NIST Issues Final Version of Full Virtualization Security Guidelines

The National Institute of Standards and Technology (NIST) has issued the final version of its recommendations for securely configuring and using full computing virtualization technologies. The security recommendations are contained in the Guide to Security for Full Virtualization Technologies (NIST Special Publication (SP) 800-125). The draft report was issued for public comment in July 2010.

Virtualization adds a low-level software layer that allows multiple, even different operating systems and applications to run simultaneously on a host. "Full virtualization" provides a complete simulation of underlying computer hardware, enabling software to run without any modification. Because it helps maximize the use and flexibility of computing resources --multiple operating systems can run simultaneously on the same hardware -- full virtualization is considered a key technology for cloud computing, but it introduces new issues for IT security.

For cloud computing systems in particular, full virtualization can increase operational efficiency because it can optimize computer workloads and adjust the number of servers in use to match demand, thereby conserving energy and information technology resources. The guide describes security concerns associated with full virtualization technologies for server and desktop virtualization and provides recommendations for addressing these concerns. Most existing recommended security practices also apply in virtual environments and the practices described in this document build on and assume the implementation of practices described in other NIST computer security publications.

The guide is intended for system administrators, security program managers, security engineers and anyone else involved in designing, deploying or maintaining full virtualization technologies. NIST SP 800-125 recommends organizations:

  • Secure all elements of a full virtualization solution and maintain their security.
  • Restrict and protect administrator access to the virtualization solution.
  • Ensure that the hypervisor, the central program that runs the virtual environment, is properly secured.
  • Carefully plan the security for a full virtualization solution before installing, configuring and deploying it.

NIST SP 800-125, Guide to Security for Full Virtualization Technologies may be downloaded from the http://csrc.nist.gov/publications/nistpubs/800-125/SP800-125-final.pdf.

  • Chemical Distribution is No Place for a Bad Actor or Terrorist Chemical Distribution is No Place for a Bad Actor or Terrorist

    In this episode, Ralph C. Jensen and Eric Byer talk about Chemical distributors and their task to balance a host of security-related issues: from safely handling and transporting hazardous chemicals to securing facilities against inclement weather.

Digital Edition

  • Security Today Magazine - April 2021

    April 2021

    Featuring:

    • Transforming Security
    • Driving COVID Adaptations
    • A Capitol Breach
    • Running the Gauntlet
    • On a Cloud of its Own

    View This Issue

  • Environmental Protection
  • Occupational Health & Safety
  • Infrastructure Solutions Group
  • Spaces4Learning
  • Campus Security & Life Safety