Detections
Analytics

SRG-OS-99999-ESXI5-000161 - The system must zero out VMDK files prior to deletion.

Information

The virtual disk must be zeroed out prior to deletion in order to prevent sensitive data in VMDK files from being recovered.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Create and document a procedure to zero out sensitive data prior to removal of the VMDK file. Command line interface commands such as vmkfstools, dd, and rm must be used, per the examples below.

vmkfstools --writezeroes <path+vmdk_flat_file>
or
dd if=/dev/zero of=<path+vmdk_flat_file>

Note: The vSphere Client does not automatically zero out a VMDK file when it is destroyed.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-39353, Rule-ID|SV-250674r799021_rule, STIG-ID|SRG-OS-99999-ESXI5-000161, STIG-Legacy|SV-51211, STIG-Legacy|V-39353, Vuln-ID|V-250674

Plugin: VMware

Control ID: bdaf6d1f4c7e443eca23eaf57f63ffd3aaf4ac9c795b9e2b71ec5b1a394ae0ba