{"id":18195,"date":"2015-05-11T16:30:00","date_gmt":"2015-05-11T16:30:00","guid":{"rendered":"https:\/\/aidanfinn.com\/?p=18195"},"modified":"2015-05-11T16:30:02","modified_gmt":"2015-05-11T16:30:02","slug":"ignite-2015-harden-the-fabric-protecting-tenant-secrets-in-hyper-v","status":"publish","type":"post","link":"https:\/\/aidanfinn.com\/?p=18195","title":{"rendered":"Ignite 2015 &#8211; Harden the Fabric: Protecting Tenant Secrets in Hyper-V"},"content":{"rendered":"<p><em>This post is HEAVY reading. It might take a few reads\/watches.<\/em><\/p>\n<p>This post is my set of notes from the <a href=\"https:\/\/channel9.msdn.com\/Events\/Ignite\/2015\/BRK3457\" target=\"_blank\">session<\/a> presented by Allen Marshall, Dean Wells, and Amitabh Tamhane at Microsoft Ignite 2015. Unfortunately it was on at the same time as the \u201cWhat\u2019s New\u201d session by Ben Armstrong and Sarah Cooley. The focus is on protecting VMs so that fabric administrators:<\/p>\n<ul>\n<li>Can power on or off VMs<\/li>\n<li>Cannot inspect the disks<\/li>\n<li>Cannot inspect the processes<\/li>\n<li>Cannot attach debuggers to the system<\/li>\n<li>Can\u2019t change the configuration<\/li>\n<\/ul>\n<p>This is to build a strong barrier between the tenant\/customer and the administrator \u2026 and in turn, the three-letter agencies that are overstepping their bounds.<\/p>\n<p align=\"center\"><iframe loading=\"lazy\" height=\"315\" src=\"https:\/\/channel9.msdn.com\/Events\/Ignite\/2015\/BRK3457\/player\" frameborder=\"0\" width=\"560\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<h3>The Concern<\/h3>\n<p>Security concerns are the primary blocker in public cloud adoption. It\u2019s not just the national agencies; people feature the operators and breached admin accounts of the fabric too. Virtual machines make VMs easier to move \u2026 and their disks to steal.<\/p>\n<p>The obvious scenario is hosted. The less obvious scenario is a private cloud. A fabric admin is usually the admin of everything, and therefore and see into everything; is this desirable? <\/p>\n<p>Now <a href=\"https:\/\/aidanfinn.com\/?tag=hyper-v\" target=\"_blank\">Hyper-V<\/a> is defending the VM from the fabric.<\/p>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image5.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb5.png\" width=\"500\" height=\"294\" \/><\/a> <\/p>\n<h2>What is a Shielded VM?<\/h2>\n<blockquote>\n<p>The data and state of a shielded VM are protected against inspection, theft, and tampering from both malware and data centre administrators)<\/p>\n<\/blockquote>\n<p>Who is this for?<\/p>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image6.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb6.png\" width=\"500\" height=\"267\" \/><\/a> <\/p>\n<p>The result of shielding is:<\/p>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image7.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb7.png\" width=\"500\" height=\"277\" \/><\/a> <\/p>\n<p>Note: BitLocker is used to encrypt the disks of the VM from within the guest OS using a virtual TPM chip.<\/p>\n<p>A service that runs outside of Hyper-V, the Host Guardian Service, is responsible for allowing VMs to boot up. Keys to boot the VM are only granted to the host when it is known and healthy &#8211; something that the host must prove. <\/p>\n<h2>FAQ<\/h2>\n<ul>\n<li>Can Azure do this? It doesn\u2019t have shielding but it encrypts data at rest.<\/li>\n<li>Can it work with Linux? Not yet, but they\u2019re working on it.<\/li>\n<li>What versions of guest OS? WS2012 and later are supported now, and they\u2019re working on W2008 and W2008 R2. There are issues because they only work in Generation 1 VMs and shielding is a Generation 2 feature.<\/li>\n<\/ul>\n<h2>Demo<\/h2>\n<p>Scenario is that he has copied the data VHD of an un-shielded vDC and mounted it on his laptop where he has local admin rights. He browses the disk, alters ACLs on the folders and runs a scavenge &amp; brute force attack (to match hashes) to retrieve usernames and passwords from the AD database. This sort of attack could also be done on vSphere or XenServer.