Home > Blogs > VMware Security & Compliance Blog > Tag Archives: Cloud

Tag Archives: Cloud

VMware CP&C releases a FREE vSphere 5.0 hardening guideline compliance checker!

I am hanging out in NYC finishing Cloud Expo East where we delivered a rousing session on Cloud Audit & Control with Coalfire AND CP&C is now VERY pleased to announce the release of our FREE vSphere 5.0 compliance checker! Last week we rolled out the 5.0 hardening guidelines in vCenter Configuration Manager (vCM) making it the first product on the planet to have the 5.0 content for our customers. Today, we are giving you access to a FREE vSphere 5.0 compliance checker! How awesome is that?

It is so easy to download and use that you can run it while watching Euro Cup with the sound of GOOOOOOAAAAAALLLLLLLLL!!!!!!!!!! In the background!

 Here is how the vSphere 5.0 Compliance Checker works: 

  • The Compliance Checker runs an assessment on 5 host systems at a time! (The 1st five being managed by an instance of vCenter Server)


  • The assessment is based on a predefined subset of the 5.0 Hardening Guidelines Content that currently exist today in vCenter Configuration Manager (vCM) Part of the vCenter Operations Manager Suite (vCo Ps)


  • The results for each host includes the rules, the rule descriptions, and the success or failure of each rule


 Check out the following results report from the vSphere 5 Checker


All you have to do is authenticate into the vCenter box that you want to assess hosts on.


The VMware Center for Policy & Compliance FREE Checkers are sweeter than bacon and designed to get you hooked & come back for more! 

Here is the link so you can get started hardening your vSphere Environment today. (Remember, we have FREE checkers for vSphere 4.0 & 4.1 AND for PCI 2.0 Windows & Linux)


Next, look for CP&C to release a HIPAA Checker that will be hotter than the Miami HEAT!

Now this poses a few questions and we would love to get your feedback: 

1. Are free tools like this helpful?

2. How do you currently lock down your vSphere environment?

3. Would remediation of the non-compliance results be a good next step?

4. Do you care about regulatory compliance & vendor best practices? If so, which ones? (PCI, HIPAA, DISA, CIS…) 

Jump in the discussion on any of our social media channels – blogs, Twitter, Facebook, or community forum: 


Cambio y Fuera!

George Gerchow – Director, VMware Center for Policy & Compliance


vCenter Configuration Manager 5.5 is now Generally Available

As you are probably aware, back in October we unveiled the VMware vCenter Operations Management Suite designed to deliver integrated performance, capacity and configuration management for virtualized and cloud computing environments.  What is less well known is that VMware vCenter Configuration Manager is the anchor for the “configuration” management capabilities within the suite.  Having been part of Configuresoft for several years before it was first purchased by EMC and then sold to VMware, I feel a bit like a dad watching his baby grow up.  The technology that was Configuresoft is at the heart of vCenter Configuration Manager.

 With today marking the general availability of vCenter Configuration Manager 5.5, I am both excited and proud to see this one go out the door.  vCenter Configuration Manager has always been a great solution for ensuring that Operating System software, whether Windows, Linux or Unix is properly configured to meet a broad range of security best practices, vendor hardening guidelines and regulatory mandates (think HIPAA, PCI, SOX etc).  But with this release, vCenter Configuration Manager becomes an indispensable part of the VMware family – addressing core requirements of the Virtual Infrastructure teams looking to leverage the VMware Cloud Infrastructure Suite as the foundation for business critical workloads moving to the cloud.

The primary theme for vCenter Configuration Manager 5.5 release is “Cloud Ready”.  New capabilities within this release significantly increase the ability of the Virtual Infrastructure team to ensure that their VMware Infrastructure is properly configured to meet the rigorous demands associated with virtualizing business critical workloads; including addressing requirements associated with VMware’s own hardening guidelines.  

This new release dramatically increases the ability to track configuration changes and to assess configuration compliance across the VMware Infrastructure including ESX, ESXi, vCenter, vCloud Director and vShield products.  There are also a substantially greater number of new configuration actions that can be executed against vCenter and ESX, ESXi configurations.  These configuration actions can be executed against a single object or in bulk against multiple objects spanning multiple vCenters.  They can be executed as part of an organization’s general configuration management processes or as part of a configuration compliance program. 

The enhancements to vCenter Configuration Manager 5.5 put tremendous visibility and control at the fingertips of the Virtual Infrastructure team responsible for VMware Infrastructure.  To help illustrate this I have included an example of how vCenter Configuration Manager can help manage configuration changes across the VMware Infrastructure (Figure 1). This particular high level dashboard is focused on the Virtual Infrastructure team and shows all changes that have occurred across the VMware Infrastructure for a specific time period.  



You can quickly drill down into any of these dashboards to investigate anything of interest or concern.  In this example I’ve drilled down into a specific vCenter (Figure 2) to understand a change associated with the “client.timeout.normal” setting.  I can see that this setting has been changed from 60 seconds to 10 which I know is out of compliance with operational best practices for vCenter (which calls for this setting to be equal or greater than 60 seconds).

Fig 2

In addition to the ability to see and understand prior changes, vCenter Configuration Manager provides the ability to change configuration settings across the VMware infrastructure (Figure 3).  I can do this for a single object or for multiple objects.  Bulk configuration changes can be directed across objects that span vCenters. 

