The system must be configured to only boot from the system boot device.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39384	GEN008600-ESXI5-000050	SV-51242r1_rule		High

Description
The ability to boot from removable media is the same as being able to boot into single user or maintenance mode without a password. This ability could allow a malicious user to boot the system and perform changes possibly compromising or damaging the system. It could also allow the system to be used for malicious purposes by a malicious anonymous user.

STIG	Date
VMware ESXi Server 5.0 Security Technical Implementation Guide	2017-01-06

Details

Check Text ( C-46658r1_chk )
Note: Checking a system's BIOS is vendor and hardware dependent. To verify media boot options: Interrupt the host computer's boot process and enter the BIOS menu. Inspect the menu option for boot order. If any media other than the ESXi boot disk is listed as a boot option, this is a finding.

Fix Text (F-44397r1_fix)
Note: Checking a system's BIOS is vendor and hardware dependent. To ensure media boot options: Interrupt the host computer's boot process and enter the BIOS menu. Inspect the menu option for boot order. Remove all boot media options except for ESXi. Save the change and exit to verify the boot cycle.