Detections
Analytics

1.49 VCSA-80-000285

Information

The vCenter Server must restrict access to cryptographic permissions.

GROUP ID: V-258952RULE ID: SV-258952r1003608

These permissions must be reserved for cryptographic administrators where virtual machine encryption and/or vSAN encryption is in use. Catastrophic data loss can result from poorly administered cryptography.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Client, go to Administration >> Access Control >> Roles.

Highlight the target custom role and click "Edit".

Remove the following permissions from any custom role that is not authorized to perform cryptographic related operations:

Cryptographic Operations privilegesGlobal.DiagnosticsHost.Inventory.Add host to clusterHost.Inventory.Add standalone hostHost.Local operations.Manage user groups

See Also

https://workbench.cisecurity.org/benchmarks/23621

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258952r1003608_rule, STIG-ID|VCSA-80-000285, Vuln-ID|V-258952

Plugin: VMware

Control ID: e9ac54502205ba6aa8589188d63d5dfc03e6955c4a1d2b2cfa911f266e0defae