Detections
Analytics

1.10 Host hardware must enable Intel SGX, if available

Information

Intel Xeon Scalable Processor platforms have Software Guard Extensions, or SGX, a technology that helps applications protect data in system memory. When configured properly, vSphere supports the use of SGX inside guest virtual machines. Enabling SGX in system firmware eases future enablement inside virtual machines and guest OSes.

Intel SGX (Software Guard Extensions) provides hardware-based memory encryption that protects sensitive data from unauthorized access or modification by malicious software running at higher privilege levels, enhancing server security.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

- Place the ESXi host into maintenance mode
 - Reboot the physical server
 - Enter the server BIOS/UEFI configuration and enable Intel SGX.

Impact:

Use of SGX requires guest OS support, and will limit some operational features inside vSphere, such as vMotion, snapshots, fault tolerance, and suspend/resume.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: Unix

Control ID: 153f78cc5a5784e63515f2d1d73277b0a651c22fa3c89cf937da729fb1f10e63