Boo! IBM PHANTOM to Prevent VM Security Scares
Why hack just one box, when you can compromise several VMs? That's the thinking IBM is trying to prevent with a new project with secretive origins...
IBM set to lock down virtual machines with PHANTOM project - Ars Technica
Quote:
From what IBM has revealed, and again, details are scarce, PHANTOM is aimed at locking down the hypervisor so that it's more resistant to intrusion. As the company puts it, most enterprise security technologies are aimed at locking down traditional networks of single-OS machines. But PHANTOM starts with the assumption that the OS is virtualized and then goes from there.
One key component of this hypervisor-level technology is its ability to view and monitor the complete state of every guest OS. Instead of just looking for compromised binaries, like traditional antivirus software, it looks for compromised virtual machines. It also monitors network traffic into and out of the virtual machines, looking for suspicious patterns that might indicate that a virtual server is being controlled by an intruder.
Any guesses as to IBM's techniques? Oh, and I learned something new about the Xbox 360 and PS3.
