Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question is derived from my previous question on Isolating Web application where two approaches were recommended.

  1. Apache Chroot Jail
  2. Isolation through Virtualization

My question is if one of the VM on which application is hosted is compromised will the virtualization layer be enough contain the vulnerable web application? Are there any other security measures need to be taken to protect other VMs?

share|improve this question
add comment

1 Answer

up vote 6 down vote accepted

See this question for a sense on how secure VMs really are. How secure are virtual machines really? False sense of security?

A good general rule is to not allow the VMs to communicate with each other through networking. This means proper measure to segregate network access should be enforced.

If you notice a compromise on any of the VMs, immediately nuke the VM and setup again from a known safe point. This should be relatively easy to do with virtualization compared to an actual server.

Besides that, make sure that your hypervisor is kept up-to-date to prevent any known exploits against the hypervisor from allowing a compromise to break out of the VM and affect the host or other VMs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.