VMware vSphere 7.0 Virtual Machine Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-OS-000480-VMM-002000
Group -
Copy operations must be disabled on the virtual machine (VM).
Copy and paste operations are disabled by default; however, explicitly disabling this feature will enable audit controls to verify this setting is correct. Copy, paste, drag and drop, or GUI copy/p...Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
Drag and drop operations must be disabled on the virtual machine (VM).
Copy and paste operations are disabled by default; however, explicitly disabling this feature will enable audit controls to verify this setting is correct. Copy, paste, drag and drop, or GUI copy/p...Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
Paste operations must be disabled on the virtual machine (VM).
Copy and paste operations are disabled by default; however, explicitly disabling this feature will enable audit controls to verify this setting is correct. Copy, paste, drag and drop, or GUI copy/p...Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
Virtual disk wiping must be disabled on the virtual machine (VM).
Shrinking and wiping (erasing) a virtual disk reclaims unused space in it. If there is empty space in the disk, this process reduces the amount of space the virtual disk occupies on the host drive....Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
Independent, nonpersistent disks must not be used on the virtual machine (VM).
The security issue with nonpersistent disk mode is that successful attackers, with a simple shutdown or reboot, might undo or remove any traces they were ever on the machine. To safeguard against t...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
Unauthorized floppy devices must be disconnected on the virtual machine (VM).
Ensure no device is connected to a virtual machine if it is not required. For example, floppy, serial, and parallel ports are rarely used for virtual machines in a data center environment, and CD/D...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
Unauthorized CD/DVD devices must be disconnected on the virtual machine (VM).
Ensure no device is connected to a virtual machine if it is not required. For example, floppy, serial, and parallel ports are rarely used for virtual machines in a data center environment, and CD/D...Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
Unauthorized parallel devices must be disconnected on the virtual machine (VM).
Ensure no device is connected to a virtual machine if it is not required. For example, floppy, serial, and parallel ports are rarely used for virtual machines in a data center environment, and CD/D...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
Unauthorized serial devices must be disconnected on the virtual machine (VM).
Ensure no device is connected to a virtual machine if it is not required. For example, floppy, serial, and parallel ports are rarely used for virtual machines in a datacenter environment, and CD/DV...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
Unauthorized USB devices must be disconnected on the virtual machine (VM).
Ensure no device is connected to a virtual machine if it is not required. For example, floppy, serial, and parallel ports are rarely used for virtual machines in a data center environment, and CD/D...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
Informational messages from the virtual machine to the VMX file must be limited on the virtual machine (VM).
The configuration file containing these name-value pairs is limited to a size of 1MB. If not limited, VMware tools in the guest operating system are capable of sending a large and continuous data s...Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The virtual machine (VM) must not be able to obtain host information from the hypervisor.
If enabled, a VM can obtain detailed information about the physical host. The default value for the parameter is FALSE. This setting should not be TRUE unless a particular VM requires this informat...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
Shared salt values must be disabled on the virtual machine (VM).
When salting is enabled (Mem.ShareForceSalting=1 or 2) to share a page between two virtual machines, both salt and the content of the page must be same. A salt value is a configurable advanced opti...Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
System administrators must use templates to deploy virtual machines (VMs) whenever possible.
Capture a hardened base operating system image (with no applications installed) in a template to ensure all VMs are created with a known baseline level of security. Use this template to create othe...Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
Use of the virtual machine (VM) console must be minimized.
The VM console enables a connection to the console of a virtual machine, in effect seeing what a monitor on a physical server would show. The VM console also provides power management and removable...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The virtual machine (VM) guest operating system must be locked when the last console connection is closed.
When accessing the VM console, the guest operating system must be locked when the last console user disconnects, limiting the possibility of session hijacking. This setting only applies to Windows-...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
All 3D features on the virtual machine (VM) must be disabled when not required.
For performance reasons, it is recommended that 3D acceleration be disabled on virtual machines that do not require 3D functionality (e.g., most server workloads or desktops not using 3D applicatio...Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
Log size must be configured properly on the virtual machine (VM).
The ESXi hypervisor maintains logs for each individual VM by default. These logs contain information including but not limited to power events, system failure information, tools status and activity...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
Log retention must be configured properly on the virtual machine (VM).
The ESXi hypervisor maintains logs for each individual VM by default. These logs contain information including but not limited to power events, system failure information, tools status and activity...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
DirectPath I/O must be disabled on the virtual machine (VM) when not required.
VMDirectPath I/O (PCI passthrough) enables direct assignment of hardware PCI functions to VMs. This gives the VM access to the PCI functions with minimal intervention from the ESXi host. This is a ...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
Virtual disk shrinking must be disabled on the virtual machine (VM).
Shrinking a virtual disk reclaims unused space in it. If there is empty space in the disk, this process reduces the amount of space the virtual disk occupies on the host drive. Normal users and pro...Rule Medium Severity -
Host Guest File System (HGFS) file transfers must be disabled on the virtual machine (VM).
Setting "isolation.tools.hgfsServerSet.disable" to "true" disables registration of the guest's HGFS server with the host. Application Programming Interfaces (APIs) that use HGFS to transfer files t...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.