<\/p>\n<p>He now deploys a shielded VM from a shielded template using Windows Azure Pack &#8211; I guess this will be Azure Stack by RTM. Shielding data is the way that administrator passwords and RDP secrets are passed via a special secure\/encyrpted package that the \u201choster\u201d cannot access. The template disk is also secured by a signature\/hash that is contained in the package to ensure that the \u201choster\u201d has not altered the disk.<\/p>\n<p>Another example: a pre-existing -non-shielded VM. He clicks Configure &gt; Shielding and selects a shielding package to be used to protect the VM.<\/p>\n<p>A console connection is not possible to a shielded VM by default.<\/p>\n<p>He now tries to attach a shielded VHD using Disk Manager. The BitLocker protected disk is mounted but is not accessible. There are \u201cno supported protectors\u201d. This is real encryption and the disk is random 1s and 0s for everything but the owner VM.<\/p>\n<p>Now even the most secure of organizations can deploy virtual DCs and sensitive data in virtual machines.<\/p>\n<h2>Security Assurances<\/h2>\n<ul>\n<li>At rest and in-flight encryption. The disks are encrypted and both VM state and Live Migration are encrypted.<\/li>\n<li>Admin lockout: Host admins have no access to disk contents or VM state.<\/li>\n<li>Attestation of health: VMs can only run on known and \u201chealthy\u201d (safe) hosts via the Host Guardian Service. <\/li>\n<\/ul>\n<h2>Methods of Deployment<\/h2>\n<p>There are two methods of deployment. The first is TPM-based and intended for hosters (isolation and mutlti-forest) and extremely difficult (if at all) to break. The second is AD-based and intended for enterprises (integrated networks and single forest) and might be how enterprises dip their tow into Shielded VMs before looking at TPM where all of the assurances are possible. <\/p>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image8.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb8.png\" width=\"600\" height=\"335\" \/><\/a> <\/p>\n<p>The latter is AD\/Kerberos based. Hosts are added to a group and the Host Guardian Service ensures that the host is a member of the group when the host attempts to power up a shielded VM. Note that the Admin-trusted (AD) model does not have forced code integrity, hardware-rooted trust, or measured boot &#8211; the TPM model these features ensure trust of the host code.<\/p>\n<p>TPM v2.0 is required on the host for h\/w-trusted model. This h\/w is not available yet on servers.<\/p>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image9.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb9.png\" width=\"600\" height=\"307\" \/><\/a> <\/p>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image10.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb10.png\" width=\"600\" height=\"332\" \/><\/a> <\/p>\n<\/p>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image11.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb11.png\" width=\"500\" height=\"229\" \/><\/a> <\/p>\n<h2>Architecture<\/h2>\n<p>Admin-trusted is friction-free with little change required.<\/p>\n<p>A <em>minimum <\/em>of one WS2016 server is required to be the Host Guardian Service node. This is in it\u2019s own AD forest of it\u2019s own, known as a safe harbour active directory. Joining this service to the existing AD poisons it &#8211; it is the keys to the keys of the kingdom. <\/p>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image12.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb12.png\" width=\"600\" height=\"315\" \/><\/a> <\/p>\n<p>The more secure hardware-trusted model has special h\/w requirements. Note the HSM, TPM 2.0 and UEFU 2.3.1 requirements. The HSM secures the certificates more effectively than software.<\/p>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image13.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb13.png\" width=\"600\" height=\"310\" \/><\/a> <\/p>\n<p>The HGS should be deployed with at least 3 nodes. There should be physical security and have limited number of admins. The AD should be dedicated to the HGS &#8211; each HGS nodes is a DC. The HGS client is a part of WS2016 Hyper-V. TPM is required and SecureBoot is recommended.<\/p>\n<h2>Virtualization Based Security (VBS)<\/h2>\n<p>Based on processor extensions in the hardware. VBS may be used by the host OS and the guest OS. This is also used by Device Guard in the Enterprise edition of Windows 10.