0

In comparison to a physical server, is there any special security vulnerability in virtual servers for purpose of hosting several websites?

For example, can the fact that there is not any hardware firewall make problems? What about the pears that have (somehow) access to the same server.

Is this generally a bad idea to setup several web hosting services on a VPS?

A big appreciation for your kind reply.

2 Answers 2

3

Generally, no. There are no differences in the way you should approach security in a VM than on a physical box. (With a few exceptions.)

Your suggestion that untrusted people might have access to the physical hardware applies to VMs and bare metal equally. Unless you run your own data centre, you will have to trust your hosting provider to manage physical security. Trust, but verify.

There have been some "side channel" attacks on cryptography in virtual machines. This is my favourite write up. This could affect your SSL keys if you have any. You can avoid that particular problem by terminating your SSL at the load balancer (AWS can do this with their ELBs, other providers will have different acronyms). This is not a particularly great threat; very few people have the skill to manage this and you are not likely a target of high enough value.

Hardware firewalls are available in cloud providers, although not necessarily in yours. Using AWS again as an example, a Security Group is a firewall that is external to your VM. Using these you can enforce network restrictions between hosts on your network that even an intruder with root access on both boxes would not be able to overcome.

1
  • Thank you so much. I didn't mean exactly physical access. Surely I can trust my datacenter. But your answer was helpful. Thanks again.
    – Sheric
    Mar 1, 2013 at 6:27
2

Assuming you go with a reputable hosting provider, then no, there's really not much of a difference.

Theoretically, the possibility exists that some unpatched vulnerability in the host OS or virtualization software would allow shared peers to gain unauthorized access but today's virtualization solutions use protections built into the CPU to guard against this.

There was a demonstration of an attack which bypassed those hardware protections made a few months ago (google "VM side channel attack") but I haven't heard of it actually being exploited and I'm assuming the major VM vendors have mitigated that possibility by now.

You should still use software-based network and application firewalls if your security stance calls for it but those are as robust of a solution as their hardware-based counterparts.

So like everything else in security, it's always a cat-and-mouse game where black and white hats are trying to find new ways to exploit existing systems but unless you have very high security requirements most people agree that the security risk of hosting on a virtual server isn't appreciably higher.

Some hosting companies like Amazon for example have ISO 27001 Certification which indicates that their security practices were thoroughly audited by a third party.

1
  • 1
    Seems that I should just stop thinking about the difference since these kind of attach are so costly and hard that don't worth doing them in my scale of work :)
    – Sheric
    Mar 1, 2013 at 6:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .