Secure Live Migration Lab
Live migration is a quiet miracle — a running VM hops hosts with no downtime. It is also a quiet leak: by default the guest's entire memory crosses the network in cleartext, unauthenticated, and can land on a host nobody verified. This lab puts you on the migration and asks which controls secure this move — encrypt the stream, authenticate both ends, isolate the network, firewall the port, attest the destination — and which are ceremony it does not need. Move the VM without leaking it.
The real job. More noise, a tighter clock.
Move the VM without leaking it
Live migration copies a running VM's entire memory to another host over the network — and by default that stream is unencrypted and unauthenticated, so the guest's RAM (keys, tokens, PII) crosses the wire in the clear and can land on an unverified host. Each round gives you a migration and a set of controls; enable the ones that secure this move — and not the ceremony it does not need. A round clears only on an exact match. Finish under par for a speed bonus.
What this lab is
- A free, browser-based lab on securing VM live migration — moving a running guest's memory and state to another host without leaking it.
- The core risk is real and often default: hypervisors such as QEMU/KVM migrate over an unencrypted, unauthenticated TCP stream, so the guest's entire RAM (keys, tokens, PII) crosses the wire in cleartext and can land on an unverified host.
- Each round gives you a migration scenario and a set of controls — TLS-encrypt the stream, mutually authenticate the endpoints, isolate the migration network, firewall the port, attest the destination — and you enable exactly the ones it needs.
- You are scored on closing the exposure without needless ceremony: a missing control leaves memory in the clear or the destination unverified, while attestation on a throwaway dev VM is effort for a threat that is not present.
- Fully client-side — no VM is moved, nothing is uploaded, no account; after each round you see why the right control set is right.
Frequently asked questions
What is the Secure Live Migration Lab?
A free, in-browser decision drill on protecting VM live migration. Each round describes a migration — a sensitive VM on a shared network, a cross-datacenter move over the WAN, an unverified destination — and a menu of controls: encrypt the stream with TLS, mutually authenticate both endpoints, carry it on an isolated migration network, firewall the migration port, and attest the destination host. You enable the controls that secure that specific move, get immediate feedback, and a graded debrief.
Why is unencrypted live migration dangerous?
Live migration copies the running guest's entire memory to the destination host over the network. Many hypervisors default to an unencrypted, unauthenticated TCP transport, so anything in that RAM — encryption keys, session tokens, customer PII — crosses the wire in cleartext, where anyone able to sniff the migration path can reconstruct it. Worse, without endpoint authentication the memory can be streamed to an attacker-controlled destination or intercepted by a man in the middle. Encrypting and authenticating the migration is the fix.
When do I need destination attestation versus just encryption?
Encrypting the stream and mutually authenticating the endpoints is the baseline for essentially every real migration — it is cheap and it closes the memory-in-the-clear and rogue-destination risks. Hardware destination attestation (verifying the target is a known-good, measured platform before the VM lands) is a heavier control scoped to sensitive or regulated workloads, like a VM holding key material. The lab deliberately includes low-sensitivity rounds where adding attestation is over-mitigation, to drill matching controls to the actual sensitivity.
Does it move a real VM or need an install?
No. Nothing is migrated, uploaded or installed. The scenarios are authored from the established facts of how live migration works and fails, and the lab runs entirely in your browser with no account. It is a judgement drill for virtualization and platform engineers, not a tool that touches your infrastructure.