<\/p>\n<p>The hypervisor is responsible for enforcing security. It\u2019s hardware protected and runs at a higher privilege level (ring -1) than the management OS, and it boots before the management OS (already running before the management OS starts to boot since WS2012). Hypervisor binaries can be measured and protected by Secure Boot. There are no drivers or installable code in Hyper-V, so no opportunity to attack there. The management OS kernel is code protected by the hypervisor too.<\/p>\n<p>Physical presence, hardware and DOS attacks are still possible. The first 2 are prevented by good practice.<\/p>\n<h2>Hardware Requirements<\/h2>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image14.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb14.png\" width=\"500\" height=\"315\" \/><\/a> <\/p>\n<p>SLAT is the key part that enables Hyper-V to enforce memory protection. Any server chipset from the last 8 or so years will have SLAT so there\u2019s likely not an issue in production systems.<\/p>\n<h2>Security Boundaries Today (WS2012 R2)<\/h2>\n<p>Each VM has a VMWP.EXE (worker process) in the management OS that is under the control of the fabric admin. A rogue admin can misuse this to peer into the VM. The VHD\/X files and others are also in the same trust boundary of the fabric admin. The hypervisor fully trusts the management OS. There are a litany of attacks that are possible by a rogue administrator or malware on the management OS.<\/p>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image15.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb15.png\" width=\"600\" height=\"318\" \/><\/a> <\/p>\n<\/p>\n<\/p>\n<h2>Changing Security Boundaries in Hyper-V<\/h2>\n<ul>\n<li><strong><u><font color=\"#ff0000\">Virtual Secure Mode<\/font><\/u><\/strong>: an enlightenment that any partition (host or guest) can take advantage of. There\u2019s a tiny runtime environment in there. In there are trust-lets running on IUM and SMART Secure Kernel, aka SMART or SKERNEL). <\/li>\n<li>The hypervisor now enforces code integrity for the management OS (hypervisor is running first) and for shielded VMs<\/li>\n<li>A hardened VMWP is sued for shielded VMs to protect their state &#8211; e.g. prevent attaching a debugger.<\/li>\n<li>A virtual TPM (vTPM) can be offered to a VM, e.g. disk encryption, measurement, etc.<\/li>\n<li>Restrictions on host admin access to guest VMs<\/li>\n<li>Strengthened the boundary to protect the hypervisor from the management OS.<\/li>\n<\/ul>\n<h2>Virtual Secure Mode (VSM)<\/h2>\n<p>VSM is the cornerstone of the new enterprise assurance features.<\/p>\n<ul>\n<li>Protects the platform, shielded VMs, and Device Guard<\/li>\n<li>It\u2019s a tiny secure environment where platform secrets are kept safe<\/li>\n<\/ul>\n<p>It operates based on virtual trust levels (VTLs). Kind of like user\/kernel mode for the hypervisor. Two levels now but the design allows for future scalability. The higher the number, the higher the level of protection. The higher levels control access privileges for lower levels. <\/p>\n<ul>\n<li>VTL 0: \u201cnormal world\u201d<\/li>\n<li>VTL 1: \u201csecure world\u201d<\/li>\n<\/ul>\n<p>VTLs provide memory isolation and are created\/managed by the hypervisor at the time of page translation. VTLs cannot be changed by the management OS.<\/p>\n<p>Inside the VSM, trustlets execute on the SKERNEL. No third party code is allowed. Three major (but not all) components are:<\/p>\n<ul>\n<li>Local Security Authority Sub System (LSASS) &#8211; credentials isolation, defeating \u201cpass the hash\u201d<\/li>\n<li>Kernel code integrity &#8211; moving the kernel code integrity checks into the VSM<\/li>\n<li>vTPM &#8211; provides a synthetic TPM device to guest VMs, enabling guest disk encryption<\/li>\n<\/ul>\n<p>There is a super small kernel, meaning there\u2019s a tiny attack surface. The hypervisor is in control of transitions\/interactions between the management OS and the VSM.<\/p>\n<p>The VSM is a rich target, so direct memory attacks (DMA) are likely. To protect against it, the IOMMUs in the system (Intel VT-D) prevents arbitrary access.<\/p>\n<h2>Protecting VM State<\/h2>\n<ul>\n<li>Requires a Generation 2 VM.