Detections
Analytics

8.4 VMware Tools on deployed virtual machines must prevent being recustomized

Information

Preventing re-customization of deployed virtual machines is essential to mitigate the risk of adversarial access through cloning and subsequent customization. Once a VM is deployed, it should be safeguarded against further customization to maintain the integrity of its configurations and data. The parameter governing this behavior is deployPkg enable-customization with a recommended setting of false.

This control mitigates the risk of unauthorized access and potential data exposure that may arise from cloning and re-customizing a VM. By adhering to this control, organizations uphold the integrity and security of deployed virtual machines.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remediate this recommendation, disable post-deployment recustomization using the VMware Tools configuration supported for the guest OS and environment. Test provisioning/customization workflows first and retain customization capability only on approved templates or build images.

Impact:

Disabling re-customization on deployed VMs may affect disaster recovery processes that necessitate IP address modifications. Such processes, facilitated by VMware Site Recovery Manager or VMware Cloud Disaster Recovery, will require alternative strategies for IP address management in recovery scenarios.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: VMware

Control ID: 0f75968bc1d3c1614fe3d19c23ffa7f6688e52be4495d08e07ee75679a62eab2