----
Microvisor + Hypervisor Makes Your VMs Secure by Design
// A Collection of Bromides on Infrastructure
I often get asked whether micro-virtualization can be used with a traditional hypervisor and full-OS "fat" VMs (humor: FAT VMs are another matter).
YES! There are powerful benefits in both client and server scenarios. I'll focus on the user centric uses that we currently support in vSentry:
- VDI and DaaS: MakeVDI/DaaS secure without legacy security software that kills scalability andUX.
- The Microvisor runs nestedin a VDI/DaaS desktop VM, running on top of a "root" hypervisor that virtualizes Intel VT/AMD-V. We've optimized micro-Xen to run nested on VMware ESX with virtual hardware 9/10 – the most widely deployed virtual infrastructure for VDI/DaaS under both Citrix XenDesktop and VMware View
- None of XenServer, Hyper-V (WS12 & Azure), RHEL/KVM, or AWS supports nesting today, though the up-stream work in Xen is done. Props to Canonical for their nesting support in KVM/Ubuntu. Today all nesting is software-based. Hardware nesting via Intel VMCS-Shadow will start to arrive in server CPUs soon.
- Client-hosted Virtual Desktops: Secure your BYO devices, developer desktops and Windows virtual desktops on a Mac or PC:
- The Microvisor runs nested within a client-hosted Windows desktop VM (as for VDI/DaaS) on VMware Workstation or (on a Mac) VMware Fusion
- Alternatively the Microvisor can run side-by-side with VMware Workstation/Fusion, effectively sharing VT/AMD-V. This allows us to secure a user desktop (Windows/OS-X) from attack – so that it can securely host an enterprise delivered VM. For this case we have two goals:
- Secure the host OS using micro-virtualization
- Also host additional full-OS VM(s) for desktop virtualization or test/dev. (with the option of protecting them too, using micro-virtualization)
This raises a killer question: Could a single hypervisor run OS VMs and micro-VMs? YES! Micro-Xen does this today (though not as a supported feature yet).
Fortunately (as a result of our collaboration with Microsoft starting in 2006, at XenSource), micro-Xen can run Windows VMs saved from Hyper-V in VHD format. I use this to demo the Bromium Management Server (BMS) in a WS12/SQL VM on my vSentry protected laptop. If you'd like a detailed technical description of how this works, let me know.
----
Shared via my feedly reader
Sent from my iPhone
No comments:
Post a Comment