<\/li>\n<li>Enables secure boot<\/li>\n<li>Support TPM 2.0<\/li>\n<li>Supports WS2012 and later, looking at W2008 and W2008 R2.<\/li>\n<li>Using Virtual Secure Mode in the guest OS requires WS2012 R2 &#8211; VSM is a hypervisor facility offered to enlightened guests (WS2016 only and not being backported).<\/li>\n<\/ul>\n<h2>vTPM<\/h2>\n<ul>\n<li>It is not backed by a physical TPM. Ensures that the VM is mobile.<\/li>\n<li>Enables BitLocker in the guest OS, e.g. BitLocker in Transparent Mode &#8211; no need to sit there and type a key when it boots.<\/li>\n<li>Hardened VMWP hosts the vTPM virtual device for protected VMs.<\/li>\n<\/ul>\n<p>This hardened VMWP handles other encryption other than just at rest (BitLocker):<\/p>\n<ul>\n<li>Live migration where egress traffic is enrypted<\/li>\n<li>All other at rest files: runtime state file, saved state, checkpoint<\/li>\n<li>Hyper-V Replica Log (HRL) file<\/li>\n<\/ul>\n<p>There are overheads but they are unknown at this point.<\/p>\n<h2>VMWP Hardening<\/h2>\n<ul>\n<li>Run as \u201cprotected process light\u201d (originally created for DRM)<\/li>\n<li>Disallows debugging and restricts handles access &#8211; state and crash dump files are encrypted<\/li>\n<li>Protected by code integrity<\/li>\n<li>New permissions with \u201cjust enough access\u201d (JEA)<\/li>\n<li>Removes duplicate handles to VMWP.EXE<\/li>\n<\/ul>\n<h2>Restricted Access to Shielded VMs<\/h2>\n<p>Disallowed:<\/p>\n<ul>\n<li>Basic mode of VMConnect <\/li>\n<li>RemoteFX <\/li>\n<li>Insecure WMI calls, screenshot, thumbnail, keyboard, mouse<\/li>\n<li>Insecure KVPs: Host Only items, Host Exchange items, Guest Exchange items<\/li>\n<li>Guest File Copy integration service (out-of band or OOB file copy)<\/li>\n<li>Initial Machine Config registry hive injection &#8211; a way to inject a preconfigured registry hive into a new VM.<\/li>\n<\/ul>\n<p>VM Generation ID is not affected.<\/p>\n<h2>Custom Security Configurations<\/h2>\n<p>How to dial back the secure-by-default configuration to suit your needs. Maybe the host admin is trusted or maybe you don\u2019t have all of the host system requirements. Three levels of custom operation:<\/p>\n<ul>\n<li><strong>Basic TPM Functionality<\/strong>: Enable vTPM for secure boot, disk encryption, or VSC<\/li>\n<li><strong>Data at Rest Protections<\/strong>: Includes Basic TPM. The hardened VMWP protects VM state and Live Migration traffic. Console mode access still works.<\/li>\n<li><strong>Fully Shielded<\/strong>: Enables all protections, including restrictions of host admin operations.<\/li>\n<\/ul>\n<h2>The WS2016 Hyper-V Security Boundaries<\/h2>\n<p><a href=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image16.png\"><img loading=\"lazy\" decoding=\"async\" title=\"image\" style=\"border-top: 0px; border-right: 0px; border-bottom: 0px; float: none; margin-left: auto; border-left: 0px; display: block; margin-right: auto\" border=\"0\" alt=\"image\" src=\"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb16.png\" width=\"620\" height=\"349\" \/><\/a> <\/p>\n<h2>Scenarios<\/h2>\n<ul>\n<li>Organizations with strict regulatory\/compliance requirements for cloud deployments<\/li>\n<li>Virtualising sensitive workloads, e.g. DCs<\/li>\n<li>Placing sensitive workloads in physically insecure locations (HGS must be physically secure)<\/li>\n<\/ul>\n<p>Easy, right?<\/p>\n<div id=\"scid:0767317B-992E-4b12-91E0-4F059A8CECA8:55230357-dab0-424b-8750-d43687955bb5\" class=\"wlWriterEditableSmartContent\" style=\"float: none; padding-bottom: 0px; padding-top: 0px; padding-left: 0px; margin: 0px; display: inline; padding-right: 0px\">Technorati Tags: <a href=\"http:\/\/technorati.com\/tags\/Event+Notes\" rel=\"tag\">Event Notes<\/a>,<a href=\"http:\/\/technorati.com\/tags\/Windows+Server+2016\" rel=\"tag\">Windows Server 2016<\/a>,<a href=\"http:\/\/technorati.com\/tags\/Hyper-V\" rel=\"tag\">Hyper-V<\/a>,<a href=\"http:\/\/technorati.com\/tags\/Security\" rel=\"tag\">Security<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>This post is HEAVY reading. It might take a few reads\/watches. This post is my set of notes from the session presented by Allen Marshall, Dean Wells, and Amitabh Tamhane at Microsoft Ignite 2015. Unfortunately