CIPUG Morgan King Virtualization

More documents

Recommendations

Info

References56• http://history.cs.ncl.ac.uk/anniversaries/40th/images/ibm360_672/slide24.html• http://www.gartner.com/it/page.jsp?id=1211813• http://www.vmware.com/files/pdf/partners/security/mcafee-key-security-ent-arch-wp.pdf• http://www.vmware.com/pdf/vsphere4/r40/vsp_40_intro_vs.pdf• http://www.vmware.com/products/vshield-endpoint/overview.html• http://www.oocities.org/surfboardart/Mainframe/microcode.htm• http://nvd.nist.gov/scap/docs/2008-conf-presentations/day2/VMware_Security_NIST.pdf• http://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/Virtualization-Benefits-and-Challenges.aspx• http://www.isaca.org/Knowledge-Center/Research/ResearchDeliverables/Pages/VMware-Server-Virtualization-Audit-Assurance-Program.aspx• http://www.sans.org/reading_room/analysts_program/VMware_ITAudit_Sep09.pdf• http://www.rationalsurvivability.com/presentations/FourHorsemen.pdf• http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=1024500• http://www.virtuallyghetto.com/2010/07/esxi-41-major-security-issue.html• http://www.vmware.com/technical-resources/virtual-networking/networking-basics.html• http://www.fyrmassociates.com/pdfs/Stealing_Guests_The_VMware_Way-ShmooCon2010.pdf• https://www.pcisecuritystandards.org/documents/Virtualization_InfoSupp_v2.pdf• http://jreypo.wordpress.com/tag/vsphere-cli/• http://www.shmoocon.org/• http://csrc.nist.gov/publications/nistpubs/800-125/SP800-125-final.pdf
Questions?Morgan King CISSP-ISSAP, CISACompliance Auditor, Cyber Securitymking@wecc.biz
Page 1:
Morgan KingCISSP-ISSAP, CISAComplia
Page 6 and 7: History• Virtualization technolog
Page 8 and 9: What is Virtualization?• Abstract
Page 10 and 11: Hypervisor Type 2 - Hosted• Requi
Page 12 and 13: Platform Players• VMware - vSpher
Page 14 and 15: Benefits• Server consolidation/ut
Page 16 and 17: Complexity• Server Virtualization
Page 18 and 19: CIP-002-3 R3Critical Cyber Asset Id
Page 20 and 21: Is Hypervisor in-scope?• Any Hype
Page 22 and 23: Mixed-Mode• Configuration where b
Page 24 and 25: 1 Hypervisor - 3 Physical NICs5 Vir
Page 26 and 27: CIP-007-3 R2Ports and Services•
Page 28 and 29: 28~# esxcli network ip connection l
Page 30 and 31: CIP-007-3 R3Security Patch Manageme
Page 32 and 33: 32Hypervisor patches
Page 34 and 35: 34Virtual Machine installed securit
Page 36 and 37: 36VMware vShield Endpoint
Page 38 and 39: 38Privileged Service Console Access
Page 40 and 41: CIP-007-3 R5.2.2Shared accounts40
Page 42 and 43: 42Are specific roles are defined?
Page 44 and 45: CIP-007-3 R5.3Password enforcement4
Page 46 and 47: CIP-007-3 R6Security Status Monitor
Page 48 and 49: 48Virtual Machines and Templates
Page 50 and 51: Attack Vectors• VM Escape• Hype
Page 52 and 53: 52http/https running as who?
Page 54 and 55: Sum it up!• CIP Standards apply t
show all

CIPUG Morgan King Virtualization

Create successful ePaper yourself

Delete template?

Save as template?