Detections
Analytics

1.12 (L2) Host integrated hardware management controller must deactivate internal networking

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Many servers have integrated hardware management controllers with the ability to present virtual network interfaces to ESXi as a management interface. These approaches create potential backdoors for access and are used by adversaries to circumvent network-based/perimeter firewalls, in either direction, and avoid observation by IDS/IPS/threat analysis tools. In many cases this functionality is not strictly necessary to manage hosts.

Using integrated hardware management controllers to present virtual network interfaces to ESXi can inadvertently create backdoors, allowing adversaries to bypass firewalls and evade detection by security tools; often, this functionality isn't essential for host management.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Impact:

Disablement of internal networking may limit vendor management tool effectiveness.

See Also

https://workbench.cisecurity.org/benchmarks/19200

Item Details

References: CSCv7|11.7

Plugin: VMware

Control ID: 4e94841bb4b6837c9a5d9066a5a3dc9c099fc3d354e3cf9e893e94e00622f147