free vsphere compliance checker

Are any of the vmware hardening guide security recommendations generally accepted as "essential", and priority. Our infrastructure team were looking align to the security of the hosts, vcenter and vnetwork in line with the vmware hardening guide, however by looking at the potential impact column of the spreadsheet - many of the settings seem to introduce many issues for operations/support- without seemingly improving the security massively either.

So I wondered if there were some higher priority secureity settings - and if so specific to vsphere and vnetwork which exactly which those are? I assume some are more important than others?
LVL 3
pma111Asked:
Who is Participating?
 
Andrew Hancock (VMware vExpert / EE MVE^2)Connect With a Mentor VMware and Virtualization ConsultantCommented:
Physical Access to any computer system, limits the risk of security, whether physical or virtual, but not all organization apply it, some have servers in open offices.

I'm trying to determine, what you think of the following items in *YOUR* Organization.

1. Do you allow CDROM on your physical servers?

2. Do you allow USB flash drives, with physical servers?

3.Do you allow floppy drives with physical servers?

4. Do you have Passwords on all your KVMs in the datacentre?

5. Do you have a datcentre? - who is allowed into the datacentre?

6. Do people sign in and out, with a reason for why they visited?

7. Do you use Contract Staff for IT Administration?

8. Do you allow the use of usb flash drives?

9. Do you allow mobile phones in your organization?

All the above have an element of security risk to any organization? So where does your organization fit in?
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
You will need to assess which Security Restrictions are important for your organization.

e.g. we work with a client, Security is so restricted you have to be escorted into a Locked ROOM to perform Administration on some VMware Solutions, and are searched when you leave the room!
0
 
pma111Author Commented:
I would still assume the security controls recommended by vmware must have some level of importance thought, surely. I.e. some more important that others, or offer more benefits than others. I.e. microsoft has critical and important in their recommendations.
0
Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Those are Security Patches, with different threat levels. e.g. OS potential hack issues.

VMware Hardening Guide Security are recommendations, you need to asses, the Risk in your business.

We do not know your business, what Security and Governance you have in place for physical servers?

Do you allow CDROM, USB flash drives, floppy drives to be used in your datacentre, with physical servers?

Do you have Passwords on all your KVMs in the datacentre?

Do you have a datcentre? - who is allowed into the datacentre?

Do people sign in and out, with a reason for why they visited?
0
 
pma111Author Commented:
>Those are Security Patches, with different threat levels. e.g. OS potential hack issues.

As well as patches, the microsoft security compliance manager has a number of security configuration recommendaitons and ranks them as either critical or important . I wasnt sure if vmware ranked its security recommendaitons in a similar way, or whether the vmware experts couild give their view on which of the hardening guides settings are crucial, and which are less important.
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Can you please answer my previous questions, and I can then advise you, as how Security Aware your Organization is?
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Do you use Contract Staff for IT Administration?

Do you allow the use of usb flash drives and mobile phones in your organization?
0
 
pma111Author Commented:
Is that the core of the vmware recommendations, safeguards against physical access to your hosts?
0
 
pma111Author Commented:
Also not familiar with "KVM"?
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
KVM - Keyboard, Video, Monitor switch, allows the use of one keyboard, video and monitor to multiple physical server consoles in the datacentre.
0
 
pma111Author Commented:
1-3 - as and when required

4 - would have to check

5 - yes

6 - they should do, whether its done or not, unsure

7 - occasionally

8-9 - yes, albeit encrypted (and users need to be added to security groups to drag data to them)
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Thanks for answering the questions, so the same would apply to Virtual Machines. Based on a very quick assessment, you seem to have low security, if it was low, medium and high. (this may not be true of course!). Some clients, would answer NO, to all those questions.

You would have to allow virtual machine access to cdroms, floppy disks and usb drives, however there are methods to prevent this.
0
All Courses

From novice to tech pro — start learning today.