Is there any security benefit to using physical machines over VMs?

Question

Consider a critical multi-server system (the clients are not in scope for this discussion). Each server can be a physical machine or hosted as VM.

Is there any reason to believe that the physical setup would be more secure than the virtualized equivalent, with all things being equal (e.g. room configuration, sufficient hardware resources for both approaches, etc.)?

Is there any research to claim one or the other?

Edit: For further clarification (per requests in the comments), the question is primarily targeted at potential software exploits and networking vulnerabilities with regard to the traffic between the servers. For software exploits and vulnerabilities, consider those both on OS and the application level.

Answer 1

It really depends on what is on the scope of "security".

1. If service availability is part of security, then usually, virtualized system are better on this topic because of:

   • the inherent mitigation of hardware fault.
   • Ability to take snapshot, etc... to ease backups and rollback

2. If availability isn't on scope, then i would tell that, for sure, physical server are more secure since you remove a whole layer (the hypervisor one) that could bring breaches or vulnerability.

Answer 2

One advantage of the physical machines over VMs is that you can physically detach and deprive physical machine from any networks and then perform tasks thriving for security and privacy.

Assuming both physical machine and the VM are compromised, the VM can theoretically escape the sandbox and connect itself with the outer world, whereas for the physical machine, if all wireless cards are detached and all network wires are disconnected, it will require hardware modification for it to communicate with the outer world

Answer 3

largest additional risk from a vm are the memory timing attacks of one vm can likely potentially be used to read memory from another. Spectre and Meltdown spring to mind. https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/ for example

Yes this can likely be mitigated, but at a performance penalty. Hypervisor security is not trivial. Obviously such exploits can be used between processes on the same machine as well.

Answer 4

The main differences that come to mind has to do with protection of critical data leakage.

With a fully encrypted physical server, temporary memory swap space would typically use encrypted swap.

While a virtual server could be defined as fully encrypted with its own encrypted swap, it's also subject to the host system memory management and swaps outside of the client VM. Depending upon the host system used, this host level buffer and swap may not be encrypted. Depending upon setup and criteria, this could range from unimportant to critical.

Access to the host gives unrestricted access to all running client VMs verses needing individual accesses for each physical server. I emphasize running because encryption is irrelevant when the system is running.