You can minimize them over a period of time using SDL (Security Development Lifecycle) practices, but the risks themselves will always be there. Security assessments against multiple virtual machine technologies have revealed multiple vulnerabilities in these areas, and practically, these risks will always be there. This is definitely a step in the right direction, and theoretically they should have the same security risk, right? No.īy their very nature, VMs have the same security risks as physical computers (their ability to closely mimic a real computer is why we run them in the first place), plus they have additional guest-to-guest and guest-to-host security risks. Let's suppose the VM-using-client practices the same security practices and policies on their virtual machines as they do their physical machines. They often use weaker passwords, take longer to patch, and allow operational practices (such as connections from high-risk to low-risk assets, unmanaged shares, missing security software, and overly promiscuous permissions) that wouldn't pass muster in their normal production environments.

In a large percentage of the cases I've been involved with, clients treat VMs as something less than their physical machines, tolerating slower and poorer security policies than they would on real computers.

Most of the time, using VM technology will increase overall risk. VM technologies are very cool, and great at saving money (and space, electricity, and more), but in all but a small minority of cases, they will not improve your overall security posture. Wow! They are either drunk on the marketing Kool-Aid, misinformed, or simply trying to misrepresent VM capabilities to sell more product.

I've been at several recent conferences where virtual machine (VM) and security “experts” were telling audiences how VM technology can be used to improve computer security.

Oracle virtualbox vs vmware reddit