RootUsers

In this post we’ll determine requirements and scenarios for implementing shielded VMs. In a traditional environment where virtual machines run on a hypervisor host, it’s possible for the administrator of the virtualization layer to get full access to the virtual machines.

For example if you buy a VPS from a provider, you are given access to the guest operating system. It is technically feasible for a malicious or compromised administrator account to gain access to the virtual machine.

This is where shielded VMs in Windows Server 2016 come in to save the day.

By determining the requirements and scenarios for implementing shielded VMs we can gain an understanding of how shielded VMs can be used to secure a virtual machine.

This post is part of our Microsoft 70-744 Securing Windows Server 2016 exam study guide series. For more related posts and information check out our full 70-744 study guide.

Scenarios for Shielded VMs

First let’s discuss why you would want to implement shielded VMs. Put simply, making use of shielded VM’s ensures that only the administrative users of the virtual machine guest itself have any kind of access to it. A virtual machine is essentially a file, a file that can be copied and run on an external system by an attacker who can then gain access to the operating system within.

Without the use of shielded VMs, it is possible for a compromised or malicious administrator account to do all sorts of things, including attaching a debugger to the VM, copying the virtual hard drive file, access the VM console, or even inject malware onto the Hyper-V host or into the disk of a VM template ensuring that it’s present in the next VM built off of it.

These activities are mitigated by configuring a shielded VM and will therefore not be possible.

Requirements for Shielded VMs

Now that we have an understanding of what’s on offer with shielded VMs, let’s take a look at the requirements for implementing them.

• Host Guardian Service (HGS): HGS provides key protection and attestation to ensure shielded VMs can only be run by Hyper-V hosts that are allowed and considered to be healthy. This is generally a cluster containing three nodes. HGS provides attestation and key protection. Attestation ensures that only trusted guarded Hyper-V hosts are allowed to run shielded VMs, while the key protection provides the keys needed to turn on the shielded VM.
• Guarded Hosts: The shielded VMs will only run on guarded hosts, these are approved and valid Hyper-V hosts that the shielded VM is allowed to run on. Migration traffic is also encrypted when migrating a shielded VM between two guarded Hyper-V hosts.
• Generation 2: Shielded VMs require that a virtual machine be a gen 2 VM. This means that the guest operating system within the VM must be Windows Server 2012 R2 or greater. The Hyper-V host itself must be running Windows Server 2016.
• Virtual TPM: Shielded VMs use BitLocker to encrypt the contents within the virtual hard drive (VHD) file of the virtual machine. BitLocker keys required to run the VM and decrypt its associated drives are secured with the VM’s virtual TPM. As the disk file itself is encrypted, even if a fabric administrator copies the virtual hard disk file they will not be able to access it.

Summary

Use of a shielded VM is a great way of protecting a virtual machine from the hypervisor host itself or the account of a malicious or compromised administrator. Now that we can determine requirements and scenarios for implementing shielded VMs, we’ll take a look at configuring shielded VMs in a future post.

This post is part of our Microsoft 70-744 Securing Windows Server 2016 exam study guide series. For more related posts and information check out our full 70-744 study guide.