Detections
Analytics

8.6 VMware Tools must limit the automatic removal of features

Information

Limiting the automatic removal of features by VMware Tools during upgrade processes is crucial to maintain the intended security profile of the guest OS from vSphere. The automatic upgrade could potentially remove essential features, impacting the security posture inadvertently. The parameter governing this behavior is autoupgrade allow-remove-feature with a recommended setting of false.

Restricting automatic removal of features ensures that the security configurations and other essential features remain intact during upgrades, thus maintaining a consistent security posture.

Solution

To remediate this recommendation, configure VMware Tools to prevent automatic removal of installed features during reconfiguration/upgrade unless required. Apply the guest-OS-specific VMware Tools configuration and validate application dependencies.

Impact:

With this control, administrators would need to employ alternative methods for updating and reconfiguring VMware Tools, which might necessitate additional administrative effort.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: VMware

Control ID: a1497c4f7bf462b6f139dd004d2b1dce62942d4933c7953f49029955e11b6f61