Software makes virtual servers a moving target

Techniques for managing virtual servers that limit the damage hackers can inflict

Carefully managed virtual servers can make the job of attackers more difficult by reducing the time that any one version of a server is exposed to the Internet, according to a George Mason University professor who has developed software that phases virtual servers in and out of use.

By limiting how long virtual servers remain online and synchronizing their replacement with fresh servers, businesses can cut the damage hackers inflict, says Arun Sood, a computer science professor at the school.

His software, called Self Cleansing Intrusion Tolerance, or SCIT, resides on physical servers and coordinates the life cycle of the virtual servers. Sood has started privately funded SCIT Labs to create a commercial SCIT product.

Traditional physical servers are exposed to the Internet for months on end, providing a vast window of opportunity for attackers, Sood says. "You can call them overexposed or you can call them sitting ducks," he says.

SCIT-controlled virtual servers can be scheduled for exposures lasting just seconds before being shut down.

Sood supports layered network defenses, and says he is not trying to displace intrusion prevention systems or other security systems that seek to block attacks. But because these other systems don't block all malicious behavior, he is working toward intrusion tolerance - systems that keep functioning and fix themselves even when they are attacked.

"I'm not smart enough to keep people out of the system," Sood says, "but I'm going to try my best to limit the damage they can do."

Sood says his technology will make successful attacks harder and will reduce their number. "If you take a server offline every minute, the intruder has just one minute to play games," he says.

Timing capabilities within SCIT manage the life cycles of virtual servers, making sure some server is always available so that service is uninterrupted, Sood says. To client machines, SCIT-ized virtual servers appear as if they are a single server.

SCIT is best suited to servers with short transaction times and has been tested with DNS, Web and single-sign-on servers, he says, which can perform effectively even if each virtual server is in use for just seconds, he says.

Once a server has been in use for the prescribed period, it is taken offline where it can be killed. The SCIT Controller generates replacement virtual servers from a server image of known state. Used virtual servers can be analyzed before they are killed to look for whether any attacks were carried out against them. They can also be saved but kept offline for future reference, Sood says.

SCIT can further complicate the job of hackers by generating replacement virtual servers that perform the same function from different platforms. So the server being taken offline may have Linux as an operating system and the one replacing it may have Windows. Or one may be BIND DNS while the replacement is Microsoft DNS server. He calls this strategy security by diversity.

So far Sood has used VMware as the platform to create the virtual machines and claims any other virtualization software would work as well.

Sood says he has applied for four patents on SCIT.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Tim Greene

Network World
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?