it was on at the same time as the \u201cWhat\u2019s New\u201d session by Ben Armstrong and Sarah Cooley. The focus &hellip; <a href=\"https:\/\/aidanfinn.com\/?p=18195\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Ignite 2015 &#8211; Harden the Fabric: Protecting Tenant Secrets in Hyper-V&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"_wpcom_ai_launchpad_first_post":false,"footnotes":""},"categories":[14],"tags":[176,181,190,137],"class_list":["post-18195","post","type-post","status-publish","format-standard","hentry","category-eventnotes","tag-eventnotes","tag-hyper-v","tag-security","tag-windows-server-2016"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"This post is HEAVY reading. It might take a few reads\/watches. This post is my set of notes from the session presented by Allen Marshall, Dean Wells, and Amitabh Tamhane at Microsoft Ignite 2015. Unfortunately it was on at the same time as the \u201cWhat\u2019s New\u201d session by Ben Armstrong and Sarah Cooley. The focus\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"AFinn\"\/>\n\t<meta name=\"google-site-verification\" content=\"TDKjbi2McB2eLIfL6KwPB3aQqv5E-mbcb2QYIcovGaI\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/aidanfinn.com\/?p=18195\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_GB\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Aidan Finn, IT Pro - A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Ignite 2015 \u2013 Harden the Fabric: Protecting Tenant Secrets in Hyper-V | Aidan Finn, IT Pro\" \/>\n\t\t<meta property=\"og:description\" content=\"This post is HEAVY reading. It might take a few reads\/watches. This post is my set of notes from the session presented by Allen Marshall, Dean Wells, and Amitabh Tamhane at Microsoft Ignite 2015. Unfortunately it was on at the same time as the \u201cWhat\u2019s New\u201d session by Ben Armstrong and Sarah Cooley. The focus\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/aidanfinn.com\/?p=18195\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2015-05-11T16:30:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2015-05-11T16:30:02+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@joe_elway\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Ignite 2015 \u2013 Harden the Fabric: Protecting Tenant Secrets in Hyper-V | Aidan Finn, IT Pro\" \/>\n\t\t<meta name=\"twitter:description\" content=\"This post is HEAVY reading. It might take a few reads\/watches. This post is my set of notes from the session presented by Allen Marshall, Dean Wells, and Amitabh Tamhane at Microsoft Ignite 2015. Unfortunately it was on at the same time as the \u201cWhat\u2019s New\u201d session by Ben Armstrong and Sarah Cooley. The focus\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@joe_elway\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195#article\",\"name\":\"Ignite 2015 \\u2013 Harden the Fabric: Protecting Tenant Secrets in Hyper-V | Aidan Finn, IT Pro\",\"headline\":\"Ignite 2015 &#8211; Harden the Fabric: Protecting Tenant Secrets in Hyper-V\",\"author\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/wp-content\\\/uploads\\\/2015\\\/05\\\/image_thumb5.png\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195\\\/#articleImage\",\"width\":500,\"height\":294},\"datePublished\":\"2015-05-11T16:30:00+01:00\",\"dateModified\":\"2015-05-11T16:30:02+01:00\",\"inLanguage\":\"en-GB\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195#webpage\"},\"articleSection\":\"Event Notes, Event Notes, Hyper-V, Security, Windows Server 2016\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/aidanfinn.com\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=14#listItem\",\"name\":\"Event Notes\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=14#listItem\",\"position\":2,\"name\":\"Event Notes\",\"item\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=14\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195#listItem\",\"name\":\"Ignite 2015 &#8211; Harden the Fabric: Protecting Tenant Secrets in Hyper-V\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195#listItem\",\"position\":3,\"name\":\"Ignite 2015 &#8211; Harden the Fabric: Protecting Tenant Secrets in