 4/5/6 Hypervisor Layer 3 Router Router Router Layer 2 Switch Switch Switch Load Balancer Load Balancer Load Balancer Layer 4/5/6 Hypervisor Layer 7 Layer 1 Physical 1 Virtual FIGURE 9.11 Hypervisor and operating system security. The diagram depicts the example of a web application where the web server and application server are running as two separate VMs on the same hypervisor. The traditional networking functions- like the router, switch, and load balancer in the diagram-may also be VMs on the same hypervisor. The network is now traversing virtual links within a single hypervisor. While the end result maybe exactly the same, from a security monitoring perspective the ability to discern these components, the interrelationships between them, and the ability to place controls on them and in the network paths between them, requires a new way of operating. Mitigation strategies for the three new challenges: Isolation. Requires creating a baseline for secure configuration of the hypervisor and par- titioning strategies such as the separation of workloads with internal- and external-facing workloads. Relationships. Requires correlating real-time asset inventory data from multiple sources to depict the nature of components in the stack and the network traffic channels between them. This understanding can then enable the placement of more effective security con- trols into the environment. Uniqueness. The process of capturing real-time asset inventory must account for the dynamic nature of assets in a cloud ecosystem. Typically, organizations use some sort of global identifier value to reliably track assets over time. The introduction of network virtualization further accentuates the importance of maintaining comprehensive asset inventories. As the volume of network traffic originating and terminating within a single hypervisor increases, it will become critical to understand all the assets dependent upon that hypervisor. This type of understanding will only be possible with robust inventories that maintain adequate in