Skip to content
Log In

VMware vSphere 8.0 vCenter Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000172

    Group
    Show

  • SRG-APP-000174

    Group
    Show

  • The vCenter Server must enforce a 90-day maximum password lifetime restriction.

    Any password, no matter how complex, can eventually be cracked. Therefore, passwords must be changed at specific intervals. One method of minimizing this risk is to use complex passwords and perio...
    Rule Medium Severity
    Show

  • SRG-APP-000175

    Group
    Show

  • The vCenter Server must enable revocation checking for certificate-based authentication.

    The system must establish the validity of the user-supplied identity certificate using Online Certificate Status Protocol (OCSP) and/or Certificate Revocation List (CRL) revocation checking. Satis...
    Rule Medium Severity
    Show

  • SRG-APP-000190

    Group
    Show

  • SRG-APP-000211

    Group
    Show

  • The vCenter Server user roles must be verified.

    Users and service accounts must only be assigned privileges they require. Least privilege requires that these privileges must only be assigned if needed to reduce risk of confidentiality, availabil...
    Rule Medium Severity
    Show

  • SRG-APP-000247

    Group
    Show

  • SRG-APP-000291

    Group
    Show

  • The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.

    Once an attacker establishes initial access to a system, they often attempt to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create a new ac...
    Rule Medium Severity
    Show

  • SRG-APP-000345

    Group
    Show

  • SRG-APP-000358

    Group
    Show

  • The vCenter Server must be configured to send logs to a central log server.

    vCenter must be configured to send near real-time log data to syslog collectors so information will be available to investigators in the case of a security incident or to assist in troubleshooting.
    Rule Medium Severity
    Show

  • SRG-APP-000360

    Group
    Show

  • SRG-APP-000371

    Group
    Show

  • The vCenter Server must compare internal information system clocks at least every 24 hours with an authoritative time server.

    Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when condu...
    Rule Medium Severity
    Show

  • SRG-APP-000427

    Group
    Show

  • SRG-APP-000428

    Group
    Show

  • The vCenter Server must enable data at rest encryption for vSAN.

    Applications handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. Data encryption...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules