Virtualization can be defined as the act of creating virtual version or model of a computing device, hardware or system resource, such as virtual computer machine (servers or workstations), network computing equipment, storage devices or even an operating system by partitioning/dividing computing resources of a physical hardware into smaller computing units for users or applications that need them. Virtualized infrastructures have become very popular in recent times given its cost saving potentials. Rather than purchasing physical hardware (servers, workstations or network devices) for every application/solution to be deployed by an organization, a single high-end hardware (server, network or storage devices) with large system resource such as memory, processing capacity (CPU), storage and operating system, is purchased and its resources partitioned into fragments to create multiple computing environments within the single hardware infrastructure. This reduces the requirement for physical space, power and other resources (including monetary) that would have been used if each application or solution were to be deployed on separate physical hardware infrastructure.
While it is advantageous to use virtualized infrastructure for application deployment for cost savings, it comes with its own risk, vulnerabilities and challenges, which if not identified, scoped and mitigated could lead to major security challenge or concern for an organization where the entire infrastructure as well as individual applications hosted on the single physical infrastructure risk being compromised. As such, it is important for the inherent risks/vulnerabilities associated with virtualized infrastructures to be identified and the organization's exposure to them assessed to ensure their impact are known and adequately mitigated while assuring on the overall security of the organization systems and network. This is coupled with the threat of abuse or misuse of the system by operators and users.
The risk associated with virtualized infrastructure, be it hypervisor, the ESXi Host (VMware, VCenter, VBlock, VxBlock) and the individual virtual machines would vary with organizations and largely depends on how the infrastructures were deployed. As such, it is important that personnel with security oversight responsibilities on the virtualized infrastructure put in context organization’s uniqueness in terms of its information security policies, procedures, security baselines, regulatory and legal requirements while conducting their security assessment or reviews to know how best to protect the organization.
This book is therefore a documentation of risks and vulnerabilities associated with virtualized infrastructure including hypervisor, ESXi Host and the underlining systems (such as VMware, VCenter, VBlock, Vmax, Vmotion), threats and threat agents that could exploit those weaknesses, their impact on the organization and actions required to mitigate the risks. It serves as a risk assessment checklist/guide for risk assurance practitioners (IT Risk Manager, Cyber/Information Security Analysts, Information Systems Auditors and Systems Control Analysts) and enable them understand as well as identify some of the risks inherent in the virtualized infrastructure, implications/impact of such risks/vulnerabilities and ways to mitigate them. The book is a risk assessment checklist/program guide for risk assurance practitioners and provide comprehensive assessment guide for identifying vulnerabilities/risks, control lapses, process weaknesses and substandard practices associated with virtualized infrastructure that could unduly expose the system. This risk assessment checklist can easily be integrated with popular audit management software such as teammates solutions, Pentana Audit (By Ideagen), RSA Archer and AutoAudit (By Refinitiv).
Intended for organizations desirous of building a risk management program around their virtualized infrastructure (ESXi Host, VMware, VCenter, VBlock, Vmax) from the ground up or strengthen an existing one. Below are sample pages of the virtualized infrastructure risk assessment checklist/program. For full access to the document, you can subscribe to our membership plan for full access to all risk assessment checklists available on our site (this inclusive) or purchase only this book by clicking the Buy Now button below.