Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

unauthorised devices connected

Posted on 2013-11-12
3
Medium Priority
?
260 Views
Last Modified: 2013-11-20
1, the vmware compliance checker flags it as an issue if unauthorised hardware are attached to a host (i.e. USB, floppy, IDLE, SERIAL etc), but what is the risk? Why would there be USB drives, IDLE, SERIAL etc drives attached to hosts? Surely its only admins who could access whatevers on them anyway, so I dont really see how this is a security issue? Normal domain users wouldnt be able to access drives attached to hosts would they?

2, Also - what determines which guests on a host can access the drive youve plugged in to a host? Say I have a host with 10 guests, and plug in a USB thumb drive, can all guests access this drive, or if not how do you determine which.
0
Comment
Question by:pma111
  • 2
3 Comments
 
LVL 124

Accepted Solution

by:
Andrew Hancock (VMware vExpert / EE MVE^2) earned 2000 total points
ID: 39641435
1. Does your company have a data theft policy?

An Administrator, which has been paid off to steal data, could easily add a small USB device, connect to the host, and steal data!

this is how easy it is todo!

HOW TO: Add and Connect a USB Device to a Virtual Machine, hosted on VMware vSphere Hypervisor ESX 4.1 ESXi 4.1, ESXi 5.0

It really depends, how your Security in your organization, I know of plenty of clients, that prohibits the connection of USB flash drives to Desktop computers!

Normally hosts are in a secure area, e.g. the datacentre, or machine room, users are not normally allow in. But an Administrator with a hidden agenda, could steal VMs or data easily.

Not all Risks in the Compliance Checker, are possibly going to be Risks for your organization, but some organizations, they are applicable.

You need to make an assessment, as to how Risky, they are to you.

2. Yes, if configured to, see above!
0
 
LVL 3

Author Comment

by:pma111
ID: 39641443
How can you get a report of what devices are currently attached to each host? Is the compliance checker also going to report on drives in the host itself, i.e. internal hard disc drives.

I assume accessing what info is on these drives is not typically do-able over the network by basic users, i.e. youd need admin level access to the guest to do so?
0
 
LVL 124
ID: 39641469
The Compliance checker, will confirm if devices can be connected to the VM.

Administrator access is required to access the virtual machine disks.

The vSphere Security Hardening Script can report if a VM is connected to a device.
0

Featured Post

Threat Trends for MSPs to Watch

See the findings.
Despite its humble beginnings, phishing has come a long way since those first crudely constructed emails. Today, phishing sites can appear and disappear in the length of a coffee break, and it takes more than a little know-how to keep your clients secure.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When rebooting a vCenters 6.0 and try to connect using vSphere Client we get this issue "Invalid URL: The hostname could not parsed." When we get this error we need to do some changes in the vCenter advanced settings to fix the issue.
Giving access to ESXi shell console is always an issue for IT departments to other Teams, or Projects. We need to find a way so that teams can use ESXTOP for their POCs, or tests without giving them the access to ESXi host shell console with a root …
Teach the user how to configure vSphere Replication and how to protect and recover VMs Open vSphere Web Client: Verify vsphere Replication is enabled: Enable vSphere Replication for a virtual machine: Verify replicated VM is created: Recover replica…
Teach the user how to install log collectors and how to configure ESXi 5.5 for remote logging Open console session and mount vCenter Server installer: Install vSphere Core Dump Collector: Install vSphere Syslog Collector: Open vSphere Client: Config…

886 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question