Detections
Analytics

7.1 (L2) Virtual machines must enable Secure Boot

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enable Secure Boot on virtual machines to ensure that only authenticated code runs from the firmware up through the operating system, thus providing a fundamental security measure against boot-time malware and unauthorized code execution. Supported by all modern guest operating systems, Secure Boot employs public key cryptography to validate the firmware, boot loader, drivers, and OS kernel at boot time.

By enforcing Secure Boot, organizations can mitigate the risk of boot-time malware and unauthorized code execution, which is crucial for maintaining the integrity and trustworthiness of the system from the first instruction.

Solution

The following PowerCLI command may be used:

$VMobj = (Get-VM -Name $VM)
$ConfigSpec = New-Object VMware.Vim.VirtualMachineConfigSpec
$bootOptions = New-Object VMware.Vim.VirtualMachineBootOptions
$bootOptions.EfiSecureBootEnabled = $true
$ConfigSpec.BootOptions = $bootOptions
$task = $VMobj.ExtensionData.ReconfigVM_Task($ConfigSpec)

Impact:

Activation of Secure Boot post guest OS installation may entail more than merely enabling a setting; consult the respective guest OS documentation for detailed instructions. This may introduce additional steps in the setup process, potentially extending the deployment time.

See Also

https://workbench.cisecurity.org/benchmarks/19200

Item Details

References: CSCv7|5.1

Plugin: VMware

Control ID: b89bf0cc9208e5b5ae6aa9ab408279e38d0f002b115a4163afe8d8e70ff13a10