- In this lesson we're gonna focus in on virtualization.
I know I've introduced virtualization to you a couple
of times, but this time we get to spend
an entire lesson on virtualization.
Now virtualization is a technology that creates
multiple environments from a single
physical hardware system.
So take one big powerful host, and we can divide it up
into multiple environments.
Now most of us think of virtualization as a virtual server
or a virtual machine, but there's really a lot
of different aspects to virtualization.
Let's talk about the benefits first before we talk about
the different types.
Each virtual instance is going to behave
as if it were a physically separate system,
but it's really running on a shared physical host.
So a major benefit of virtualization
is resource utilization.
Virtualization enables the efficient use of hardware
resources, again by allowing multiple virtual systems
to run on that single physical system.
The benefit, it can improve resource utilization
and reduce cost.
And then we have flexibility, because virtualization
provides flexibility and scalability, right?
That ability to grow, by allowing virtual systems
to be easily created, deployed, and managed
without the need to invest in additional physical hardware.
So resource utilization and flexibility
two major benefits of virtualization.
Now there's different types of virtualization,
we have server virtualization,
where have multiple virtual servers referred to
as virtual machines on a single physical host,
we can have virtual desktops that can be accessed
by our users, we can have virtual storage
pulling in multiple storage devices into a single
virtual storage system, and we can have network
virtualization creating virtual networks without requiring
physical network hardware.
So let's dive deeper into each one of these;
server, desktop, storage, and network.
Server virtualization allows the resources
of the host, right?
To guest servers, which we refer to generally
as virtual machines, we talked about having a host
and having VMs, or virtual machines.
Now the physical host computer has the processor,
the memory, the storage, the networking components,
and we're gonna use specialized software
to dynamically allocate those resources.
Now virtual machines are gonna act exactly
like physical machines, right?
They each have an independent operating system,
they're gonna have their own applications,
they'll have their own network connections,
and they're going to use the resources, right?
That have been allocated to them.
But that's important to think about,
that they behave like a physical machine,
because that means that things like
configuration management, change management,
patch management, you know, doing assessments,
vulnerability management, audit, licensing,
they all have to be thought of in terms
of each virtual machine.
Now hypervisors are gonna be the software
or firmware components we actually use
to virtualize the system resources on a host system
to have our virtual machines.
And there are two types of hypervisors,
you have a type one and type two.
A type one, sometimes referred to as a bare metal,
or a native hypervisor, run directly on the system hardware.
They have direct access to the hardware, and so we don't
need an operating system to load, as the hypervisor
is really the operating system.
In a type two hypervisor, sometimes referred to
as hosted, is hypervisors that specialized software
is running on a host operating system
that provides the virtualization services.
Now type one is going to be faster and more efficient,
but it has greater hardware requirements and expense
than type two.
We talked about containers not once, not twice,
this might be our third time.
This is a refresher, containers are products
of an operating system virtualization,
we don't need a hypervisor.
Containers provide a lightweight virtual environment
referred to as an instance, our operating system containers
are virtual environments that share the kernel
of a host operating system, but can provide user space
isolation, where our application containers
are virtual environments that share the kernel
of the host operating system designed to package
and run a single service.
So moving away from virtual machines,
let's talk about desktop virtualization.
The virtual desktop infrastructure, I'm gonna refer to
just as VDI, is virtualization technology
that hosts a desktop operating system
on a centralized server, in the data center.
Now there are two types of desktop virtualization;
persistent and non-persistent.
A persistent VDI, a virtual desktop infrastructure,
provides each user with his or her own desktop image,
which can be customized and saved for future uses,
very much like a traditional desktop.
Non-persistent VDI provides this pool of uniform desktops
that users can access whenever they need it,
but non-persistent desktops revert right back
to their original state each time the user logs out,
so it doesn't matter what the user might have saved
on the desktop or what configuration changes
they might have made, that all gets wiped out
and we're back to the original state each time
the user logs out.
Then we have network virtualization, or NSX.
