The operating system must automatically implement organization-defined safeguards and countermeasures if security functions (or mechanisms) are changed inappropriately.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-OS-000260-ESXI5-PF	SRG-OS-000260-ESXI5-PF	SRG-OS-000260-ESXI5-PF_rule		Medium

Description
Any changes to the hardware, software, and/or firmware components of the operating system can potentially have significant effects on the overall security of the system. Accordingly, only qualified and authorized individuals must be allowed to obtain access to operating system components for purposes of initiating changes, including upgrades and modifications. In order to ensure a prompt response to unauthorized changes to application security functions or security mechanisms, organizations may define countermeasures and safeguards the operating system must undertake in the event these types of operating system changes occur. Permanent finding - While the vCenter/vSphere update manager can manage software, hardware/firmware components are beyond its capabilities.

Description

Any changes to the hardware, software, and/or firmware components of the operating system can potentially have significant effects on the overall security of the system. Accordingly, only qualified and authorized individuals must be allowed to obtain access to operating system components for purposes of initiating changes, including upgrades and modifications. In order to ensure a prompt response to unauthorized changes to application security functions or security mechanisms, organizations may define countermeasures and safeguards the operating system must undertake in the event these types of operating system changes occur. Permanent finding - While the vCenter/vSphere update manager can manage software, hardware/firmware components are beyond its capabilities.

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-SRG-OS-000260-ESXI5-PF_chk )
ESXi does not support this requirement. This is a permanent finding.

Fix Text (F-SRG-OS-000260-ESXI5-PF_fix)
This requirement is a permanent finding and cannot be fixed. An appropriate mitigation for the system must be implemented but this finding cannot be considered fixed.