Home > Blogs > VMware Security & Compliance Blog > Tag Archives: VMware

Tag Archives: VMware

New VMware Security Advisory VMSA-2017-0009

Today VMware has released the following new security advisory:

VMSA-2017-0009 – VMware Workstation update addresses multiple security issues

This documents an important severity insecure library loading issue via ALSA sound driver configuration files (CVE-2017-4915) and a moderate severity NULL pointer dereference issue (CVE-2017-4916) affecting Workstation Pro/Player.

All VMware Workstation Pro/Player 12.x are affected.

Successful exploitation of the insecure library loading issue may allow unprivileged host users to escalate their privileges to root in a Linux host machine.

The NULL pointer dereference vulnerability exists in the vstor2 driver and may allow host users with normal user privileges to trigger a denial-of-service in a Windows host machine.

Workstation Pro/Player 12.5.6 fixes all these issues.

VMware would like to thank Jann Horn of Google Project Zero and Borja Merino for reporting these issues to us.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

New VMware Security Advisory VMSA-2016-0010

Today VMware has released the following new security advisory:

VMSA-2016-0010 – VMware product updates address multiple important security issues

This addresses a DLL hijacking issue in Windows-based VMware Tools “Shared Folders” (HGFS) feature (CVE-2016-5330) and an HTTP Header injection issue in vCenter Server and ESXi (CVE-2016-5331).

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

VMware CP&C releases IRS 1075 Content in vCM!

The VMware Center for Policy & Compliance (CP&C) is pleased to announce the release of IRS 1075 content in vCenter Configuration Manager. vCM, a key component in the vCenter Operations Suite. (vC Ops)

The purpose of 1075 is to protect Federal Tax Information (FTI) and secure Safeguards for Protecting FederalTax Returns and Return Information.

Introduction to IRS 1075 for Virtualization

To Utilize a Virtual Environment that receives, processes, stores or transmits FTI, the agency must meet the following mandatory notification requirements: 

Notification Requirements 

  • If the agency’s approved SPR is less than six years old and reflects the agency’s current process, procedures and systems, the agency must submit the Virtualization Notification, which will serve as an addendum to their SPR.
  • If the agency’s SPR is more than six years old or does not reflect the agency’s current process, procedures and systems, the agency must submit a new SPR and the Virtualization Notification.

 

With the IRS 1075 content in vCM, our customers will be able to get great dashboard to track their Compliance posture:

IRS.1

You can also break down the compliance results by data type to see where most of your infractions are coming from:

IRS.2

From there, you can see the individual rules behind the content that is surfaced in our dashboards. In this release we provided 5 Rule groups, 2 templates and 104 rules:

IRS.3

Keep in mind that vCM manages not only virtual enviroments, but covers physical as well. It is the market leader in Configuration Audit, Change Detection, Patch Management and COMPLIANCE content. Yes! That is right, we can also remediate non compliant results with a right click in both the virtual and physical world! vCM even has VDI (VIEW) hardening guidelines. Look for our Mobile Compliance Content coming soon… 

Also, don't forget about the VMware CP&C FREE compliance checkers! 

https://my.vmware.com/web/vmware/evalcenter?p=compliance-chk&lp=default

The IRS 1075 guidelines are available today and can be downloaded using the vCM Content Wizard.

Feel free to hit us up with questions & comments at:

Hasta La Vista,

George Gerchow – Director, VMware Center for Policy & Compliance

 

 

 

VMware (CP&C) Releases PCI 2.0 FREE Compliance Checkers!

Hola Amigos y Amigas,

Today we are going to give you access to two (That’s right, DOS!) FREE downloadable tools that help you get started on the journey to achieving PCI 2.0 Compliance.

The PCI 2.0 Compliance Checkers for Windows and LINUX are fresh off the virtual assembly line and compiled by the good folks at VMware’s Center for Policy & Compliance! (CP&C)

 Here is how they work: 

  • The Compliance Checkers run an assessment on 5 Guest systems at a time!
  • The assessment is based on a predefined subset of the PCI 2.0 Content that currently exist today in vCenter Configuration Manager (vCM) Part of the vCenter Operations Manager Suite
  • The results for each guest includes the rules, the rule descriptions, and the success or failure of each rule

 Check out the following results report from the LINUX Checker. Pure AWESOMENESS! 

PCI.Checker.Linux.4.12

The Compliance Checkers are designed to get you hooked and come back for more! 

