Skip to content
Log In

VMware vSphere 7.0 vCenter Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000014

    Group
    Show

  • SRG-APP-000065

    Group
    Show

  • SRG-APP-000068

    Group
    Show

  • SRG-APP-000095

    Group
    Show

  • The vCenter Server must produce audit records containing information to establish what type of events occurred.

    Without establishing what types of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.
    Rule Medium Severity
    Show

  • SRG-APP-000141

    Group
    Show

  • vCenter Server plugins must be verified.

    The vCenter Server includes a vSphere Client extensibility framework, which provides the ability to extend the vSphere Client with menu selections or toolbar icons that provide access to vCenter Se...
    Rule Medium Severity
    Show

  • SRG-APP-000148

    Group
    Show

  • The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.

    To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational use...
    Rule Medium Severity
    Show

  • SRG-APP-000149

    Group
    Show

  • SRG-APP-000164

    Group
    Show

  • SRG-APP-000165

    Group
    Show

  • The vCenter Server must prohibit password reuse for a minimum of five generations.

    Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords must b...
    Rule Medium Severity
    Show

  • SRG-APP-000166

    Group
    Show

  • The vCenter Server passwords must contain at least one uppercase character.

    Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...
    Rule Medium Severity
    Show

  • SRG-APP-000167

    Group
    Show

  • The vCenter Server passwords must contain at least one lowercase character.

    Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...
    Rule Medium Severity
    Show

  • SRG-APP-000168

    Group
    Show

  • The vCenter Server passwords must contain at least one numeric character.

    Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...
    Rule Medium Severity
    Show

  • SRG-APP-000169

    Group
    Show

  • SRG-APP-000172

    Group
    Show

  • The vCenter Server must enable FIPS-validated cryptography.

    FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. In vSphere 6.7 and later, ESXi and vCenter Se...
    Rule High Severity
    Show

  • SRG-APP-000174

    Group
    Show

  • The vCenter Server must enforce a 60-day maximum password lifetime restriction.

    Any password, no matter how complex, can eventually be cracked. Therefore, passwords must be changed at specific intervals. One method of minimizing this risk is to use complex passwords and peri...
    Rule Medium Severity
    Show

  • SRG-APP-000175

    Group
    Show

  • SRG-APP-000190

    Group
    Show

  • The vCenter Server must terminate vSphere Client sessions after 10 minutes of inactivity.

    Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port th...
    Rule Medium Severity
    Show

  • SRG-APP-000211

    Group
    Show

  • SRG-APP-000247

    Group
    Show

  • SRG-APP-000291

    Group
    Show

  • The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.

    Once an attacker establishes initial access to a system, they often attempt to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create a new ac...
    Rule Medium Severity
    Show

  • SRG-APP-000345

    Group
    Show

  • The vCenter Server must set the interval for counting failed login attempts to at least 15 minutes.

    By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the a...
    Rule Medium Severity
    Show

  • SRG-APP-000358

    Group
    Show

  • The vCenter Server must be configured to send logs to a central log server.

    vCenter must be configured to send near real-time log data to syslog collectors so information will be available to investigators in the case of a security incident or to assist in troubleshooting.
    Rule Medium Severity
    Show

  • SRG-APP-000360

    Group
    Show

  • vCenter must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts.

    It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impe...
    Rule Medium Severity
    Show

  • SRG-APP-000371

    Group
    Show

  • SRG-APP-000427

    Group
    Show

  • The vCenter Server Machine Secure Sockets Layer (SSL) certificate must be issued by a DOD certificate authority.

    Untrusted certificate authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DOD systems or by organizations with insufficient secur...
    Rule Medium Severity
    Show

  • SRG-APP-000516

    Group
    Show

  • The vCenter Server must disable the Customer Experience Improvement Program (CEIP).

    The VMware CEIP sends VMware anonymized system information that is used to improve the quality, reliability, and functionality of VMware products and services. For confidentiality purposes this fea...
    Rule Medium Severity
    Show

  • SRG-APP-000575

    Group
    Show

  • The vCenter server must enforce SNMPv3 security features where SNMP is required.

    SNMPv3 supports commercial-grade security, including authentication, authorization, access control, and privacy. Previous versions of the protocol contained well-known security weaknesses that were...
    Rule Medium Severity
    Show

  • SRG-APP-000575

    Group
    Show

  • The vCenter server must disable SNMPv1/2 receivers.

    SNMPv3 supports commercial-grade security, including authentication, authorization, access control, and privacy. Previous versions of the protocol contained well-known security weaknesses that were...
    Rule Medium Severity
    Show

  • SRG-APP-000345

    Group
    Show

  • SRG-APP-000516

    Group
    Show

  • The vCenter Server must disable the distributed virtual switch health check.

    Network health check is disabled by default. Once enabled, the health check packets contain information on host#, vds#, and port#, which an attacker would find useful. It is recommended that networ...
    Rule Low Severity
    Show

  • SRG-APP-000516

    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules