Detections
Analytics

7.11 Virtual machines must remove unnecessary AHCI devices

Information

Removing unnecessary devices from virtual machines minimizes the attack surface and reduces potential pathways for data exfiltration or unauthorized data capture. This practice aligns with the principle of least functionality, ensuring that VMs have only the essential components required to perform their designated functions.

Eliminating unnecessary devices reduces attack surface and streamlines the virtual machine configuration, promoting a cleaner, more manageable, and less vulnerable setup.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

To remediate this recommendation, power off the VM if required and remove unused AHCI/SATA controllers only after removing or moving dependent devices. Do not remove a controller that is actively backing a required virtual disk.

Impact:

Careful analysis and understanding of the virtual machine's requirements and dependencies are crucial before implementing this security control to avoid unintended disruptions or degradation of service.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: VMware

Control ID: cd75378b0febf71fd6d6347f6edc2b5a14deb8a0c1e3e2a15d0e36a3912a0e9f