Home
Security Hardening
DISA STIG VMware vSphere 6.7 VCenter V1R1

DISA STIG VMware vSphere 6.7 VCenter V1R1

DISA_STIG_VMware_vSphere_vCenter_6.7_v1r1.audit from DISA VMware vSphere 6.7 vCenter v1r1 STIG
See Also https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_STIG.zip This control applies to the following type of system VMware. Source Tenable.com/audits
VCTR-67-000001 – The vCenter Server must prohibit password reuse for a minimum of five generations.
Details Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and...
VCTR-67-000002 – The vCenter Server must not automatically refresh client sessions.
Details Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take...
VCTR-67-000003 – The vCenter Server must enforce a 60-day maximum password lifetime restriction.
Details Any password, no matter how complex, can eventually be cracked. Therefore, passwords need to be changed at specific intervals....
VCTR-67-000004 – The vCenter Server must terminate management sessions after 10 minutes of inactivity.
Details Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take...
VCTR-67-000005 – The vCenter Server users must have the correct roles assigned.
Details Users and service accounts must only be assigned privileges they require. Least privilege requires that these privileges must only...
VCTR-67-000007 – The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information-flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).
Details DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either...
VCTR-67-000008 – The vCenter Server must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events.
Details It is critical for the appropriate personnel to be aware if an ESXi host is at risk of failing...
VCTR-67-000018 – The vCenter Server must configure all port groups to a value other than that of the native VLAN.
Details ESXi does not use the concept of native VLAN. Frames with VLAN specified in the port group will have...
VCTR-67-000019 – The vCenter Server must not configure VLAN Trunking unless Virtual Guest Tagging (VGT) is required and authorized.
Details When a port group is set to VLAN Trunking, the vSwitch passes all network frames in the specified range...

DISA STIG VMware vSphere 6.7 VCenter V1R1

DISA_STIG_VMware_vSphere_vCenter_6.7_v1r1.audit from DISA VMware vSphere 6.7 vCenter v1r1 STIG

VCTR-67-000001 – The vCenter Server must prohibit password reuse for a minimum of five generations.

VCTR-67-000002 – The vCenter Server must not automatically refresh client sessions.

VCTR-67-000003 – The vCenter Server must enforce a 60-day maximum password lifetime restriction.

VCTR-67-000004 – The vCenter Server must terminate management sessions after 10 minutes of inactivity.

VCTR-67-000005 – The vCenter Server users must have the correct roles assigned.

VCTR-67-000007 – The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information-flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).

VCTR-67-000008 – The vCenter Server must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events.

VCTR-67-000018 – The vCenter Server must configure all port groups to a value other than that of the native VLAN.

VCTR-67-000019 – The vCenter Server must not configure VLAN Trunking unless Virtual Guest Tagging (VGT) is required and authorized.