Machines
When you manually install guest operating systems and applications on a virtual machine, you introduce
a risk of misconfiguration. By using a template to capture a hardened base operating system image with
no applications installed, you can ensure that all virtual machines are created with a known baseline level
of security.
You can use templates that can contain a hardened, patched, and properly configured operating system
to create other, application-specific templates, or you can use the application template to deploy virtual
machines.
Procedure
u
Provide templates for virtual machine creation that contain hardened, patched, and properly
configured operating system deployments.
If possible, deploy applications in templates as well. Ensure that the applications do not depend on
information specific to the virtual machine to be deployed.
vSphere Security
VMware, Inc. 130