6.7

Host-based firewalls can slow performance. Balance your security needs against performance goals
before you install host-based firewalls on VMs elsewhere in the virtual network.
See Securing the Network With Firewalls.
Segmentation
Keep different virtual machine zones within a host on different network segments. If you isolate each
virtual machine zone on its own network segment, you minimize the risk of data leakage from one zone to
the next. Segmentation prevents various threats, including Address Resolution Protocol (ARP) spoofing.
With ARP spoofing, an attacker manipulates the ARP table to remap MAC and IP addresses, and gains
access to network traffic to and from a host. Attackers use ARP spoofing to generate man in the middle
(MITM) attacks, perform denial of service (DoS) attacks, hijack the target system, and otherwise disrupt
the virtual network.
Planning segmentation carefully lowers the chances of packet transmissions between virtual machine
zones. Segmentation therefore prevents sniffing attacks that require sending network traffic to the victim.
Also, an attacker cannot use a nonsecure service in one virtual machine zone to access other virtual
machine zones in the host. You can implement segmentation by using one of two approaches.
n
Use separate physical network adapters for virtual machine zones to ensure that the zones are
isolated. Maintaining separate physical network adapters for virtual machine zones is probably the
most secure method. After the initial segment creation. This approach is less prone to
misconfiguration.
n
Set up virtual local area networks (VLANs) to help safeguard your network. VLANs provide almost all
the security benefits inherent in implementing physically separate networks without the hardware
overhead. VLANs can save you the cost of deploying and maintaining additional devices, cabling, and
so on. See Securing Virtual Machines with VLANs.
Preventing Unauthorized Access
Requirements for securing VMs are often the same as requirements for securing physical machines.
n
If a virtual machine network is connected to a physical network, it can be subject to breaches just like
a network that consists of physical machines.
n
Even if you do not connect a VM to the physical network, the VM can be attacked by other VMs.
VMs are isolated from each other. One VM cannot read or write another VM’s memory, access its data,
use its applications, and so forth. However, within the network, any VM or group of VMs can still be the
target of unauthorized access from other VMs. Protect your VMs from such unauthorized access.
Securing the Network With Firewalls
Security administrators use firewalls to safeguard the network or selected components in the network
from intrusion.
vSphere Security
VMware, Inc. 193