Home
Security Hardening
DISA STIG VMware vSphere 6.7 ESXi V1R1

DISA STIG VMware vSphere 6.7 ESXi V1R1

ESXI-67-000050 – The ESXi host must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.
Details Virtual machines might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes vSAN, iSCSI, and...
ESXI-67-000052 – The ESXi host must protect the confidentiality and integrity of transmitted information by using different TCP/IP stacks where possible.
Details Three different TCP/IP stacks are available by default on ESXi: Default, Provisioning, and vMotion. To better protect and isolate...
ESXI-67-000053 – SNMP must be configured properly on the ESXi host.
Details If SNMP is not being used, it must remain disabled. If it is being used, the proper trap destination...
ESXI-67-000054 – The ESXi host must enable bidirectional CHAP authentication for iSCSI traffic.
Details When enabled, vSphere performs bidirectional authentication of both the iSCSI target and host. There is a potential for a...
ESXI-67-000055 – The ESXi host must disable Inter-VM transparent page sharing.
Details Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to...
ESXI-67-000074 – The ESXi host must exclusively enable TLS 1.2 for all endpoints.
Details TLS 1.0 and 1.1 are deprecated protocols with well-published shortcomings and vulnerabilities. TLS 1.2 should be enabled on all...
ESXI-67-000079 – The ESXi host must not suppress warnings that the local or remote shell sessions are enabled.
Details Warnings that local or remote shell sessions are enabled alert administrators to activity that they may not be aware...
ESXI-67-100004 – The ESXi host must centrally review and analyze audit records from multiple components within the system by configuring remote logging.
Details Remote logging to a central log host provides a secure, centralized store for ESXi logs. By gathering host log...
ESXI-67-000060 – The virtual switch MAC Address Change policy must be set to reject on the ESXi host.
Details If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC...
ESXI-67-000061 – The virtual switch Promiscuous Mode policy must be set to reject on the ESXi host.
Details When Promiscuous Mode is enabled for a virtual switch, all virtual machines connected to the Portgroup have the potential...

Prev Next

DISA STIG VMware vSphere 6.7 ESXi V1R1

ESXI-67-000050 – The ESXi host must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.

ESXI-67-000052 – The ESXi host must protect the confidentiality and integrity of transmitted information by using different TCP/IP stacks where possible.

ESXI-67-000053 – SNMP must be configured properly on the ESXi host.

ESXI-67-000054 – The ESXi host must enable bidirectional CHAP authentication for iSCSI traffic.

ESXI-67-000055 – The ESXi host must disable Inter-VM transparent page sharing.

ESXI-67-000074 – The ESXi host must exclusively enable TLS 1.2 for all endpoints.

ESXI-67-000079 – The ESXi host must not suppress warnings that the local or remote shell sessions are enabled.

ESXI-67-100004 – The ESXi host must centrally review and analyze audit records from multiple components within the system by configuring remote logging.

ESXI-67-000060 – The virtual switch MAC Address Change policy must be set to reject on the ESXi host.

ESXI-67-000061 – The virtual switch Promiscuous Mode policy must be set to reject on the ESXi host.