Virtualization Tools ให้สิทธิ์อะไรบ้าง? ทำไมถึงเสี่ยง?
เมื่อผู้ใช้ (User/Dev/Admin) มีสิทธิ์ใช้ Virtualization Tools เช่น VMware Workstation, VirtualBox, Hyper-V, Docker, Kubernetes (kubectl), Vagrant, Terraform, Cloud Console (AWS/Azure/GCP) → พวกเขาสามารถ:
- สร้าง VM/Container เอง (Shadow IT)
- ตั้งค่า Network (Bridged, NAT, Host-only, Custom VNet)
- Mount Host Filesystem / Device
- Snapshot/Clone/Export VM (Data Exfiltration)
- Run Privileged Containers (--privileged, Host PID/Network Namespace)
- Bypass Host Firewall/EDR ผ่าน VM Network Stack
- Nested Virtualization (VM ใน VM) ซ่อนกิจกรรม
Network Security Controls ที่จำเป็น (Required Controls)
1. Hypervisor/Host Level Hardening (Foundation)
- Disable Unused Features: Shared Folders, Drag-and-Drop, Copy-Paste, USB Passthrough, Serial Ports
- VM Isolation: ไม่ให้ VM เข้าถึง Host Network โดยตรง (ใช้ NAT/Host-only แทน Bridged)
- Resource Limits: CPU, RAM, Disk, Network Bandwidth Quotas (QoS)
- Secure Boot / Measured Boot: UEFI Secure Boot, TPM, vTPM สำหรับ VM
- Encrypted VMs: Encrypt VM Disks (BitLocker, LUKS, vSphere VM Encryption)
- Hypervisor Patch Management: อัปเดต ESXi, Hyper-V, KVM, Docker Engine, containerd เป็นประจำ
2. Network Segmentation & Micro-segmentation
| Control | Implementation | Tools |
|---|
| VLAN / VXLAN Segmentation | แยก VM/Container ตาม Workload (Dev, Test, Prod, Mgmt) | Physical Switch, vSwitch, Distributed Switch, OVS, Cilium |
| Micro-segmentation | Policy ต่อ Workload/VM (East-West Traffic Control) | VMware NSX, Cisco ACI, Calico, Cilium, Illumio, Guardicore |
| Distributed Firewall | Firewall ที่ Hypervisor Level (Kernel/VFP) รองรับ L2-L7 | NSX Distributed FW, Azure NSG, AWS SG, GCP Firewall, Cilium |
| Service Mesh (mTLS) | Encrypt + Auth Service-to-Service ใน K8s | Istio, Linkerd, Consul Connect, Cilium |
3. Virtual Network Security Policies
- Default Deny: Block All Ingress/Egress → Allow List เฉพาะที่จำเป็น
- Egress Control: จำกัด Outbound Internet (Proxy, DNS Filter, Allowed FQDN/IP List)
- Inter-VM Traffic Inspection: Mirror Traffic → IDS/IPS/NDR (Tap/SPAN/ERSPAN/Geneve)
- Network Policy (K8s): `NetworkPolicy` + CNI (Calico, Cilium, Weave) Enforce Pod-to-Pod
- Zero Trust Network: Identity-based (SPIFFE/SPIRE), mTLS Everywhere, No Implicit Trust
4. Access Control & Governance (Who Can Do What)
| Control | Description | Implementation |
|---|
| RBAC (Role-Based Access Control) | สิทธิ์ตาม Role (VM Operator, Network Admin, Security Admin, Auditor) | vCenter RBAC, Azure RBAC, AWS IAM, GCP IAM, Kubernetes RBAC |
| ABAC (Attribute-Based) | สิทธิ์ตาม Attribute (Time, Location, Device Posture, Risk Score) | Azure AD Conditional Access, AWS ABAC, Google BeyondCorp |
| Privileged Access Management (PAM) | Just-in-Time (JIT) Access, Session Recording, Approval Workflow | CyberArk, BeyondTrust, Thycotic, HashiCorp Boundary, Azure PIM |
| Infrastructure as Code (IaC) Governance | Policy as Code บน Terraform/ARM/Bicep/Helm | OPA/Gatekeeper, Checkov, tfsec, Sentinel, Kyverno |
