Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question is derived from my previous question on Isolating Web application where two approaches were recommended.

  1. Apache Chroot Jail
  2. Isolation through Virtualization

My question is if one of the VM on which application is hosted is compromised will the virtualization layer be enough contain the vulnerable web application? Are there any other security measures need to be taken to protect other VMs?

share|improve this question
up vote 6 down vote accepted

See this question for a sense on how secure VMs really are. How secure are virtual machines really? False sense of security?

A good general rule is to not allow the VMs to communicate with each other through networking. This means proper measure to segregate network access should be enforced.

If you notice a compromise on any of the VMs, immediately nuke the VM and setup again from a known safe point. This should be relatively easy to do with virtualization compared to an actual server.

Besides that, make sure that your hypervisor is kept up-to-date to prevent any known exploits against the hypervisor from allowing a compromise to break out of the VM and affect the host or other VMs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.