Why the Hypervisor is the Crown Jewel to Protect
A hypervisor — VMware ESXi, Microsoft Hyper-V, KVM — is the software layer that creates and manages virtual machines. Every VM on a hypervisor host is subject to the security state of that host. A compromised hypervisor gives an attacker god-mode access to every VM: the ability to read memory, extract credentials, intercept network traffic, and persist invisibly beneath the operating systems. ISO/IEC 27001:2022 Annex A.8.23 addresses web filtering and network controls, but virtualisation management — governing ESXi hosts, vCenter, and VM configurations — falls under A.8.8 (technical vulnerability management) and A.8.9 (configuration management). CERT-In expects that all IT infrastructure, including virtualisation platforms, is under the same governance framework as physical infrastructure. In practice, virtualisation is the most commonly neglected layer.
Hypervisor Security — Critical Controls Checklist
| Control | VMware vSphere | Hyper-V / KVM |
|---|---|---|
| Management network isolation | vCenter on dedicated VLAN | SCVMM / oVirt on mgmt VLAN |
| Host patching | ESXi patches via vSphere Lifecycle Mgr | Windows Update / WSUS for Hyper-V |
| CIS Benchmark | CIS VMware ESXi Benchmark | CIS Hyper-V Server Benchmark |
| Authentication | vCenter SSO with AD + MFA | Windows Auth + MFA via Azure AD |
| VM communication channels | Disable floppy, serial, parallel ports | Disable legacy hardware in VM config |
VM Isolation: Preventing Escape and Lateral Movement
VM-to-VM communication that does not go through a managed vSwitch is a security gap. Configure your virtual switches with the same rigour as physical switches: VLAN tagging, promiscuous mode disabled, forged transmit disabled, and MAC address changes disabled. VMs handling regulated data (DPDP personal data, financial records) must be on dedicated VLANs and must not share virtual network adapters with lower-classification VMs.
Snapshot Management: The Compliance Landmine
VM snapshots are powerful for recovery — but they are also a significant compliance and operational risk. Snapshots consume growing amounts of storage, can contain sensitive data in a state that bypasses backup policies, and are frequently forgotten. Compliance issues: long-running snapshots may contain personal data (DPDP) outside your documented data retention policy. Operational issues: a snapshot chain older than 72 hours on a production VM significantly increases the risk of datastore corruption. Policy requirement: no VM snapshot should remain active in production for longer than 48 hours without a documented justification. Automate alerts for snapshots older than this threshold.
vMotion and Live Migration Security
Live VM migration (vMotion in VMware, Live Migration in Hyper-V) transmits the entire memory state of a running VM across a network connection. If this occurs on a shared network, the memory content — including encryption keys, passwords, and sensitive data — is transmitted in plaintext. vMotion traffic must be encrypted (VMware vSphere supports Encrypted vMotion) or must occur on a dedicated, isolated network link. This is a direct data-in-transit security requirement under ISO 27001 A.8.24.
Virtualisation Security On-Site Assessment
InfraVeritas 360 assesses your hypervisor hardening, VM isolation, vMotion security, and snapshot policy as part of every on-site IGaaS engagement — mapping findings to ISO 27001, CERT-In, and DPDP requirements.
Assess Your Virtualisation Security →