Virtualization-based technologies have become ubiquitous in computing. While they provide an easy-to-implement platform for scalable, high-availability services, they also introduce new security issues. Traditionally, discussions on security vulnerabilities in server platforms have been focused on stand-alone (i.e., non-virtualized) environments. For cloud and virtualized platforms, the discussion focuses on the shared usage of resources and the lack of control over the infrastructure. However, the impact virtualization technologies can have on exploit mitigation mechanisms of host machines is often neglected. Therefore, this survey discusses the following issues: first, the security issues and challenges that are introduced by the migration from stand-alone solutions to virtualized environments—special attention is given to the Virtual Machine Monitor, since it is a core component in a virtualized solution; second, the impact (sometimes negative) that these new technologies have on existing security strategies for hosts; third, how virtualization technologies can be leveraged to provide new security mechanisms not previously available.; and, finally, how virtualization technologies can be used for malicious purposes.

One of the most challenging problems in computer security is formalization of vulnerabilities, exploits, mitigations and their relationship. In spite of various existing researches and theories, a mathematical model that can be used to quantitatively represent and analyze exploit complexity and mitigation effectiveness is still in absence.In this work, we introduce a novel way of modeling exploits and mitigation techniques with mathematical concepts from set theory and big O notation. The proposed model establishes formulaic relationships between exploit primitives and exploit objectives, and enables the quantitative evaluation of vulnerabilities and security features in a system. We demonstrate the application of this model with two real world mitigation techniques. It serves as the first step toward a comprehensive mathematical understanding and modeling of exploitations and mitigations, which will largely benefit and facilitate the practice of system security assessment.

No abstract

No abstract