Here is the link so you can get started hardening your vSphere and Guest Environment today. (Remember, we have FREE checkers for vSphere 4.0 & 4.1)

https://www.vmware.com/tryvmware/?p=compliance-chk&lp=default&cid=70180000000MJsMAAW

The vSphere 5.0 Checker will soon be on its way like a Tim Tebow Comeback! (Too bad his comebacks will be for the Jets, I love my Broncos but am not happy about the Manning move.) Just sayin…

Now this poses a few questions and we would love to get your feedback: 

1. Are free tools like this helpful?

2. How do you currently lock down your vSphere environment?

3. Would remediation of the non-compliance results be a good next step?

4. Do you care about regulatory compliance & vendor best practices? If so, which ones? (PCI, HIPAA, DISA, CIS…) 

Jump in the discussion on any of our social media channels – blogs, Twitter, Facebook, or community forum: 

 Peace Out!

George Gerchow – Director, VMware Center for Policy & Compliance

 

 

vCenter Configuration Manager 5.5 is now Generally Available

As you are probably aware, back in October we unveiled the VMware vCenter Operations Management Suite designed to deliver integrated performance, capacity and configuration management for virtualized and cloud computing environments.  What is less well known is that VMware vCenter Configuration Manager is the anchor for the “configuration” management capabilities within the suite.  Having been part of Configuresoft for several years before it was first purchased by EMC and then sold to VMware, I feel a bit like a dad watching his baby grow up.  The technology that was Configuresoft is at the heart of vCenter Configuration Manager.

 With today marking the general availability of vCenter Configuration Manager 5.5, I am both excited and proud to see this one go out the door.  vCenter Configuration Manager has always been a great solution for ensuring that Operating System software, whether Windows, Linux or Unix is properly configured to meet a broad range of security best practices, vendor hardening guidelines and regulatory mandates (think HIPAA, PCI, SOX etc).  But with this release, vCenter Configuration Manager becomes an indispensable part of the VMware family – addressing core requirements of the Virtual Infrastructure teams looking to leverage the VMware Cloud Infrastructure Suite as the foundation for business critical workloads moving to the cloud.

The primary theme for vCenter Configuration Manager 5.5 release is “Cloud Ready”.  New capabilities within this release significantly increase the ability of the Virtual Infrastructure team to ensure that their VMware Infrastructure is properly configured to meet the rigorous demands associated with virtualizing business critical workloads; including addressing requirements associated with VMware’s own hardening guidelines.  

This new release dramatically increases the ability to track configuration changes and to assess configuration compliance across the VMware Infrastructure including ESX, ESXi, vCenter, vCloud Director and vShield products.  There are also a substantially greater number of new configuration actions that can be executed against vCenter and ESX, ESXi configurations.  These configuration actions can be executed against a single object or in bulk against multiple objects spanning multiple vCenters.  They can be executed as part of an organization’s general configuration management processes or as part of a configuration compliance program. 

The enhancements to vCenter Configuration Manager 5.5 put tremendous visibility and control at the fingertips of the Virtual Infrastructure team responsible for VMware Infrastructure.  To help illustrate this I have included an example of how vCenter Configuration Manager can help manage configuration changes across the VMware Infrastructure (Figure 1). This particular high level dashboard is focused on the Virtual Infrastructure team and shows all changes that have occurred across the VMware Infrastructure for a specific time period.  

Figure1

 

You can quickly drill down into any of these dashboards to investigate anything of interest or concern.  In this example I’ve drilled down into a specific vCenter (Figure 2) to understand a change associated with the “client.timeout.normal” setting.  I can see that this setting has been changed from 60 seconds to 10 which I know is out of compliance with operational best practices for vCenter (which calls for this setting to be equal or greater than 60 seconds).

Fig 2

In addition to the ability to see and understand prior changes, vCenter Configuration Manager provides the ability to change configuration settings across the VMware infrastructure (Figure 3).  I can do this for a single object or for multiple objects.  Bulk configuration changes can be directed across objects that span vCenters. 

Fig 3

Finally (Figure 4) I can proactively manage configurations through compliance where I create rules and templates (collections of rules) for any configurations I want to ensure are uniformly applied across my entire virtual data center or subsets of “like objects” in my data center.  vCenter Configuration Manager comes with a rich set of templates out-of-the box that can be used as is or as the starting point for the development of your own internal best practices.  

Fig 4

The new capabilities of vCenter Configuration Manager 5.5 significantly increase the value delivered to customers purchasing the vCenter Operations Management Suite Enterprise Edition where today vCenter Configuration Manager is included to address critically important use cases associated with “hardening” the VMware Cloud Infrastructure Suite. 

