8.2.7 Ensure unauthorized connection of devices is disabled

Information

In a virtual machine, users and processes without root or administrator privileges can
connect devices, such as network adapters and CD-ROM drives. This should be prevented.

*Rationale*

Disabling unauthorized connection of devices helps prevents unauthorized changes within
the guest operating system, which could be used to gain unauthorized access, cause denial
of service conditions, and otherwise negatively affect the security of the guest operating system.

Solution

To implement the recommended configuration state, run the following PowerCLI
command-
# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'isolation.device.connectable.disable' -value $true

See Also

https://workbench.cisecurity.org/files/2168

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv7|9.2

Plugin: VMware

Control ID: 1adbbff8d730ad822341e4ecd6440e78231cf94d0fe6ac51831916933374d342