Category: News

Jan 07 2011

How PCI DSS 2.0 affects virtualization compliance

The Payment Card Industry Data Security Standard (PCI DSS) 2.0 is hot off the presses, and the question everyone’s asking is, “Does it cover virtualization compliance?”

Well, kind of.

Two years in the making, PCI DSS 2.0 offers additional guidance and clarifies portions of the previous PCI DSS 1.2 standard. Virtualization compliance is mentioned, but only generally, and there are no specific virtualization security recommendations. In fact, the major change in version 2.0 is that PCI Security Standards Council brought the virtualization layer into the scope of the standard, which governs organizations that handle credit card information.

Previously, virtualization was completely ignored, so the move is a step in the right direction. But without firm guidance on how to ensure virtualization compliance, the standard is still ineffective. And the council doesn’t plan to update PCI DSS 2.0 for another three years, so it will be quite a while before we get more detail about protecting credit card information in virtual infrastructures.

Read the full article at searchvmware.com…

Share This:

Jan 07 2011

Which VMware certifications are right for you?

It used to be that VMware had only one certification: the VMware Certified Professional (VCP). Becoming a VCP was fairly basic; you had to attend an approved training class and then pass an exam. And if you passed the VCP exam with a high-enough score, you were eligible to become a VMware Certified Instructor (VCI).

Now there are more VMware certifications, so you might wonder, “Which VMware certifications are right for me?” To help you decide, I’ve covered the various VMware certifications and requirements and how they can improve your IT career.

VMware Certified Professional
This VMware certification proves that you have the basic skills and knowledge to work with vSphere. To become a VCP, you must take an authorized, instructor-led training class. (Online classes are not eligible.)

Read the full article at searchvmware.com…

Share This:

Jan 07 2011

Why physical performance monitoring tools aren’t enough

You can’t rely on traditional performance monitoring tools for monitoring a virtual infrastructure. Using the same tools that you would in a physical environment often results in inaccurate and incomplete metrics.

For the most accurate method, you need to know which performance monitoring tools to use and what to monitor in your infrastructure.

Physical performance monitoring tools: Why not?

Performance monitoring tools that are designed for a physical infrastructure use an operating system to measure and monitor the performance statistics of servers’ physical hardware. In a virtual infrastructure, the guest OS can’t see the physical hardware, only the virtual hardware that has been emulated by the hypervisor. Because an OS can’t directly access most of the host server’s physical hardware, traditional performance monitoring tools won’t function properly in a virtual infrastructure.

Read the full article at searchservervirtualization.com…

Share This:

Jan 07 2011

Utilizing vSphere features, resource controls for VM priority

After you implement virtualization for your customers it is important to define the priorities for their virtual machines (VMs). If you do not, your customers may find that their critical applications now run slower than before. Setting up resource controls can be a valuable service that VARs can offer their customers. The value can be two-fold: it helps to define customer priorities so that mission-critical VMs get access to the resources they need to run their workloads, and it allows VARs to show their customers the benefits of virtualization.

Here we will learn the resource control features in vSphere and how solutions providers can use them to set up a virtualized infrastructure that works for their customers.

Read the full 2-part article (Part 1, Part 2) at searchsystemschannel.com…

Share This:

Jan 07 2011

Top eight VMware vSphere backup best practices

When it comes to backing up virtual machines in VMware vSphere, you need to leverage the strengths of virtualization to maximize your backup efficiency. You also need to know what to back up as well as how to back it up. In addition, you can’t use the same principles that you use in a traditional environment to back up a virtual environment. The following are eight vSphere backup best practices.

Read the full article at searchdatabackup.com…

Share This:

Nov 29 2010

VCenter Update Manager installation and configuration

When it comes to patching and updating ESX and ESXi hosts and VMs, solution providers have several options. Remote and local command line utilities are used to update hosts and VMs, and standalone applications, such as the vSphere Host Update Utility and vCenter Update Manager, are also helpful.

While command line utilities are just as effective as standalone applications, many customers prefer to use application clients for hosting and patching. Using command line utilities can be tedious, and solution providers must know proper syntaxes to use them properly. On the other hand, application clients are easier to use and have more features, such as the ability to schedule when updates are applied.

