VMCH-70-000006 - Independent, nonpersistent disks must not be used on the virtual machine (VM).

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The security issue with nonpersistent disk mode is that successful attackers, with a simple shutdown or reboot, might undo or remove any traces they were ever on the machine. To safeguard against this risk, production virtual machines should be set to use persistent disk mode; additionally, ensure activity within the VM is logged remotely on a separate server, such as a syslog server or equivalent Windows-based event collector. Without a persistent record of activity on a VM, administrators might never know whether they have been attacked or hacked.

There can be valid use cases for these types of disks, such as with an application presentation solution where read-only disks are desired, and such cases should be identified and documented.

Solution

From the vSphere Client, right-click the Virtual Machine and go to 'Edit Settings'.

Select the target hard disk and change the mode to 'persistent' or uncheck 'Independent'.

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the provided commands as shown below.

Get-VM 'VM Name' | Get-HardDisk | Set-HardDisk -Persistence IndependentPersistent

or

Get-VM 'VM Name' | Get-HardDisk | Set-HardDisk -Persistence Persistent

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-256455r886408_rule, STIG-ID|VMCH-70-000006, Vuln-ID|V-256455

Plugin: VMware

Control ID: 02313d377c594448a832b36d56b2738fa393a13eb708d7fce4ec6520e84b9d3d