Draft SP 800-125A Rev. 1, Security Recommendations for Server
Total Page:16
File Type:pdf, Size:1020Kb
The attached DRAFT document (provided here for historical purposes), released on April 11, 2018, has been superseded by the following publication: Publication Number: NIST Special Publication (SP) 800-125A Rev. 1 Title: Security Recommendations for Server-based Hypervisor Platforms Publication Date: June 2018 • Final Publication: https://doi.org/10.6028/NIST.SP.800-125Ar1 (which links to https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-125Ar1.pdf). • Related Information on CSRC: Final: https://csrc.nist.gov/publications/detail/sp/800-125a/rev-1/final 1 Draft NIST Special Publication 800-125A 2 Revision 1 3 4 Security Recommendations for 5 Hypervisor Deployment on 6 ServersServer-based Hypervisor 7 Platforms 8 9 10 11 12 Ramaswamy Chandramouli 13 14 15 16 17 18 19 20 21 22 23 C O M P U T E R S E C U R I T Y 24 25 Draft NIST Special Publication 800-125A 26 Revision 1 27 28 29 30 Security Recommendations for 31 Server-based Hypervisor Platforms 32 33 Hypervisor Deployment on Servers 34 35 36 37 Ramaswamy Chandramouli 38 Computer Security Division 39 Information Technology Laboratory 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 April 2018 56 57 58 59 60 61 U.S. Department of Commerce 62 Wilbur L. Ross, Jr., Secretary 63 64 National Institute of Standards and Technology 65 Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology 66 67 Authority 68 69 This publication has been developed by NIST in accordance with its statutory responsibilities under the 70 Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law 71 (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including 72 minimum requirements for federal information systems, but such standards and guidelines shall not apply 73 to national security systems without the express approval of appropriate federal officials exercising policy 74 authority over such systems. This guideline is consistent with the requirements of the Office of Management 75 and Budget (OMB) Circular A-130. 76 Nothing in this publication should be taken to contradict the standards and guidelines made mandatory 77 and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should these 78 guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, 79 Director of the OMB, or any other federal official. This publication may be used by nongovernmental 80 organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, 81 however, be appreciated by NIST. 82 83 National Institute of Standards and Technology Special Publication 800-125A Revision 1 84 Natl. Inst. Stand. Technol. Spec. Publ. 800-125A Rev. 1, 38 Pages (April 2018) 85 CODEN: NSPUE2 86 87 88 89 Certain commercial entities, equipment, or materials may be identified in this document in order to describe an 90 experimental procedure or concept adequately. Such identification is not intended to imply recommendation or 91 endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best 92 available for the purpose. 93 There may be references in this publication to other publications currently under development by NIST in accordance 94 with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, 95 may be used by federal agencies even before the completion of such companion publications. Thus, until each 96 publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For 97 planning and transition purposes, federal agencies may wish to closely follow the development of these new 98 publications by NIST. 99 Organizations are encouraged to review all draft publications during public comment periods and provide feedback to 100 NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at 101 https://csrc.nist.gov/publications. 102 103 Public comment period: April 11, 2018 through May 2, 2018 104 105 National Institute of Standards and Technology 106 Attn: Computer Security Division, Information Technology Laboratory 107 100 Bureau Drive (Mail Stop 8930) Gaithersburg, MD 20899-8930 108 Email: [email protected] 109 110 All comments are subject to release under the Freedom of Information Act (FOIA). 111 i NIST SP 800-125A REV. 1 (DRAFT) SECURITY RECOMMENDATIONS FOR SERVER-BASED HYPERVISOR PLATFORMS 112 113 Reports on Computer Systems Technology 114 115 The Information Technology Laboratory (ITL) at the National Institute of Standards and 116 Technology (NIST) promotes the U.S. economy and public welfare by providing technical 117 leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test 118 methods, reference data, proof of concept implementations, and technical analyses to advance the 119 development and productive use of information technology. ITL’s responsibilities include the 120 development of management, administrative, technical, and physical standards and guidelines for 121 the cost-effective security and privacy of other than national security-related information in 122 Federal information systems. The Special Publication 800-series reports on ITL’s research, 123 guidelines, and outreach efforts in information system security, and its collaborative activities with 124 industry, government, and academic organizations. 125 126 127 Abstract 128 129 The Hypervisor platform is a collection of software modules that provides virtualization of 130 hardware resources (such as CPU/GPU, Memory, Network and Storage) and thus enables 131 multiple computing stacks (made of an operating system (OS) and Application application 132 programs) called Virtual Machines (VMs) to be run on a single physical host. In addition, it may 133 have the functionality to define a network within the single physical host (called virtual network) 134 to enable communication among the VMs resident on that host as well as with physical and 135 virtual machines outside the host. With all this functionality, the hypervisor has the responsibility 136 to mediate access to physical resources, provide run time isolation among resident VMs and 137 enable a virtual network that provides security-preserving communication flow among the VMs 138 and between the VMs and the external network. The architecture of a hypervisor can be 139 classified in different ways. The security recommendations in this document relate to ensuring 140 the secure execution of baseline functions of the hypervisor and are therefore agnostic to the 141 hypervisor architecture. Further, the recommendations are in the context of a hypervisor 142 deployed for server virtualization and not for other use cases such as embedded systems and 143 desktops. Recommendations for secure configuration of a virtual network are dealt with in a 144 separate NIST document (Special Publication 800-125B). 145 146 147 Keywords 148 149 Virtualization; Hypervisor; Virtual Machine; Virtual Network; Secure Configuration; Security 150 Monitoring; Guest OS 151 152 153 ii NIST SP 800-125A REV. 1 (DRAFT) SECURITY RECOMMENDATIONS FOR SERVER-BASED HYPERVISOR PLATFORMS 154 155 Acknowledgements 156 157 The author, Ramaswamy Chandramouli wishes to thank his colleague Tim Grance for his 158 personal input on the content and in helping with the logistics of the publication. Special thanks 159 to Andreas Bartelt from Bosch Center of Competence Security for valuable input regarding 160 technologies for device virtualization. He also thanks Michael Bartock for his valuable review 161 and feedback as a division reader. Last but not the least, he expresses his thanks to Isabel Van 162 Wyk for her detailed editorial review. 163 164 165 Note to Reviewers 166 167 This revision includes additional technologies for device virtualization such as para- 168 virtualization, passthrough and self-virtualizing hardware devices as well as associated security 169 recommendations. Major content changes in this revision are in: Section 1.1, Section 2.2.2 and 170 Section 5. 171 iii NIST SP 800-125A REV. 1 (DRAFT) SECURITY RECOMMENDATIONS FOR SERVER-BASED HYPERVISOR PLATFORMS 172 173 Table of Contents 174 175 EXECUTIVE SUMMARY ........................................................................................................................................... v 176 1. INTRODUCTION, SCOPE & TARGET AUDIENCE...................................................................................... 1 177 1.1 Hypervisor Baseline Functions ....................................................................................................................... 2 178 1.2 Scope of this document ................................................................................................................................... 3 179 1.3 Target Audience ................................................................................................................................................ 4 180 1.4 Relationship to other NIST Guidance Documents ................................................................................... 4 181 2. APPROACH FOR DEVELOPING SECURITY RECOMMENDATIONS ......................................................... 6 182 2.1 Hypervisor Platform Threat Sources .............................................................................................................