PCI DSS compliance on a virtualized server running Xen

Question

I have a server running xen with HVM and would like to make one VM PCI compliant. I've read the PCI virtualization guide and it says that I need to make sure there is no information leakage between VM's. How can I make sure each OS is unable to intercept data from other DomU's?

Answer 1

I'm not a PCI Expert, and I do strongly suggest you consult one, but here's my understanding of the PCI Virtualization Guidelines:

The primary concern as with all aspects of PCI compliance is the protection of sensitive data (cardholder information). In terms of the information leakage concerns there are three major areas that seem to come up:

1. Information Leakage that lets you get access to the hypervisor's controls
   ("leakage at the control plane or management plane" of the network).
   You would guard against this by securing the hypervisor control networks (the ones that let you get to dom0 in Xen) and making sure that:
   1. You can only access the management IPs from authorized networks.
   2. You can't access the management IPs from the virtual machines (or alternatively "No authorized networks contain virtual machines").
2. Information leakage between the VMs over the network.
   This is your typical network security stuff: Isolate networks into appropriate vLANs, set up good firewall rules, and ideally use an IDS/IPS to alert you if anything hinky is going on.
3. Information leakage through the hypervisor.
   This is the hardest one to quantify -- particularly with hypervisors like Xen or FreeBSD Jails which don't emulate all the way down to "bare hardware" but are instead "inside" another dom0 operating system that has access to all the VMs.
   You want to ensure that there is no way for one VM to access data inside another VM. In doing this you need to consider the VMs themselves, but you also need to keep an eye on the hypervisor and make sure there is nothing there that copies data between VMs, or if something like that does exist for whatever reason that there is a well documented reason and and the software is designed to prevent leakage, and carefully monitored.

How you implement mechanisms to protect against these problems is likely to be hypervisor specific - Unfortunately I'm not very familiar with Xen (I've used it, but most of my experience is with VMWare) so I can't give you any practical advice in this regard.