VMware vSphere 7.0 Virtual Machine Security Technical Implementation Guide

Overview

Version	Date	Finding Count (28)			Downloads
1	2023-12-01 2023-02-27 2023-06-22 2023-06-22	CAT I (High): 0	CAT II (Med): 19	CAT III (Low): 9	Excel	JSON	XML

STIG Description
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Available Profiles

Classified	Public	Sensitive
I - Mission Critical Classified	I - Mission Critical Public	I - Mission Critical Sensitive	II - Mission Support Classified	II - Mission Support Public	II - Mission Support Sensitive	III - Administrative Classified	III - Administrative Public	III - Administrative Sensitive

Findings (MAC III - Administrative Sensitive)

Finding ID	Severity	Title	Description
V-256469	Medium	Use of the virtual machine (VM) console must be minimized.	The VM console enables a connection to the console of a virtual machine, in effect seeing what a monitor on a physical server would show. The VM console also provides power management and...
V-256464	Medium	Unauthorized removal, connection, and modification of devices must be prevented on the virtual machine (VM).	In a virtual machine, users and processes without root or administrator privileges can connect or disconnect devices, such as network adaptors and CD-ROM drives, and can modify device settings....
V-256465	Medium	The virtual machine (VM) must not be able to obtain host information from the hypervisor.	If enabled, a VM can obtain detailed information about the physical host. The default value for the parameter is FALSE. This setting should not be TRUE unless a particular VM requires this...
V-256460	Medium	Unauthorized serial devices must be disconnected on the virtual machine (VM).	Ensure no device is connected to a virtual machine if it is not required. For example, floppy, serial, and parallel ports are rarely used for virtual machines in a datacenter environment, and...
V-256461	Medium	Unauthorized USB devices must be disconnected on the virtual machine (VM).	Ensure no device is connected to a virtual machine if it is not required. For example, floppy, serial, and parallel ports are rarely used for virtual machines in a data center environment, and...
V-256462	Medium	Console connection sharing must be limited on the virtual machine (VM).	By default, more than one user at a time can connect to remote console sessions. When multiple sessions are activated, each terminal window receives a notification about the new session. If an...
V-256459	Medium	Unauthorized parallel devices must be disconnected on the virtual machine (VM).	Ensure no device is connected to a virtual machine if it is not required. For example, floppy, serial, and parallel ports are rarely used for virtual machines in a data center environment, and...
V-256455	Medium	Independent, nonpersistent disks must not be used on the virtual machine (VM).	The security issue with nonpersistent disk mode is that successful attackers, with a simple shutdown or reboot, might undo or remove any traces they were ever on the machine. To safeguard against...
V-256454	Medium	Virtual disk wiping must be disabled on the virtual machine (VM).	Shrinking and wiping (erasing) a virtual disk reclaims unused space in it. If there is empty space in the disk, this process reduces the amount of space the virtual disk occupies on the host...
V-256457	Medium	Unauthorized floppy devices must be disconnected on the virtual machine (VM).	Ensure no device is connected to a virtual machine if it is not required. For example, floppy, serial, and parallel ports are rarely used for virtual machines in a data center environment, and...
V-256456	Medium	Host Guest File System (HGFS) file transfers must be disabled on the virtual machine (VM).	Setting "isolation.tools.hgfsServerSet.disable" to "true" disables registration of the guest's HGFS server with the host. Application Programming Interfaces (APIs) that use HGFS to transfer files...
V-256453	Medium	Virtual disk shrinking must be disabled on the virtual machine (VM).	Shrinking a virtual disk reclaims unused space in it. If there is empty space in the disk, this process reduces the amount of space the virtual disk occupies on the host drive. Normal users and...
V-256477	Medium	Encryption must be enabled for Fault Tolerance on the virtual machine (VM).	Fault Tolerance log traffic can be encrypted. This could contain sensitive data from the protected machine's memory or CPU instructions. vSphere Fault Tolerance performs frequent checks between a...
V-256476	Medium	DirectPath I/O must be disabled on the virtual machine (VM) when not required.	VMDirectPath I/O (PCI passthrough) enables direct assignment of hardware PCI functions to VMs. This gives the VM access to the PCI functions with minimal intervention from the ESXi host. This is a...
V-256475	Medium	Log retention must be configured properly on the virtual machine (VM).	The ESXi hypervisor maintains logs for each individual VM by default. These logs contain information including but not limited to power events, system failure information, tools status and...
V-256474	Medium	Log size must be configured properly on the virtual machine (VM).	The ESXi hypervisor maintains logs for each individual VM by default. These logs contain information including but not limited to power events, system failure information, tools status and...
V-256473	Medium	Logging must be enabled on the virtual machine (VM).	The ESXi hypervisor maintains logs for each individual VM by default. These logs contain information including but not limited to power events, system failure information, tools status and...
V-256472	Medium	Encryption must be enabled for vMotion on the virtual machine (VM).	vMotion migrations in vSphere 6.0 and earlier transferred working memory and CPU state information in clear text over the vMotion network. As of vSphere 6.5, this transfer can be transparently...
V-256470	Medium	The virtual machine (VM) guest operating system must be locked when the last console connection is closed.	When accessing the VM console, the guest operating system must be locked when the last console user disconnects, limiting the possibility of session hijacking. This setting only applies to...
V-256468	Low	System administrators must use templates to deploy virtual machines (VMs) whenever possible.	Capture a hardened base operating system image (with no applications installed) in a template to ensure all VMs are created with a known baseline level of security. Use this template to create...
V-256466	Low	Shared salt values must be disabled on the virtual machine (VM).	When salting is enabled (Mem.ShareForceSalting=1 or 2) to share a page between two virtual machines, both salt and the content of the page must be same. A salt value is a configurable advanced...
V-256467	Low	Access to virtual machines (VMs) through the "dvfilter" network Application Programming Interface (API) must be controlled.	An attacker might compromise a VM by using the "dvFilter" API. Configure only VMs that need this access to use the API.
V-256463	Low	Informational messages from the virtual machine to the VMX file must be limited on the virtual machine (VM).	The configuration file containing these name-value pairs is limited to a size of 1MB. If not limited, VMware tools in the guest operating system are capable of sending a large and continuous data...
V-256458	Low	Unauthorized CD/DVD devices must be disconnected on the virtual machine (VM).	Ensure no device is connected to a virtual machine if it is not required. For example, floppy, serial, and parallel ports are rarely used for virtual machines in a data center environment, and...
V-256451	Low	Drag and drop operations must be disabled on the virtual machine (VM).	Copy and paste operations are disabled by default; however, explicitly disabling this feature will enable audit controls to verify this setting is correct. Copy, paste, drag and drop, or GUI...
V-256450	Low	Copy operations must be disabled on the virtual machine (VM).	Copy and paste operations are disabled by default; however, explicitly disabling this feature will enable audit controls to verify this setting is correct. Copy, paste, drag and drop, or GUI...
V-256452	Low	Paste operations must be disabled on the virtual machine (VM).	Copy and paste operations are disabled by default; however, explicitly disabling this feature will enable audit controls to verify this setting is correct. Copy, paste, drag and drop, or GUI...
V-256471	Low	All 3D features on the virtual machine (VM) must be disabled when not required.	For performance reasons, it is recommended that 3D acceleration be disabled on virtual machines that do not require 3D functionality (e.g., most server workloads or desktops not using 3D applications).