8.2.7 Prevent unauthorized connection of devices.

Information

Prevent unauthorized connection of devices.

*Rationale*

In a virtual machine, users and processes without root or administrator privileges can
connect or disconnect devices, such as network adaptors and CD-ROM drives, and can
modify device settings. Use the virtual machine settings editor or configuration editor to
remove unneeded or unused hardware devices. If you want to use the device again, you can
prevent a user or running process in the virtual machine from connecting, disconnecting, or
modifying a device from within the guest operating system. By default, a rogue user with
non-administrator privileges in a virtual machine can -

Connect a disconnected CD-ROM drive and access sensitive information on the
media left in the drive

Disconnect a network adaptor to isolate the virtual machine from its network, which
is a denial of service

Modify settings on a device

Solution

To implement the recommended configuration state, run the following PowerCLI
command-# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'isolation.device.connectable.disable' -value $true

Impact-Device interaction is blocked inside the guest OS using VMware tools

Default Value-The prescribed state is not the default state.

See Also

https://workbench.cisecurity.org/files/145

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6(10)

Plugin: VMware

Control ID: abf5b666414978809618ebd2b8f35d770623e9290fe05f55452d5a998f5778ca