Read the full article at searchsystemschannel.com…

Share This:

Nov 02 2010

The vLaunchpad – hacked!

Early Sunday morning I was alerted by a tweet DM from @terrafx that the vLaunchpad website was hacked and was displaying a turkish hacker page. The vLaunchpad is one of 5 web sites that I have hosted with godaddy.com, this one is on their Linux grid computing platform (cloud). I quickly checked the site and everything looked OK to me so I investigated further. I started browsing the web server and found a suspicious file in the root directory called x.txt. After downloading it to my PC and opening it I found the following HTML code:

vpad-1

Obviously this was a malicious file that was displaying the page that people were seeing after the hack occurred. I wasn’t sure what all happened so I started looking at date/time stamps to see if any other files were altered and also checking through some of the key wordpress php files. Seeing nothing else malicious I contacted godaddy that didn’t know anything about it. So I investigated further and found a nifty tool inside their web-based control center that allows you to interact with all the files on the website. There is a history button in their web based file manager that lets you go back to scheduled snapshots that occur automatically on the website. Once you pick a date it shows you any files that have changed, been added or deleted from the current file listing. I picked the date of the attack and here’s what I saw:

vpad-2The listing showed 4 files deleted and one file modified, so obviously something happened. This capability is pretty cool because if a hack occurs you can see exactly what files have been changed. I really didn’t find out much else besides that but I wanted to know how the hack occured, there really was only 3 reasons that I could think of, a compromised password (wordpress or ftp), wordpress vulnerability or a web server vulnerability. Two were within my control, I had pretty strong wordpress/ftp passwords so I didn’t think that was the cause and my wordpress version was fairly update to date. The web server was beyond my control as it is godaddy’s responsibility. I wanted to eliminate ftp as a cause so I asked godaddy for the ftp logs for the last few days. Once I got those I saw nothing but my IP address in them after the hack occurred so I was back to either WordPress or the web server being the cause. I pushed godaddy for more information, basically blaming the web server for the attack and I finally got an answer from them:

vpad-3Apparently using compromised SSH accounts (you can enable SSH on godaddy websites) and exploiting a vulnerability in the GNU C Library that is part of Linux operating systems, an attacker was able to execute and upload code to many customers websites that were running on the server, mine happened to be one of them. So it looks like what happened is that after godaddy was alerted to the hack, they went in and cleaned everything up on their own without involving their customers which would explain why everything looked normal when I check the website after I was alerted. It looks like they restored the original files, renamed the malicious file to x.txt and deleted the extra files that were put on the web server. If I hadn’t been alerted about it I probably would of never known the hack occurred. Thanks to godaddy’s quick response the hack was quickly identified and fixed.

The hack did serve as a wake up call though and if you have a wordpress blog make sure you do frequent backups, especially of the database. I kick off the database backup from the godaddy control panel than ftp all wordpress files including the db backup file to my local PC. There are also plugins that you can use to help automate this. There are also a variety of security plugins that you can install on your wordpress site. Here’s a few good links to dealing with a wordpress hack and how to better secure your wordpress website.

Share This:

Oct 27 2010

Virtual security: New attack vectors, new ballgame

When it comes to securing virtual environments, you have to take different measures from those for traditional physical security.

With virtual security, new attack vectors –that is, the means by which a hacker gains control of a server OS — must be protected to prevent breaches. Because of these vectors — and thus risks — virtual security requires you to secure the host and each virtual machine (VM).

In this tip, we cover the kinds of attacks you should be concerned about as you develop a virtualization security strategy as well as considerations and best practices for the various components of your infrastructure.

Physical security
There are many physical attack vectors, from physical consoles to a guest OS to the applications that run on an OS. To secure a physical system, you must have a locked data center that restricts access to the console. Next, you secure the operating system and applications, and finally, you implement security controls — such as a firewall — at the network layer. With virtual security, these breaches still apply, but there are other avenues by which an attacker can gain access to a VM.

Read the full article at searchservervirtualization.com (Part 1 of a 2-part article)

Also read Part 2: Virtual network security best practices

Share This: