VM Power Scheduling
A virtual machine that is running costs money and can be attacked. A machine that is powered off does neither. Analog Informatics Corporation (AIC) kits power off unused workstations and session capacity on a schedule or after they sit idle, and start them again when a person needs them.
This is built into the AIC CMMC Completeâ„¢ Level 1, Level 2, and Level 3 kits.
Short Answers
Why power machines off?
Two reasons. Cost: in the cloud you pay for compute by the hour, so a workstation that runs only during working hours costs a fraction of one that runs all the time. Security: a machine that is off cannot be probed, scanned, or used as a foothold, so the live attack surface shrinks.
How does it decide when?
Each hypervisor connection and pool has a policy: a daily power-off time, an idle timeout, how long to wait for a machine to boot, and whether to power off or suspend.
How do people get their machine back?
On My Workstations, a person sees whether their machine is up or down, starts it, and connects. The schedule powers it off again later.
What about the session recording and jump capacity?
Recording and jump capacity can also start on demand and stop on a schedule, so heavy capacity runs only while sessions need it.
Can it power off the wrong machine?
Protected machines, such as the management host, can be excluded, and power control is limited to the machines in each pool.
Supported Platforms
Platform
- Microsoft Hyper-V
- Docker
- Microsoft Azure virtual machines
- Amazon EC2
- Google Compute Engine
- VMware vSphere and ESXi
- Proxmox VE
- Nutanix AHV
- Citrix Hypervisor
- Red Hat Virtualization and oVirt
- Oracle VM
What You Can Set
| Setting | What It Does |
|---|---|
| Schedule | Powers machines off at a set time each day, in your program time zone |
| Idle timeout | Powers a machine off after it has been idle for a set time |
| Sleep action | Power off, or suspend where the platform supports it |
| Boot wait | How long to wait for a machine to be ready before connecting |
| Start on demand | A person starts their own machine from My Workstations |
| Capacity roles | User workstations, and recording or jump capacity |
Screenshots
Related Controls
| Framework | Controls |
|---|---|
| NIST SP 800-53 | CM-7 (least functionality), SC-7, AC-17 |
| NIST SP 800-171 | 3.4.6, 3.13.1 |
An assessment organization, and in some cases the government, decides whether an organization meets a framework.
An assessment organization, certification body, or regulator decides whether a requirement is satisfied.