📖 What is Hypervisor?
Hypervisor is a layer of software that creates and runs virtual machines by isolating the operating system and applications from the underlying physical hardware. It manages the distribution of physical resources like CPU, memory, and storage among the VMs.
"Be prepared for questions on 'VM Escape,' where an attacker breaks out of the guest VM to access the hypervisor or other VMs."
📚 Certification: CCSP (CCSP)
🔑 What are the Key Concepts of Hypervisor?
- ▸ Type 1 hypervisors run directly on physical hardware, providing better performance and security by reducing the attack surface compared to hosted Type 2 hypervisors.
- ▸ Resource isolation ensures that guest VMs cannot access each other's memory or CPU cycles, preventing data leakage and ensuring stability in multi-tenant environments.
- ▸ VM Escape occurs when an attacker leverages a vulnerability to break out of a guest VM, gaining unauthorized access to the underlying hypervisor or other VMs.
- ▸ The hypervisor acts as a hardware abstraction layer, allowing multiple diverse operating systems to run concurrently on a single set of physical hardware resources.
- ▸ Management tools allow administrators to perform live migrations, snapshots, and resource allocation, which are critical for maintaining high availability in cloud infrastructures.
🎯 How does Hypervisor appear on the CCSP Exam?
You may be asked to identify the most secure hypervisor architecture for a high-performance production environment, where you must choose Type 1 over Type 2 to minimize overhead.
A scenario might describe a multi-tenant cloud environment where a vulnerability allows a user to access the host system; you will need to identify this as a VM Escape attack.
Expect questions regarding the shared responsibility model, specifically focusing on who is responsible for patching the hypervisor in an IaaS model versus a PaaS or SaaS model.
❓ Frequently Asked Questions
Why is a Type 1 hypervisor generally considered more secure than a Type 2 hypervisor?
Type 1 hypervisors eliminate the need for a host operating system, which removes a significant layer of potential vulnerabilities and reduces the overall attack surface available to an attacker.
How does hypervisor-based isolation differ from container-based isolation?
Hypervisors provide full hardware virtualization and separate kernels for each VM, whereas containers share the host's OS kernel, making hypervisors inherently more isolated and secure.
What is the primary risk associated with 'over-provisioning' resources via the hypervisor?
Over-provisioning can lead to 'noisy neighbor' syndromes, where one VM consumes excessive physical resources, causing performance degradation or denial-of-service for other VMs on the same host.