Overview
ISO/IEC 21878:2018 - "Information technology - Security techniques - Security guidelines for design and implementation of virtualized servers" provides guidance for secure design and implementation of virtualized servers (VSs). It targets organizations deploying VSs in data centres and cloud environments and aims to help architects, VS administrators and security teams make informed decisions about virtualization security. The standard addresses design considerations, risk identification and mitigation, and implementation recommendations for typical server virtualization deployments.
Key topics and technical focus
- Scope and exclusions: Covers server virtualization (hypervisors, virtual machines, management subsystem, hardware, optional host OS). Excludes desktop, OS, network and storage virtualization, and vendor attestation claims.
- Types of virtualization: Differentiates full vs para‑virtualization and Type‑1 (bare‑metal) vs Type‑2 (hosted) hypervisors.
- Components and terminology: Defines VMs, VMM (virtual machine manager), hypervisor, golden image, domain, management subsystem and VS administrator.
- Threats and VS‑specific risks: Identifies common threats and risks to VMs, hypervisors and operational processes (including cloud service considerations).
- Secure lifecycle guidance: Recommendations across lifecycle phases - initial preparation, planning and design, implementation, and disposition.
- Implementation checklist and vulnerability guidance: Provides a security checklist and guidance for reducing vulnerability exposure during deployment.
- Supporting guidance: Includes informative annexes (risk assessment for VSs and implementation guidance for checklist items).
Practical applications and who should use it
- Cloud service providers (CSPs) and managed service operators designing multi‑tenant virtualized infrastructures.
- Enterprise IT and data centre teams securing internal virtualization platforms and workloads.
- Security architects and compliance officers evaluating virtualization risk, hardening hypervisors, and defining secure configuration baselines (golden images).
- System integrators and solution designers implementing VS solutions that require documented security controls.
- Auditors and assessors using the standard to benchmark virtualization security practices against recognized guidelines.
Practical uses include designing VM isolation strategies, hardening hypervisors, creating secure management subsystems, applying lifecycle controls (patching, image management, decommissioning), and integrating virtualization risk assessments into broader IT risk programs.
Related standards
- ISO/IEC 17788 (Cloud computing - Overview and vocabulary) is referenced for terminology and cloud context.
Keywords: ISO/IEC 21878:2018, virtualized servers security, server virtualization security, hypervisor security, VM isolation, virtualization risk assessment, golden image, virtual machine manager.
Open preview (PDF)Information technology — Security techniques — Security guidelines for design and implementation of virtualized servers
