A virtual machine should be secured (for all intents and purposes) the
same as a physical machine. It is vulnerable to the same attacks and
can attack other computer just as if it were physical. The only
difference is that instead of using physical hardware and wires, it
uses virtual hardware and wires.
1) It depends. How well is the virtual LAN walled off from the
internet. It is just as secure as an identically configured physical
machine
2) The other computers on the LAN would be just as vulnerable as if
the compromised box were physical instead of virtual.
Greg Rubin
On 3/23/06, Chavoux Luyt <chavoux@gmail.com> wrote:
Hi
I'm fairly new to virtual machines and would like to know more about
their vulnerability after reading the recent thread on creating an
isolated virtual LAN with 2 virtual machines. I'm using a VMware
virtual machine running WindowsXP SP2(as guest OS) on linux (host OS)
for development. I can connect to the virtual machine (shared folders)
from the linux host using konqueror & samba. I cannot access the linux
host from the Windows virtual machine, but I can connect to the
internet and to the other (Windows) PC's on the LAN (using their IP
adresses). I have not bothered to join the domain from the virtual
machine nor installed the anti-virus/firewall software running on all
the other PC's on the LAN. I only use the virtual network connection
to copy data to and from the linux host.
I have two questions regarding the security risk of this setup...
1. The virtual machine is on a different (virtual) subnetwork to the
rest of the LAN... how vulnerable is it to attacks from the internet?
I.e. is it more vulnerable than the other Windows machines on the LAN
that have updated virus scanners and firewalls? (The whole LAN is
behind a firewall as well).
2. If the virtual machine itself get compromised, it is not such a big
problem. However, how vulnerable would the other windows machines on
the LAN be to attacks from a compromised virtual machine? Basically,
if I'm not worried about the data on the virtual machine, should I
bother to make it secure?
Thanks
Chavoux
---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.
http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------