Hyper-V\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?cat=14#listItem\",\"name\":\"Event Notes\"}}]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\",\"name\":\"AFinn\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195#personImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"AFinn\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1\",\"name\":\"AFinn\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"AFinn\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195#webpage\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195\",\"name\":\"Ignite 2015 \\u2013 Harden the Fabric: Protecting Tenant Secrets in Hyper-V | Aidan Finn, IT Pro\",\"description\":\"This post is HEAVY reading. It might take a few reads\\\/watches. This post is my set of notes from the session presented by Allen Marshall, Dean Wells, and Amitabh Tamhane at Microsoft Ignite 2015. Unfortunately it was on at the same time as the \\u201cWhat\\u2019s New\\u201d session by Ben Armstrong and Sarah Cooley. The focus\",\"inLanguage\":\"en-GB\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?p=18195#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/?author=1#author\"},\"datePublished\":\"2015-05-11T16:30:00+01:00\",\"dateModified\":\"2015-05-11T16:30:02+01:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#website\",\"url\":\"https:\\\/\\\/aidanfinn.com\\\/\",\"name\":\"Aidan Finn, IT Pro\",\"description\":\"A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...\",\"inLanguage\":\"en-GB\",\"publisher\":{\"@id\":\"https:\\\/\\\/aidanfinn.com\\\/#person\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Ignite 2015 \u2013 Harden the Fabric: Protecting Tenant Secrets in Hyper-V | Aidan Finn, IT Pro","description":"This post is HEAVY reading. It might take a few reads\/watches. This post is my set of notes from the session presented by Allen Marshall, Dean Wells, and Amitabh Tamhane at Microsoft Ignite 2015. Unfortunately it was on at the same time as the \u201cWhat\u2019s New\u201d session by Ben Armstrong and Sarah Cooley. The focus","canonical_url":"https:\/\/aidanfinn.com\/?p=18195","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"TDKjbi2McB2eLIfL6KwPB3aQqv5E-mbcb2QYIcovGaI","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/aidanfinn.com\/?p=18195#article","name":"Ignite 2015 \u2013 Harden the Fabric: Protecting Tenant Secrets in Hyper-V | Aidan Finn, IT Pro","headline":"Ignite 2015 &#8211; Harden the Fabric: Protecting Tenant Secrets in Hyper-V","author":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"publisher":{"@id":"https:\/\/aidanfinn.com\/#person"},"image":{"@type":"ImageObject","url":"https:\/\/aidanfinn.com\/wp-content\/uploads\/2015\/05\/image_thumb5.png","@id":"https:\/\/aidanfinn.com\/?p=18195\/#articleImage","width":500,"height":294},"datePublished":"2015-05-11T16:30:00+01:00","dateModified":"2015-05-11T16:30:02+01:00","inLanguage":"en-GB","mainEntityOfPage":{"@id":"https:\/\/aidanfinn.com\/?p=18195#webpage"},"isPartOf":{"@id":"https:\/\/aidanfinn.com\/?p=18195#webpage"},"articleSection":"Event Notes, Event Notes, Hyper-V, Security, Windows Server 2016"},{"@type":"BreadcrumbList","@id":"https:\/\/aidanfinn.com\/?p=18195#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/aidanfinn.com#listItem","position":1,"name":"Home","item":"https:\/\/aidanfinn.com","nextItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=14#listItem","name":"Event Notes"}},{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=14#listItem","position":2,"name":"Event Notes","item":"https:\/\/aidanfinn.com\/?cat=14","nextItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?p=18195#listItem","name":"Ignite 2015 &#8211; Harden the Fabric: Protecting Tenant Secrets in Hyper-V"},"previousItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?p=18195#listItem","position":3,"name":"Ignite 2015 &#8211; Harden the Fabric: Protecting Tenant Secrets in Hyper-V","previousItem":{"@type":"ListItem","@id":"https:\/\/aidanfinn.com\/?cat=14#listItem","name":"Event