Essential Eight RA-ML2.3 Privileged environments are not virtualised within unprivileged environments
What it says
Privileged operating environments are not virtualised within unprivileged operating environments.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure that secure environments are not run within less secure ones.
This control is about making sure that our secure computer environments aren't run within less secure ones. Imagine putting a secure, locked box inside a flimsy, open one. If someone breaks into the outer box, they could easily get into the inner one. This control keeps our most important parts of the system safe from prying eyes and potential attacks.
Free. Save your status, tasks and notes.
Why it matters
Running privileged VMs inside unprivileged hosts increases the chance a host compromise leads to privileged environment takeover and data exposure.
How to implement
The IT team should identify all current instances where privileged environments might be run within unprivileged environments by conducting a thorough review of the virtualisation setups across the organisation.
The system administrator should ensure that separate virtual machines are used for privileged environments, thereby preventing them from being nested within less secure environments.
This can be achieved by configuring servers to run different virtual machines based on user privilege levels.
Security officers should regularly review virtualisation practices to ensure compliance with security policies.
They can do this by scheduling monthly audits of virtual machine configurations.
The IT manager should establish a policy that mandates the separation of privileged and unprivileged virtual environments.
This can be done by updating the organisation's IT security policy and distributing it to all relevant personnel.
Keep it running
Audit hypervisor and VM configs to ensure privileged environments are never nested or hosted within unprivileged environments; remediate any exceptions found.
Evidence and audit
- Check 1 of 1What an auditor asks for
Ask for
What measures are in place to ensure that privileged environments are not virtualised within unprivileged environments?
Look at
Examine virtual machine and server configurations to see how environments are set up. Check for documents that outline virtualisation policies.
Good evidence
Configurations ensure privileged environments are separate, with documented policies and regular checks in place to maintain separation.
Mappings
Closest match in ASD Information Security Manual: ISM-1687, Prevent virtualisation of privileged environments, which asks for the same thing.
ASD Information Security Manual: 3 mappings
This control is equivalent to ISM-1687.
E8-RA-ML2.3 requires that privileged operating environments are not virtualised within unprivileged operating environments to prevent privilege boundary collapse. ISM-1687 states the same requirement using essentially identical language and intent. Both controls focus on preventing an unprivileged host from constraining or inspecting a privileged guest (or vice versa) by disallowing that virtualisation arrangement.
- ISM-1380Privileged users work in separate privileged and unprivileged operating environmentsPartially meets
This control partially meets ISM-1380.
E8-RA-ML2.3 requires that privileged operating environments are not virtualised within unprivileged operating environments to maintain strong separation between privilege tiers. ISM-1380 supports this by mandating that privileged users operate using separate privileged and unprivileged environments, which reduces the likelihood that administrators run privileged sessions inside less trusted contexts. ISM-1380 is broader in user practice and operational separation, while E8-RA-ML2.3 is a specific prohibition on a virtualisation hosting pattern.
This control supports ISM-1689.
E8-RA-ML2.3 requires that privileged operating environments are not virtualised within unprivileged operating environments to avoid exposure of privileged contexts to untrusted hosts. ISM-1689 supports this goal by preventing privileged user accounts from logging on to unprivileged operating environments, limiting administrative activity on lower-trust systems. ISM-1689 is an account logon restriction, whereas E8-RA-ML2.3 is about the virtualisation relationship between operating environments.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.