Network virtualization is a complete reproduction
of a physical network in software,
which is hard to imagine, isn't it?
The network virtualization presents logical networking
devices and services, like logical ports, switches,
routers, firewalls, load balancers, even VPNs.
Virtual networks offer the same features and guarantees
of a physical network with the operational benefits
of hardware independence of virtualization.
So do we have any security concerns about virtualization?
Well, two in particular;
virtual machine escape, and virtualization sprawl.
Virtual machine escape happens when a virtual machine
and the host operating system interact,
that should never, ever, ever, ever happen.
But over time multiple exploitable vulnerabilities
have been identified, which means that it's really important
that your virtual machine hosts
are going to be included, right?
Your virtualization host, are gonna be included
in your organizational vulnerability
and patch management programs.
The second is virtualization sprawl.
Now virtualization sprawl occurs when the number
of virtual systems is like, out of control, right?
Potentially unmanaged, unnecessary,
and not in compliance with licensing agreements.
And we talked about virtualization sprawl
way back when we talked about some operational issues.
So here's the way to think about it.
Our virtual devices should always be treated
the same as our physical systems.
And subject to asset management, capacity management,
configuration management, vulnerability management,
licensing, assessment, and audit.
Just because they're a virtual device doesn't mean
that they should be excluded from any of those.
So we wanna make sure that we're always managing them,
that we understand their necessity,
and that we have the appropriate licensing.
And that my friends bring us to a three second challenge.
Our challenge question's three seconds each,
let's do it.
Software or firmware components that can virtualize
system resources?
One, two, three.
That's gonna be a hypervisor.
Number two; term applied to an environment
where the number of virtual machines is out of control.
That's the one we just talked about.
One, two, three.
That's virtualization sprawl.
Number three; this type of VDI, right?
So virtual desktop, reverts back to its original state
each time the user logs out.
One, two, three.
That's gonna be a non-persistent VDI.
Remember we had a persistent VDI and a non-persistent VDI.
Number four; the term applied to a situation
where a virtual machine and a host
operating system interact.
We said this should never, ever, ever happen.
Okay, we wanna make sure we're always patching, right?
Our systems to make sure it never happens.
One, two, three.
That's known as virtual machine escape.
Lastly, number five; a lightweight virtual environment,
also called instances, that we've now talked about
multiple times.
One, two, three, I know you're gonna get it.
And that's a container.
All right, good work.
Let's move into a security in action.
This one is about VM sprawl.
So your organization has enthusiastically adopted
virtualization, you virtualized your servers,
networks, even your desktops.
Your CIO has instructed the IT team to spin up a server
for every application, for almost every service.
Performance is great, users are happy,
expenses are within budget, so what could go wrong?
Well you have a concern.
You express concerns about the impact
of VM, virtual machine sprawl, to your manager.
After she sighs, says, "Yeah, but users are happy,
performance is great, expenses are within budget."
She says, "Okay, document your concerns,
and then we'll have a conversation."
So what might you include on the list?
So go ahead and put me on pause, write about
your concerns about VM sprawl, how are we gonna talk
to this manager?
Well, what you may say is, "Listen, when we spin up
a server for everything, and we have these desktops,
and networks, right?
We have too many machines, potentially,
too many devices, to manage effectively.
We're adding to our vulnerability and patch management
overhead every time we spin up a new machine.
We may not be in licensing compliance.
Do we have enough licenses for our operating systems?
For our applications?
And, you know, we may have unnecessary
resource consumptions, it may not be necessary
to be spinning up a server for every single application.
We really need to have a good plan,
and we need to recognize that each one of those
virtual devices have to be managed as if they were
a physical device, and if we're good with that, that's okay.
As long as we've recognized that, right?
And we understand what we need to do,
and we understand the resources we have to devote.
But we can't just think of virtualization as this panacea
without any consequences.
And that's the conversation
that you should probably be having.
Right, that takes us to our word cloud,
you know what to do.
When you're ready, come on over to the next lesson,
I'll be waiting for you there.