Detections
Analytics

1.9 Host hardware must enable AMD SEV-ES, if available

Information

AMD EPYC platforms support SEV-ES, a technology to encrypt memory and CPU register state, and limit visibility to the hypervisor, in order to increase workload security and decrease exposure to certain types of attacks. When configured properly, vSphere supports the use of SEV-ES inside guest virtual machines and containers under vSphere and vSphere with Tanzu. Enabling SEV-ES in system firmware eases future enablement inside virtual machines, containers, and guest OSes.

Enabling AMD SEV-ES (Secure Encrypted Virtualization-Encrypted State) on host hardware enhances the security of virtual machines by encrypting their memory and CPU state, reducing the risk of unauthorized data access and tampering from compromised hypervisors or malicious actors.

Solution

- Place the ESXi host into maintenance mode and reboot the physical server.
 - Enter the server BIOS/UEFI configuration and enable the AMD virtualization and memory-encryption features required by the platform.

Impact:

Use of SEV-ES in a particular VM requires the guest OS to support it, and will limit some operational features such as vMotion, snapshots, and so on. Consult the documentation for more information about these tradeoffs.

See Also

https://workbench.cisecurity.org/benchmarks/28124

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: Unix

Control ID: e97a4c1e9a0ea5a9b4f255d80b83b0c354dc8b4b1e121f24c1f85cab45048a87