I've been thinking about virtualization for security for some time. However, my need is to be able to better secure domain controllers at remote locations. At the moment, DCs at a remote locations are vulnerable because there is insufficient physical security. If we could virtualize the DC and then restrict access to the virtual machine to domain admins only we securely deploy DCs (and other such infrastructure).

To do this the virtualizing software would need to support encryption of the virtual machine and some form of ACL restricting access (perhaps using certificates). The security would need to robust enough that even if the physical box is compromised the virtual machine is still protected.

Sure this wouldn't prevent someone doing a DOS - there's not much that can if they have physical access to the box. I can even live with the DC being destroyed. I just want to be sure that AD is secure.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/397/33499#33499