Other significant enhancements to vCenter Configuration Manager in this release include:

  • Ability to create machine groups within vCenter Configuration Manager based on organizational constructs (clusters, virtual datacenter, application trust zones) within vCenter, vCloud Director and vShield.
  • Support for configuration and compliance management for virtualization specific constructs such as templates and offline VMs (via VMware vCenter Orchestrator workflows delivered separate from the release)
  • The ability to snapshot a VM before making a configuration change
  • Support for the “Security Content Automation Protocol” (version 1.0) –  important to federal agencies
  • A new REST based API that will allow vCenter Configuration Manager to more fully participate in VMware and 3rd party ecosystem solutions

Early feedback from customers involved in beta testing has been extremely positive.  The increased ability of vCenter Configuration Manager to harden the VMware Infrastructure combined with the existing strength of the product to harden the Operating System (Windows, Linux, Unix) make vCenter Configuration Manager fundamental to clouds built on VMware technology.  More information can be found by visiting the vCenter Configuration Manager page on VMware.com.   Also, be sure to download the free vSphere Compliance Checker which will help you better understand the value that vCenter Configuration Manager delivers to organizations looking to move business critical workloads to the cloud.

Peace Out!

George Gerchow, Director, VMware Center for Policy and Compliance

 

Thoughts on Visibility, Context, and Control after listening to Chris Young’s keynote from RSA 2012

At RSA last week in San Fran, Chris Young, from Cisco, commanded the stage, he held the audience on the edge of their seats in anticipation, and he said all the right things. Well, that is he said all the right things to make Cisco sound perfectly positioned. And can we really fault them for being so network centric?

He did make some excellent points. Chris said “I believe that visibility and context aware enforcement are two of the things we all need the most in security” which I totally agree with. You obviously can’t take action against an attack if you can’t visualize it. And how do you know if it’s legitimate or not without the context. In fact this has been the premise of IPS and Anomaly Detection tools for over a decade. And yes, those are definitely network based tools.

Have you ever stopped to consider WHY those tools are network based? It’s because that was where the concept of an inline tap was developed. It was easy for an engineer to take the network signal off an ethernet cable and pipe it into an analysis tool without actually interfering with the connection. And that served as a much easier way of monitoring lots of systems communicating without the pain of attaching to every new system as they were added to the network.

The concept of a tap may have been born out of networking, but it can now be applied to a wide range of other technologies. The same idea has been applied and in-use with software agents for at least a decade as well to shim or tap the CPU, memory, storage, and networking stacks inside an OS. Those agents work fairly well, but in recent years they have succumb to attack from malware designed to disable these tools upon takeover of an OS. The reason the malware has been successful against a “host agent”, but not against a network agent comes from the context of execution. When a piece of malware takes over an OS, it has already taken control beyond the scope of what was originally designed. To say it another way, the malware plays with no rules or makes up its own rules on the fly, but the security software and OS are only going to ever adhere to the rules they know. So agent based tools are always at a disadvantage.

So with that context in mind, the security world has been split between network centric tools and software agent tools but because of the inherent dis-advantage of the software agents we’ve seen an uptick in network specific tools over the last several years. To articulate this point, Chris also said “the network is becoming the only constant source of intelligence we can rely on and the only control point we can depend on”. Unfortunately, this is where I will have to disagree with Chris and Cisco’s approach to using only network centric tools. What he failed to acknowledge is another form of tap available and in use today. This technology, like agent based solutions can intercept many different forms of data streams such as CPU, memory, network, or storage. However this solution does NOT have the problem agent based tools have and instead leverages the transparent inspection nature of a network based tap. Sounds like the best of both worlds right?

So what is this tapping tool that Chris neglected to acknowledge? Why of course it’s a Hypervisor! Yes, that’s right, it’s the core competency of virtualization and what I’m describing is an added benefit that has been overlooked by others for many years, but which we at VMware have invested heavily in for nearly half a decade now. All data processing in all forms that ever happens inside a VM is all passed through the hypervisor and all of that data is available to be inspected for any conceivable reason. And we’ve already been creating access methods for the security industry to use for the last 4 years. These tools could be API’s like VMSafe or EPSEC for partners to use, or even our own vShield suite of technology.

Even Cisco is using some of these technologies, like vNetwork and DVFilter, to do their own inspection and enforcement like Chris is advocating. In fact their own implementation while gaining access to these data streams in the hypervisor, they insist on moving the inspection back into their network centric tools via the Nexus 1000v and their Virtual Security Gateway (VSG).

The problem with that approach is that the depth of these protection tools is typically not comprehensive across all of the different threat vectors. What we need to do as an industry is work on ways to better integrate and adopt these tools more rapidly. The unfortunate truth is that each of the security vendors has a core competency and they let that small set of protection tools dictate the direction of their portfolio and development efforts. Whereas our adversaries recognize none of these limits, play with no rules, and exploit our unwillingness to properly implement our defense in depth and breadth strategies. As a call to action we should learn to embrace each of our various tool sets, make it easier for our customers to use our tools in conjunction with one another, and even someday to create an open management framework for shared policy constructs.

We don’t need to focus on the network and the minimal set of inspection points that has to offer in the traditional security model. Instead we should focus on the hypervisor and the near infinite and simultaneous inspection points now available. Only this level or cooperation will allow us to take off our stack specific blinders and instead Visualize the true threat landscape and apply the proper Context to implementing our Control boundaries in this new evolution of IT, we call it Cloud.

 –

Rob

Rob Babb is a Senior Systems Engineer on the Security and Compliance Specialist team at VMware. 

RSA Conference San Francisco 2K12 – Back to the Golden Age

Greetings securanerds and compliance aficionados! 

The RSA Conference has made a HUGE come back this year in Tim Tebow\ Jeremy Lin-Sanity "like" fashion and secured it's rightful place as the largest & best security conference on the planet.
Art Coviello got things started with some HEAT as he preached the "Hack Back" message. The Buzz at RSA was intense and fresh as new privacy initiatives and cloud computing are driving life back into the security space along with compliance. The sessions and expo floor were simply PACKED! It was great to see the usual security Titans displaying their knowledge & goods along with up and comers like HyTrust who had their brand on the back of every badge.
 
For VMware Center for Policy & Compliance (CP&C) , it was immediate action from day uno as we were busier than a one-toothed man in a corn-on-the-cob eating contest! (No offense to my single fanged friends, it is just the truth 🙂
We started off with announcing our upcoming release of vCenter Configuration Manager (vCM) 5.5 part of the vCenter Operations Manager Suite (vCOPS), the best vSphere, Cloud Infrastructure Suite & Config\ Compliance Management Tool in the industry. You will hear more about vCM 5.5 when it goes GA on March 15th but I must give you a sneak peak, 5.5 may be sweeter than Crispy Bacon!
vCM 5.5 Example report showcasing  vCenter and vCD Permissions: 
    Providing a single view of permission levels across vCenters and vCDs that can be filtered by User, Group, Object, etc. 
    NOBODY else in the systems management space today can do this except for vCOPS & vCM!

Check it:
VCM 5.5 Effective Permissions Report

 

Next was an interview at the RSA booth on EMC Live TV going over our combined integration with VMware, EMC & RSA into Archer (eGRC) solution to deliver "Compliance Across the Stack" bringing together technical controls with policy enforcement. The demo showcases Server, Network and Storage Compliance results in Archer! This is a LARGE step in our Trusted Cloud initiative "Meeting Customers Compliance Requirements to Migrate Tier 1 Apps to vSphere and Cloud Environments".
Here is the Video:   

http://www.youtube.com/watch?v=fM6ndYZt_2o&list=UUWAJOJJM6yeRNWyyV5_swVw&index=9&feature=plpp_video

And our blog on the announcement with screen shots from the integrated Archer   Demo:

 http://blogs.vmware.com/alliances/2012/02/vmware_emc_rsa.html

We kept the vibe alive as our honorary CP&C member Davi Ottenheimer "The Flying Penguin http://www.flyingpenguin.com/"  threw some deep knowledge at folks during his Sessions:
    CLD-108 Lightning Round: Data Confidentiality and Integrity in the Cloud
    DAS-302: Message in a Bottle – Finding Hope in a Sea of Security Breach Data

I hope you got a chance to see him in action, if not you can catch Davi live in Vegas singing Sinatra at the Venetian Showroom. (Seriously http://davisingssinatra.com/)
Finally we started wrapping things up with the VMware communities podcast #177 covering the conference with my RSA pal Mike Foley:
Switching gears a bit, we also saw blatant displays where policy & technology could not prevent human action from putting the environment at risk. There were several people who made their way into sessions by telling the door staff "We are with the Speaker". In all cases, the hoodlums were welcomed without any identified credentials, verification from the speaker or proof of having a delegate badge. It just goes to show you that visibility, training and accountability are key ingredients to a securing an infrastructure in a compliant fashion. (Next year just buy a full conference badge people!)
Last but not least and to get your weekend started with a laugh, check out the following HILARIOUS video on VMware security and compliance solutions for the Cloud:
Feel free to hit us up with questions & comments at:
Have a great weekend, snow is falling all over the west so hit the slopes if you can!
Please excuse any typos or grammar mistakes, after all I am ESL and will lean on that as long as possible. 
Peace Out!
George Gerchow – VMware Director, Center for Policy & Compliance

