 the work group, and to the enterprise data center. This multilayered protection model is dependent on intelligent and dynamic provisioning and orchestra- tion to enable the cohesive and elastic security protections. 9.6 TOPICS FOR FURTHER STUDY This section highlights the potential for future research and development to address hypervisor vulnerabilities. Hypervisor hardening and VM nonisolation are research and development domains required to address hypervisor vulnerabilities. Realizing that stranded resources could become an issue when isolating VMs to create separation of internal and externally exposed resources, we are preparing to shift to a hardened hypervisor to remove requirements for isolation. Key components of this hardening will be the use of trusted execution, expanded patching lifecycle, privilege escala- tion detection, CPU affinity, cache-coloring, among others. Trusted execution. VM validation/along with platform validation at time of instantiation will ensure the correct VMs are spun up, and spun up on the appropriate hypervisor [6]. Expanded patching lifecycle. Utilizing smart patching techniques for only updating patches for packages installed, utilizing image patching with VM replacement, and other techniques we expect to harden our VMs just as much as the hypervisor. Privilege escalation detection. Auditing and logging of executed commands in user space will allow us to detect when programs have been run without proper authorization. Building the Network of the Future CPU affinity/anti-affinity. Instead of using server isolation, we can isolate VMs by CPU core groups, in order to achieve certain levels of side-channel attacks. Cache-coloring. Many of the published side-channel attacks use the shared L3 cache on the CPU, projects like SteathMem have found a way to use cache-coloring to incapacitate these types of attacks [7]. ACKNOWLEDGMENTS Many of our colleagues in the Chief Security Organization made significant contribution to this chapter. We would like to acknowledge their contributi