Fig 3

Finally (Figure 4) I can proactively manage configurations through compliance where I create rules and templates (collections of rules) for any configurations I want to ensure are uniformly applied across my entire virtual data center or subsets of “like objects” in my data center.  vCenter Configuration Manager comes with a rich set of templates out-of-the box that can be used as is or as the starting point for the development of your own internal best practices.  

Fig 4

The new capabilities of vCenter Configuration Manager 5.5 significantly increase the value delivered to customers purchasing the vCenter Operations Management Suite Enterprise Edition where today vCenter Configuration Manager is included to address critically important use cases associated with “hardening” the VMware Cloud Infrastructure Suite. 

Other significant enhancements to vCenter Configuration Manager in this release include:

  • Ability to create machine groups within vCenter Configuration Manager based on organizational constructs (clusters, virtual datacenter, application trust zones) within vCenter, vCloud Director and vShield.
  • Support for configuration and compliance management for virtualization specific constructs such as templates and offline VMs (via VMware vCenter Orchestrator workflows delivered separate from the release)
  • The ability to snapshot a VM before making a configuration change
  • Support for the “Security Content Automation Protocol” (version 1.0) –  important to federal agencies
  • A new REST based API that will allow vCenter Configuration Manager to more fully participate in VMware and 3rd party ecosystem solutions

Early feedback from customers involved in beta testing has been extremely positive.  The increased ability of vCenter Configuration Manager to harden the VMware Infrastructure combined with the existing strength of the product to harden the Operating System (Windows, Linux, Unix) make vCenter Configuration Manager fundamental to clouds built on VMware technology.  More information can be found by visiting the vCenter Configuration Manager page on VMware.com.   Also, be sure to download the free vSphere Compliance Checker which will help you better understand the value that vCenter Configuration Manager delivers to organizations looking to move business critical workloads to the cloud.

Peace Out!

George Gerchow, Director, VMware Center for Policy and Compliance


RSA Conference San Francisco 2K12 – Back to the Golden Age

Greetings securanerds and compliance aficionados! 

The RSA Conference has made a HUGE come back this year in Tim Tebow\ Jeremy Lin-Sanity "like" fashion and secured it's rightful place as the largest & best security conference on the planet.
Art Coviello got things started with some HEAT as he preached the "Hack Back" message. The Buzz at RSA was intense and fresh as new privacy initiatives and cloud computing are driving life back into the security space along with compliance. The sessions and expo floor were simply PACKED! It was great to see the usual security Titans displaying their knowledge & goods along with up and comers like HyTrust who had their brand on the back of every badge.
For VMware Center for Policy & Compliance (CP&C) , it was immediate action from day uno as we were busier than a one-toothed man in a corn-on-the-cob eating contest! (No offense to my single fanged friends, it is just the truth 🙂
We started off with announcing our upcoming release of vCenter Configuration Manager (vCM) 5.5 part of the vCenter Operations Manager Suite (vCOPS), the best vSphere, Cloud Infrastructure Suite & Config\ Compliance Management Tool in the industry. You will hear more about vCM 5.5 when it goes GA on March 15th but I must give you a sneak peak, 5.5 may be sweeter than Crispy Bacon!
vCM 5.5 Example report showcasing  vCenter and vCD Permissions: 
    Providing a single view of permission levels across vCenters and vCDs that can be filtered by User, Group, Object, etc. 
    NOBODY else in the systems management space today can do this except for vCOPS & vCM!

Check it:
VCM 5.5 Effective Permissions Report


Next was an interview at the RSA booth on EMC Live TV going over our combined integration with VMware, EMC & RSA into Archer (eGRC) solution to deliver "Compliance Across the Stack" bringing together technical controls with policy enforcement. The demo showcases Server, Network and Storage Compliance results in Archer! This is a LARGE step in our Trusted Cloud initiative "Meeting Customers Compliance Requirements to Migrate Tier 1 Apps to vSphere and Cloud Environments".
Here is the Video:   


And our blog on the announcement with screen shots from the integrated Archer   Demo:


We kept the vibe alive as our honorary CP&C member Davi Ottenheimer "The Flying Penguin http://www.flyingpenguin.com/"  threw some deep knowledge at folks during his Sessions:
    CLD-108 Lightning Round: Data Confidentiality and Integrity in the Cloud
    DAS-302: Message in a Bottle – Finding Hope in a Sea of Security Breach Data

I hope you got a chance to see him in action, if not you can catch Davi live in Vegas singing Sinatra at the Venetian Showroom. (Seriously http://davisingssinatra.com/)
Finally we started wrapping things up with the VMware communities podcast #177 covering the conference with my RSA pal Mike Foley:
Switching gears a bit, we also saw blatant displays where policy & technology could not prevent human action from putting the environment at risk. There were several people who made their way into sessions by telling the door staff "We are with the Speaker". In all cases, the hoodlums were welcomed without any identified credentials, verification from the speaker or proof of having a delegate badge. It just goes to show you that visibility, training and accountability are key ingredients to a securing an infrastructure in a compliant fashion. (Next year just buy a full conference badge people!)
Last but not least and to get your weekend started with a laugh, check out the following HILARIOUS video on VMware security and compliance solutions for the Cloud:
Feel free to hit us up with questions & comments at:
Have a great weekend, snow is falling all over the west so hit the slopes if you can!
Please excuse any typos or grammar mistakes, after all I am ESL and will lean on that as long as possible. 
Peace Out!
George Gerchow – VMware Director, Center for Policy & Compliance