Notes"}}]},{"@type":"Person","@id":"https:\/\/aidanfinn.com\/#person","name":"AFinn","image":{"@type":"ImageObject","@id":"https:\/\/aidanfinn.com\/?p=18195#personImage","url":"https:\/\/secure.gravatar.com\/avatar\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g","width":96,"height":96,"caption":"AFinn"}},{"@type":"Person","@id":"https:\/\/aidanfinn.com\/?author=1#author","url":"https:\/\/aidanfinn.com\/?author=1","name":"AFinn","image":{"@type":"ImageObject","@id":"https:\/\/aidanfinn.com\/?p=18195#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/65fde4aa9f2ab1cf1514ae320a37ec682d9398ce5791d3c2dd1e8670a71ceea0?s=96&d=mm&r=g","width":96,"height":96,"caption":"AFinn"}},{"@type":"WebPage","@id":"https:\/\/aidanfinn.com\/?p=18195#webpage","url":"https:\/\/aidanfinn.com\/?p=18195","name":"Ignite 2015 \u2013 Harden the Fabric: Protecting Tenant Secrets in Hyper-V | Aidan Finn, IT Pro","description":"This post is HEAVY reading. It might take a few reads\/watches. This post is my set of notes from the session presented by Allen Marshall, Dean Wells, and Amitabh Tamhane at Microsoft Ignite 2015. Unfortunately it was on at the same time as the \u201cWhat\u2019s New\u201d session by Ben Armstrong and Sarah Cooley. The focus","inLanguage":"en-GB","isPartOf":{"@id":"https:\/\/aidanfinn.com\/#website"},"breadcrumb":{"@id":"https:\/\/aidanfinn.com\/?p=18195#breadcrumblist"},"author":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"creator":{"@id":"https:\/\/aidanfinn.com\/?author=1#author"},"datePublished":"2015-05-11T16:30:00+01:00","dateModified":"2015-05-11T16:30:02+01:00"},{"@type":"WebSite","@id":"https:\/\/aidanfinn.com\/#website","url":"https:\/\/aidanfinn.com\/","name":"Aidan Finn, IT Pro","description":"A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...","inLanguage":"en-GB","publisher":{"@id":"https:\/\/aidanfinn.com\/#person"}}]},"og:locale":"en_GB","og:site_name":"Aidan Finn, IT Pro - A blog covering Azure, Hyper-V, Windows Server, desktop, systems management, deployment, and so on ...","og:type":"article","og:title":"Ignite 2015 \u2013 Harden the Fabric: Protecting Tenant Secrets in Hyper-V | Aidan Finn, IT Pro","og:description":"This post is HEAVY reading. It might take a few reads\/watches. This post is my set of notes from the session presented by Allen Marshall, Dean Wells, and Amitabh Tamhane at Microsoft Ignite 2015. Unfortunately it was on at the same time as the \u201cWhat\u2019s New\u201d session by Ben Armstrong and Sarah Cooley. The focus","og:url":"https:\/\/aidanfinn.com\/?p=18195","article:published_time":"2015-05-11T16:30:00+00:00","article:modified_time":"2015-05-11T16:30:02+00:00","twitter:card":"summary","twitter:site":"@joe_elway","twitter:title":"Ignite 2015 \u2013 Harden the Fabric: Protecting Tenant Secrets in Hyper-V | Aidan Finn, IT Pro","twitter:description":"This post is HEAVY reading. It might take a few reads\/watches. This post is my set of notes from the session presented by Allen Marshall, Dean Wells, and Amitabh Tamhane at Microsoft Ignite 2015. Unfortunately it was on at the same time as the \u201cWhat\u2019s New\u201d session by Ben Armstrong and Sarah Cooley. The focus","twitter:creator":"@joe_elway"},"aioseo_meta_data":{"post_id":"18195","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2020-12-21 03:53:22","updated":"2025-06-04 16:55:10","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/aidanfinn.com\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/aidanfinn.com\/?cat=14\" title=\"Event Notes\">Event Notes<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tIgnite 2015 \u2013 Harden the Fabric: Protecting Tenant Secrets in Hyper-V\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/aidanfinn.com"},{"label":"Event Notes","link":"https:\/\/aidanfinn.com\/?cat=14"},{"label":"Ignite 2015 &#8211; Harden the Fabric: Protecting Tenant Secrets in Hyper-V","link":"https:\/\/aidanfinn.com\/?p=18195"}],"amp_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/18195","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=18195"}],"version-history":[{"count":1,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/18195\/revisions"}],"predecessor-version":[{"id":18196,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/18195\/revisions\/18196"}],"wp:attachment":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=18195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=18195"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=18195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}