 

“Let’s get out of the weeds”

As part of VMware’s Security & Compliance Specialist team, we’re brought in to speak about a very wide range of concepts that extend from CPU architecture all the way up to the traditional tools like Firewalls, IPS’, Anti-Virus, and many others. Usually there’s some type of compliance question or concern driving the need to have a security conversation. And what most people don’t explicitly realize is that a discussion about security, whether physical or computer, always distills to the lowest common denominator being ‘trust’.

The concept of trust is an interesting notion. Trust is usually a faith or belief based emotion, and the hope that we hold for one another is that in matters of science and technology that trust is based upon some empirical evidence and well-informed reasoning. So obviously education is often our best methodology to assist customers with building that trust around our products.

Often the questions I receive are not about things like virtualized security products, like vShield, or the various API’s that have been developed. Instead the focus is most often on the vSphere platform itself. The reasoning behind this is mainly a lack of accurate information of sufficient detail available in the market. For several years VMware did a great job of building a secure architecture of vSphere but did not focus on advertising much of those design decisions, not because it wasn’t important but because it was not a topic our customers were expressing a need to have with us. Obviously as customers move through their own unique virtualization journey and move into Phase 2, Business Production, they are tackling security and compliance concerns around the more mission critical applications and data that are beginning to be virtualized. Having these conversations are also a pre-cursor  of things that need to be resolved prior to a company investing in a private, public, or hybrid “cloud” solution as it all relates back to how well a company can trust the technological controls that have been put in place.

Since I am so often asked questions about vSphere, that tell me the asker does not trust vSphere, or any hypervisor platform, I am frequently having a discussion on what I call “building a pyramid of trust”. Like any structure, the foundation is the most important part because without a well-formed base, in this case with regards to knowledge, it is highly unlikely the other pieces layered on top will be stable enough to continue adding more layers. In my pyramid, my base consists of the core constructs of virtualization. These are the Core Isolation Principles that describe exactly how the hypervisor is designed to separate out itself from the virtual machines and also what keeps each VM separate from one another.  Should these principles be violated, so would the isolation described by the very definition of virtualization.

To help explain the core principles I break apart the functions of the hypervisor into 4 key areas, CPU, Memory, Storage, and Networking. Each of these describe the physical functions that are abstracted into the VM’s themselves. The ways in which this abstraction occurs are very key concepts to fully grasping and understanding how we’ve developed our platform from the ground up with security in mind. It shows through in how we isolate specific CPU instructions, how our memory is layered, abstracted, and allocated, through the storage platform, and most importantly the protections guarding against remote exploit and arbitrary code execution. All of these things build defense in depth techniques that layer security in a virtualized environment.

Many security practitioners have built their careers focusing on more up leveled concepts of security, and their primary attention was never much directed to the physical hardware interfaces themselves. Much in the same way that server admins were not familiar with centralized storage and networking when we taught them how to virtualize over the last 10+ years. We are helping the security admins also break down their traditional barriers of understanding and now helping them to understand all of these other disciplines in the context of their day-to-day activities.

The interesting part is the resistance we face in educating security teams about all of these technologies and helping to build their trust in the technology. The experience thus far has shown that the typical US corporation is full of cliché terminology, which we’ve already known for years. Dilbert, The Office, SNL, all have made us laugh for hours at what we have become. Even with all this exposure to the ludicrousness of business clichés, I was taken aback a few weeks ago when an attendee at a meeting said we needed to “get out of the weeds”. It was obvious with that one statement that this person was not able to see the foundation of the pyramid being built. They were not willing to connect the dots and see how knowing the information being presented was able to answer all of their questions. Instead, they were using their pre-conceived notions that were founded on mis-information and FUD in the market to limit their ability to absorb the material in an educational context.

I don’t blame this person for their comment. In the day and age we live, time is precious and things happen so quickly it’s hard to keep up with changes in business without sacrificing too much personal time. We’re constantly being asked to make value judgments on which information is worthwhile to absorb vs deciding when it’s time to move on. For some of us, our thread of patience is stretched to the breaking point already.

