Broadcom adds hypervisor protection to VMware

Broadcom adds hypervisor protection to VMware

Citing the growing speed and volume of artificial intelligence-enabled attacks, Broadcom Inc. today introduced VMware HyperArmor, software that protects the hypervisor underlying VMware Cloud Foundation and gives administrators more time to test and deploy security patches.

Announced at VMware Explore in Frankfurt, HyperArmor targets two common routes into virtualized infrastructure: stolen root credentials and unpatched vulnerabilities. It combines host-level virtual patching, controls on executable programs and scripts and multifactor authentication for remote access to VMware ESX hosts.

Broadcom executives said the product responds to attacks that are accelerating faster than enterprises can update infrastructure software.

“You don’t have enough time to triage a single alert, and you can’t apply patches at machine speed,” said Prashanth Shenoy, chief marketing officer and vice president of marketing for cloud platform, infrastructure and solutions at Broadcom.

HyperArmor operates directly at the ESX layer, which runs directly on a physical server to support virtual machines. Protecting the hypervisor is important because it undergirds all workloads that depend on that host.

The virtual patching capability is designed to detect and block malicious actions without modifying the underlying infrastructure software. Broadcom said it requires neither host reboots nor software upgrades to mitigate vulnerabilities, allowing infrastructure teams to schedule testing and installation of official patches.

Eric Chen, a Broadcom distinguished engineer who was involved in building HyperArmor, emphasized that the protection gives administrators breathing room rather than eliminating the need to update their systems.

“We always still want you to patch; that is the right thing to do, but this basically buys you time,” Chen said. He added that customers face a steady flow of patches across their environments and want help reducing the pressure to deploy each update immediately.

HyperArmor also establishes a baseline of permitted activity on ESX hosts, which run a relatively small, fixed collection of processes. It inventories existing scripts and runs them automatically, requiring administrators to approve new scripts. Unauthorized executables and scripts are blocked by default.

That approach differs from security tools protecting general-purpose applications, Chen said. Because Broadcom knows which processes should run on the hypervisor, it can enforce restrictions directly within the host rather than relying solely on network inspection.

Minimal overhead

Broadcom said the product continuously monitors host processes and behavior with minimal performance overhead. It doesn’t require security agents inside individual guest virtual machines.

The third component integrates multifactor authentication into the ESX Secure Shell login process. Users must provide standard SSH credentials and then complete a time-based one-time password challenge tied to a separate identity. Broadcom said that prevents someone who obtains a root password from reaching the command line without the second factor.

HyperArmor complements VMware vDefend, which provides security at the network and workload level. That includes microsegmentation, traffic inspection and network-level virtual patching. VMware Avi Load Balancer protects web applications and application programming interfaces.

“HyperArmor is at the ESX host layer,” Shenoy said. “VDefend acts at the network and workload layer, along with the Avi web application firewall.”

Cloud Foundation already includes centralized identity management, encryption and live patching that applies critical hypervisor updates without taking workloads offline or putting hosts into maintenance mode. HyperArmor adds controls intended to protect the host while administrators prepare software patches.

Chen said the product emerged from conversations with customers attempting to build their own hypervisor protections and struggling to sustain the effort.

HyperArmor supports ESX 8.x and later releases, extending protection to customers preparing upgrades to newer VMware platforms. Customers can purchase it directly from Broadcom or through its partners and resellers, using the same sales channels available for VMware Cloud Foundation. Pricing wasn’t disclosed.

Image: VMware