Virtual Machine Manager Security Requirements Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The VMM must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent the auditing of critical events. Misconfigured audi...Rule Medium Severity -
SRG-OS-000064
Group -
The VMM must generate audit records when successful/unsuccessful attempts to access privileges occur.
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an in...Rule Medium Severity -
SRG-OS-000066
Group -
The VMM, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
Without path validation, an informed trust decision by the relying party cannot be made when presented with any certificate not already explicitly trusted. A trust anchor is an authoritative entit...Rule Medium Severity -
SRG-OS-000067
Group -
SRG-OS-000068
Group -
The VMM must map the authenticated identity to the user or group account for PKI-based authentication.
Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.Rule Medium Severity -
SRG-OS-000069
Group -
The VMM must enforce password complexity by requiring that at least one uppercase character be used.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-OS-000070
Group -
The VMM must enforce password complexity by requiring that at least one lowercase character be used.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-OS-000071
Group -
The VMM must enforce password complexity by requiring that at least one numeric character be used.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisti...Rule Medium Severity -
SRG-OS-000072
Group -
SRG-OS-000073
Group -
The VMM must store only encrypted representations of passwords.
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily c...Rule Medium Severity -
SRG-OS-000074
Group -
The VMM must transmit only encrypted representations of passwords.
Passwords need to be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily c...Rule Medium Severity -
SRG-OS-000075
Group -
The VMM must enforce 24 hours/one day as the minimum password lifetime.
Enforcing a minimum password lifetime helps to prevent repeated password changes to defeat the password reuse or history enforcement requirement. If users are allowed to immediately and continually...Rule Medium Severity -
SRG-OS-000076
Group -
The VMM must enforce a 60-day maximum password lifetime restriction.
Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed periodically. If the VMM does not limit the lifetime of passwords and force users to change t...Rule Medium Severity -
SRG-OS-000078
Group -
SRG-OS-000079
Group -
The VMM must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
To prevent the compromise of authentication information, such as passwords during the authentication process, the feedback from the VMM shall not provide any information allowing an unauthorized us...Rule Medium Severity -
SRG-OS-000080
Group -
The VMM must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., networks, web servers, and web porta...Rule Medium Severity -
SRG-OS-000095
Group -
The VMM must be configured to disable non-essential capabilities.
It is detrimental for VMMs to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and there...Rule Medium Severity -
SRG-OS-000096
Group -
SRG-OS-000104
Group -
SRG-OS-000105
Group -
The VMM must use multifactor authentication for network access to privileged accounts.
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authenticat...Rule Medium Severity -
SRG-OS-000106
Group -
SRG-OS-000107
Group -
The VMM must use multifactor authentication for local access to privileged accounts.
To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authenti...Rule Medium Severity -
SRG-OS-000108
Group -
SRG-OS-000109
Group -
The VMM must require individuals to be authenticated with an individual authenticator prior to using a group authenticator.
To assure individual accountability and prevent unauthorized access, organizational users shall be individually identified and authenticated. A group authenticator is a generic account used by mu...Rule Medium Severity -
SRG-OS-000112
Group -
The VMM must implement replay-resistant authentication mechanisms for network access to privileged accounts.
A replay attack may enable an unauthorized user to gain access to the VMM. Authentication sessions between the authenticator and the VMM validating the user credentials must not be vulnerable to a ...Rule Medium Severity -
SRG-OS-000113
Group -
The VMM must implement replay-resistant authentication mechanisms for network access to nonprivileged accounts.
A replay attack may enable an unauthorized user to gain access to the VMM. Authentication sessions between the authenticator and the VMM validating the user credentials must not be vulnerable to a ...Rule Medium Severity -
SRG-OS-000114
Group -
The VMM must uniquely identify peripherals before establishing a connection.
Without identifying devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. Peripherals include, but are not limited to, such devices as flash drives, ...Rule Medium Severity -
SRG-OS-000118
Group -
SRG-OS-000120
Group -
The VMM must use mechanisms meeting the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module.
Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoD data may be ...Rule Medium Severity -
SRG-OS-000122
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.