After a few days had passed, the meeting organizer came back to me and said how grateful they were to have the conversation. They said the discussions that were sparked both during our meeting and in the days following has caused some very positive decisions to be made, mostly because of the comment made by that one individual to “get out of the weeds”. That was a key indicator for many other attendees that their co-worker was resistant to change and to use another cliché “unable to see the forest for the trees”.

This is not an all-too unique situation for us. In fact, it’s become more of a norm for our team to have initial education meetings followed a week or two later by another meeting to review the information again. The reason is that we’ve got to come back and reinforce and inspect that foundation of the pyramid so our audience fully builds their trust of our solution. We’re having great success in this education endeavor and we look forward to meeting with you and your teams in the future.

 –

Rob

 

 

Rob Babb is a Senior Systems Engineer on the Security and Compliance Specialist team at VMware. 

CP&C Releases vCM PCI 2.0 Content, Combine this with vShield & WOW!

The VMware Center for Policy and Compliance is pleased to announce our latest content update for PCI 2.0 in vCenter Configuration Manager ™ (VCM).

PCI 2.0 is right around the corner 2k12 and many of you should be preparing for these audits yesterday!

Are any of you starting to prep for PCI 2.0? Please share your concerns, we want to help! Get CP&C in touch with your QSA.

Here is a sample of what has changed, for more information check out the PCI DSS v2 Summary of Changes doc.

Scope of Assessment for Compliance with PCI DSS Requirements

  • Added “virtualization components” to the definition of “system components.”  

Network Segmentation

  • Added clarifications including that segmentation may be achieved through physical or logical means 

What’s new in this package? Platform support for:

  • Windows 7,
  • Windows Vista
  • Windows XP
  • Windows 2003,
  • Windows 2008
  • vSphere/ESX
  • UNIX & LINUX 

How does this help you address your compliance needs?

This is at the core of what VMware offers as part of our Trusted Cloud Solution. At VMworld, we announced our PCI self healing Virtual environment around CDE and auto segmentation of VM’s based upon data, defining relationships to those VM’s and continually applying policy & remediation to the entire environment. The Combination of vCM, vShield & VIN make for a Compliance Solution that is unmatched in the market and works for other use cases like HIPAA. (See Diagram Below)

Self.Healing 
 

How do you get it the new content?
Customers wishing to harden their PCI 2.0 environment can download the new content via the VCM Content Wizard

Be on the lookout for a free PCI 2.0 checker to be released by CP&C later this year!

Also, feel free to hit us up at:

Adios,
George Gerchow VMware Director, Center for Policy & Compliance

VMware’s CP&C releases another free Compliance Checker!

Buenos Dias,

I'm George Gerchow, Director of VMware's Center for Policy & Compliance. I'll be here all week to talk about Compliance in the Cloud and answer your questions. 

Today we are going to give you access to a FREE downloadable tool that helps you get started on the “Trusted Cloud” ride. 

It is the vSphere 4.1 Compliance Checker fresh off the virtual assembly line and compiled by the good folks at CP&C!

 Here is how it works: 

  • The Compliance Checker runs an assessment on ESX/ESXi hosts managed by vCenter
  • The assessment is based on a predefined subset of 29 of the vSphere 4.1 Security Hardening Guide rules and is run against the first 5 ESX/ESXi hosts found on the target vCenter
  • The results for each host include the rules, the rule descriptions, and the success or failure of each rule

At VMware, we like to call the Compliance Checkers “Crack” for IT as it get’s ya hooked and you will come back for more! 

Here is the link so you can get started hardening your vSphere Environment today: 

http://www.vmware.com/products/datacenter-virtualization/vsphere-compliance-checker/overview.html  

Now this poses a few questions and we would love to get your feedback: 

  1. Are free tools like this helpful?
  2. How do you currently lock down your vSphere environment?
  3. Would remediation of the non-compliance results be a good next step?
  4. Do you care about regulatory compliance & vendor best practices? If so, which ones? (PCI, HIPAA, DISA, CIS…) 

I will be rollin’ into Denver today like Tom Brady rolled over the Miami Secondary last night but will be online waiting to hear from you. (FYI, IN Denver, I am giving a Keynote at a Healthcare seminar on Trusted Cloud)

Jump in the discussion on any of our social media channels – blogs, Twitter, Facebook, or community forum: 

Here is a sneek peek of what the Checker looks like:

Checker.09.11 

Thanks and have a great day from all of us at CP&C and VMware!