Virtualization brings new protections, but also new risks.  One basic danger is the possibility of guest-to-host attacks.  Some businesses have to host virtual machines from several businesses or users, some of which may not be trustworthy, on the same host system.  Recently, Microsoft discovered and patched a vulnerability in its Virtual PC and Virtual Server products that would allow a guest virtual machine to gain administrative access and thus gain access to the other virtual machines living on the system. 

The key here is that Microsoft patched the flaw -- thus, the single most important thing you can do to secure a VM is the same as any system -- to make sure your underlying operating system software is patched and up to date.  Its also important to remember that the host administrator has the equivalent of physical access to all guest VMs in most virtualization schemes, so avoid use of VMs on potentially malicious hosts.

Don Simard, the commercial solutions director at the U.S. National Security Agency, also warns that attacks on system hardware itself could eventually pose a threat.  He explains, "graphics cards and network cards today are really miniature computers that see everything in all the VMs."

Mr. Simard says that while no such attacks currently exist (to his knowledge), it is important to keep your firmware up to date.  AMD and Intel's latest CPU offerings not only offer improved virtualization support, but also new protections against improper hardware use.  These products allow you to set permissions of what flows of data between hardware devices are not allowed.  If you have the latest hardware and the you spend the time to manage these permissions, you can sufficiently safeguard yourself for even the most demanding security-essential networks.

Another solid rule of thumb is to not become overly comfortable due to the isolation of the virtual machines.  While it may be hard to break that layer, failing to patch or maintain the latest security software on individual virtual machines opens the door to losing information on those machines, and potentially more dangerous attacks like those previously mentioned.  Via security software, firewalls (as needed), and patching, you can ensure that your virtual machines each receive an appropriate level of protection.

A final consideration, is that even if your virtual machine is fully secured and your host server is well maintained, you often need to prove it.  Regulatory mandates such as the Payment Card Industry data security standards (PCI DSS), federal Health Insurance Portability and Accountability Act healthcare security requirements, or the European Union's data-privacy rules require careful accounting.  For this reason logging software like RSA enVision, virtual machine management suites, and configuration management software can be valuable assets both for simplifying internal security and proving compliance.

Ultimately, virtual machines tend to improve security.  If a single OS gets infected with viruses or malware, it can be quarantined and will be less likely to be able to infect the other virtual machines on the host.  Furthermore, one of the virtual machine's most powerful and potentially risky components -- the hypervisor -- is protected due to its inherent complexity and the fact that only three vendors in the world -- Xen, Microsoft, and VMware -- have written one.  Thus the lack of knowledge on them represents a degree of protection. 

The other key layer that touches all the VM's on a system and could be potentially compromised to give access to them, the security layer, represents a greater potential risk.  However, as previously mentioned, by properly firewalling network-connected VM's and keeping VM's antivirus software and patching up to date, attacks on guest can be minimized.  And by implementing the latest security steps available on recent hardware, keeping your firmware up to date, and patching your virtualization host software, you can protect the insulating level below as well.