Detections
Analytics

8.4 (L2) VMware Tools on deployed virtual machines must prevent being recustomized

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Preventing re-customization of deployed virtual machines is essential to mitigate the risk of adversarial access through cloning and subsequent customization. Once a VM is deployed, it should be safeguarded against further customization to maintain the integrity of its configurations and data. The parameter governing this behavior is deployPkg enable-customization with a recommended setting of false.

This control mitigates the risk of unauthorized access and potential data exposure that may arise from cloning and re-customizing a VM. By adhering to this control, organizations uphold the integrity and security of deployed virtual machines.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Impact:

Disabling re-customization on deployed VMs may affect disaster recovery processes that necessitate IP address modifications. Such processes, facilitated by VMware Site Recovery Manager or VMware Cloud Disaster Recovery, will require alternative strategies for IP address management in recovery scenarios.

See Also

https://workbench.cisecurity.org/benchmarks/19200

Item Details

References: CSCv7|5.1

Plugin: VMware

Control ID: 0f75968bc1d3c1614fe3d19c23ffa7f6688e52be4495d08e07ee75679a62eab2