I - Mission Critical Public
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000065
Group -
The vCenter Server must enforce the limit of three consecutive invalid login attempts by a user.
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the a...Rule Medium Severity -
SRG-APP-000068
Group -
The vCenter Server must display the Standard Mandatory DOD Notice and Consent Banner before logon.
Display of the DOD-approved use notification before granting access to the application ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive ...Rule Medium Severity -
SRG-APP-000095
Group -
The vCenter Server must produce audit records containing information to establish what type of events occurred.
Without establishing what types of events occurred, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.Rule Medium Severity -
SRG-APP-000141
Group -
vCenter Server plugins must be verified.
The vCenter Server includes a vSphere Client extensibility framework, which provides the ability to extend the vSphere Client with menu selections or toolbar icons that provide access to vCenter Se...Rule Medium Severity -
SRG-APP-000148
Group -
The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users.
To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational user...Rule Medium Severity -
SRG-APP-000080
Group -
The vCenter Server must require multifactor authentication.
Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentica...Rule Medium Severity -
SRG-APP-000164
Group -
The vCenter Server passwords must be at least 15 characters in length.
The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Password complexity, or strength, is a measure of the effectivene...Rule Medium Severity -
SRG-APP-000165
Group -
The vCenter Server must prohibit password reuse for a minimum of five generations.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. To meet password policy requirements, passwords must be...Rule Medium Severity -
SRG-APP-000166
Group -
The vCenter Server passwords must contain at least one uppercase character.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-APP-000167
Group -
The vCenter Server passwords must contain at least one lowercase character.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-APP-000168
Group -
The vCenter Server passwords must contain at least one numeric character.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-APP-000169
Group -
The vCenter Server passwords must contain at least one special character.
Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resistin...Rule Medium Severity -
SRG-APP-000172
Group -
The vCenter Server must enable FIPS-validated cryptography.
FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules use authentication that meets DOD requirements. In vSphere 6.7 and later, ESXi and vCenter Se...Rule High Severity -
SRG-APP-000174
Group -
The vCenter Server must enforce a 90-day maximum password lifetime restriction.
Any password, no matter how complex, can eventually be cracked. Therefore, passwords must be changed at specific intervals. One method of minimizing this risk is to use complex passwords and perio...Rule Medium Severity -
SRG-APP-000175
Group -
The vCenter Server must enable revocation checking for certificate-based authentication.
The system must establish the validity of the user-supplied identity certificate using Online Certificate Status Protocol (OCSP) and/or Certificate Revocation List (CRL) revocation checking. Satis...Rule Medium Severity -
SRG-APP-000190
Group -
The vCenter Server must terminate vSphere Client sessions after 15 minutes of inactivity.
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port th...Rule Medium Severity -
SRG-APP-000211
Group -
The vCenter Server user roles must be verified.
Users and service accounts must only be assigned privileges they require. Least privilege requires that these privileges must only be assigned if needed to reduce risk of confidentiality, availabil...Rule Medium Severity -
SRG-APP-000247
Group -
The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).
DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot accomplish its mission or must operate at degraded capacity. Managing exc...Rule Medium Severity -
SRG-APP-000291
Group -
The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.
Once an attacker establishes initial access to a system, they often attempt to create a persistent method of reestablishing access. One way to accomplish this is for the attacker to create a new ac...Rule Medium Severity -
SRG-APP-000345
Group -
The vCenter Server must set the interval for counting failed login attempts to at least 15 minutes.
By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the a...Rule Medium Severity -
SRG-APP-000358
Group -
The vCenter Server must be configured to send logs to a central log server.
vCenter must be configured to send near real-time log data to syslog collectors so information will be available to investigators in the case of a security incident or to assist in troubleshooting.Rule Medium Severity -
SRG-APP-000360
Group -
The vCenter server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts.
It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impe...Rule Medium Severity -
SRG-APP-000371
Group -
The vCenter Server must compare internal information system clocks at least every 24 hours with an authoritative time server.
Inaccurate time stamps make it more difficult to correlate events and can lead to an inaccurate analysis. Determining the correct time a particular event occurred on a system is critical when condu...Rule Medium Severity -
SRG-APP-000427
Group -
The vCenter Server Machine Secure Sockets Layer (SSL) certificate must be issued by a DOD certificate authority.
Untrusted certificate authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DOD systems or by organizations with insufficient secur...Rule Medium Severity -
SRG-APP-000428
Group -
The vCenter Server must enable data at rest encryption for vSAN.
Applications handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. Data encryption...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.