| Change Management | Approval, Testing, Rollback Plan, Audit Trail | ServiceNow, Jira, GitOps (ArgoCD, Flux) + Policy Checks |
5. Monitoring, Logging & Threat Detection
- Hypervisor Logs: ESXi (vmkernel.log, hostd.log), Hyper-V (Event Logs), KVM (libvirt logs, auditd)
- VM/Container Logs: Centralized Logging (Fluentd/Fluent Bit → Elastic/Splunk/Loki)
- Network Flow Logs: VPC Flow Logs (AWS), NSG Flow Logs (Azure), VPC Flow Logs (GCP), NetFlow/IPFIX từ vSwitch
- Runtime Security (Container): Falco, Sysdig, Tracee, Tetragon (eBPF-based) - Detect Exec, File Write, Network Connect, Capability Use
- Cloud Security Posture Management (CSPM): Wiz, Orca, Lacework, Prisma Cloud, Defender for Cloud, ScoutSuite (Open Source)
- Kubernetes Security Posture (KSPM): kube-bench, kubescape, Polariss, Kyverno Policies
6. Image/Container Supply Chain Security
- Image Signing & Verification: Cosign/Sigstore, Notary, Docker Content Trust
- Base Image Hygiene: Distroless, Chainguard, Wolfi, Minimal Base Images
- SBOM (Software Bill of Materials): Syft, SPDX, CycloneDX - Generate & Consume
- Vulnerability Scanning (CI/CD): Trivy, Grype, Snyk, Aqua, Anchor, Clair
- Admission Control: Kyverno, OPA Gatekeeper - Block Unsigned/Non-compliant Images
- Runtime Attestation: AMD SEV-SNP, Intel TDX, Azure Confidential Computing, AWS Nitro Enclaves
7. Data Protection & Recovery
- Backup/DR: VM Backup (Veeam, Commvault, Rubrik, Velero for K8s), Immutable Backup
- Snapshot Management: Retention Policy, Quiesced Snapshots, Off-site Copy
- Encryption at Rest: vSphere VM Encryption, Azure Disk Encryption, AWS EBS Encryption, GCP CMEK
- Key Management: HSM, Cloud KMS, HashiCorp Vault, Thales CipherTrust
Shared Responsibility Model ใน Virtualization/Cloud
| Layer | Provider Responsibility | Customer Responsibility |
|---|
| Physical / Hypervisor | Hardware, Hypervisor Patching, Physical Security | Guest OS, Apps, Data, Network Config, Identity, Access |
| Container Orchestration (Managed K8s) | Control Plane, Node Patching (Optional), Network Fabric | Worker Node Config, Pod Security, Network Policy, RBAC, Images |
| Serverless / FaaS | Runtime, Scaling, Network, OS | Code, Dependencies, Permissions, Data, Secrets |
สรุป: Checklist สำหรับ Admin/Security Team
- [ ] Harden Hypervisor/Host (Disable unused, Patch, Encrypt, Secure Boot)
- [ ] Network Segmentation (VLAN/VXLAN, Micro-segmentation, Distributed FW)
- [ ] Default Deny Network Policy (Ingress/Egress, Service Mesh mTLS)
- [ ] RBAC + PAM + JIT Access (Least Privilege, Audit Trail)
- [ ] IaC Governance (Policy as Code, GitOps, Drift Detection)
- [ ] Comprehensive Logging (Hypervisor, VM, Network Flow, Container Runtime)
- [ ] Detection (NDR, CSPM, KSPM, Runtime Security/eBPF)
- [ ] Supply Chain Security (Sign, Scan, SBOM, Admission Control, Attestation)
- [ ] Backup/DR/Encryption/Key Management (Test Restore!)
- [ ] Regular Red Team / Pen Test / BAS ต่อ Virtualized Environment
