Virtualisation manager (vCenter): what it is and how it is attacked
The console that administers every virtual machine host at once.
Also known as
- vCenter
- vSphere
- hypervisor manager
- cluster manager
- virtual infrastructure
Typing any of them into the editor finds this object.
Why it matters on a security diagram
It is a larger blast radius than any single host: one account here reaches every machine running on the cluster, and encryption applied at this level hits everything at once without an agent ever running inside a guest.
How it gets attacked, and what reduces it
How it gets attacked
- An administrator account, which is control of every guest at the same time
- Encryption applied from the host, which no in-guest tool sees coming
- Management left reachable from the ordinary staff network
What reduces it
- Keep management off the general network and behind separate administrative accounts
- Do not join it to the same directory as the estate it manages, or one compromise reaches both
- Alert on mass power operations and datastore changes, which is what an attack looks like from here
Where it sits
- Group
- Servers · Machines that run something for other machines.
- Whose side, by default
- Ours · Belongs to the organisation the diagram is about.
- Catalogue identifier
- virtualisation-manager
Reviewed . CC BY 4.0.
Others in servers
- Serverhost · machineA computer that runs something for other computers.
- Web serverHTTP server · websiteThe computer that sends your website to anybody who visits it.
- Application serverbackend · business logic tierRuns the working parts of an application, behind the website.
- DatabaseDB · SQL server · data storeStores the organised information an application depends on.
- Mail serveremail server · Exchange · SMTPSends, receives and stores the organisation's email.
- Name serverDNS · domain name serverTranslates names like example.com into network addresses.
- File serverSMB server · network shareHolds shared documents everyone can reach over the network.
- Virtual machine hosthypervisor · ESXi · Hyper-VOne physical server pretending to be many.
- Jump hostbastion · jump box · hardened admin hostThe single controlled machine administrators go through to reach sensitive systems.
- Backup serverbackup · Veeam · backup controllerMakes and manages the spare copies of your data that let you recover after something goes wrong.
- Update serverWSUS · patch server · software distributionDistributes software updates to every machine.
- Build pipelineCI/CD · Jenkins · GitHub ActionsThe automated production line that turns written code into the software the business actually runs.
- Phone systemVoIP · PBX · telephony serverRuns the organisation's telephone calls over the network.
The servers group lists all 14 of them side by side.
Virtualisation manager on your own diagram
Open the editor, press N, and type vCenter. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.
Open the diagram maker