VCWN-65-000063 - The vCenter Server for Windows must restrict access to cryptographic role.

Information

vSphere 6.5 modifies the built-in 'Administrator' role to add permission to perform cryptographic operations such as KMS operations and encrypting and decrypting virtual machine disks. This role must be reserved for cryptographic administrators where VM encryption and/or vSAN encryption is in use. A new built-in role called 'No Cryptography Administrator' has been added to provide all administrative permissions except cryptographic operations. Permissions must be restricted such that normal vSphere administrators are assigned the 'No Cryptography Administrator' role or more restrictive. The 'Administrator' role must be tightly controlled and must not be applied to administrators who will not be doing cryptographic work. Catastrophic data loss can result from a poorly administered cryptography.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Web Client go to Administration >> Access Control >> Roles

Move any accounts not explicitly designated for cryptographic operations, other than Solution Users, to other roles such as 'No Cryptography Administrator'.

Item Details

Audit Name: DISA VMware vSphere 6.5 vCenter Server for Windows STIG v2r3

Category: CONFIGURATION MANAGEMENT

Plugin: VMware

Control ID: 8dab8da8e55313b2c4a93d94db8f7cb7e5e85a838571943016ec66ca0160f730

Detections

Analytics

VCWN-65-000063 - The vCenter Server for Windows must restrict access to cryptographic role.

Information

Solution

See Also

Item Details