Detections
Analytics

1.11 Host hardware must secure unused external hardware ports

Information

Unused ports, especially USB, can be used by attackers to attach storage, networking, and keyboards. Take reasonable steps to control access to these ports through disablement, access control, and/or with other means such as solid rack doors, rack side panels, and flooring that makes the ports inaccessible from outside the rack when the rack door is closed. Cables fit easily through many gaps in and around racks and rack doors, and stiff wires can be used to push them into sockets from outside the rack, as well as to dislodge cables to create a service disruption.

Where possible, USB ports should also be set to only permit keyboards.

When disabling functionality like this please consider that you may need to access the server using a USB keyboard during an outage or as part of lifecycle operations, and plan accordingly.

Unused external hardware ports can be exploited as potential entry points for unauthorized devices and malicious activity, thereby compromising server security.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

- Place the ESXi host into maintenance mode if remediation will require a reboot.
 - Access the server BIOS/UEFI or hardware-management controller and disable unused external interfaces.

Impact:

Security involves balancing risks, including ease of recovery from outages. Disabling external ports can hinder emergency use of the ESXi console. Servers can often toggle USB port access; ensure your choice aligns with organizational needs and is tested prior to incidents.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|1.7, CSCv7|9.2

Plugin: VMware

Control ID: 18c3f7e9023c8ccef0348d2ce9dc4050fdabebf249accd6b1138970faa513ef2