STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jan 2024:

The vCenter Server must display the Standard Mandatory DOD Notice and Consent Banner before login.

DISA Rule

SV-256320r885571_rule

Vulnerability Number

V-256320

Group Title

SRG-APP-000068

Rule Version

VCSA-70-000024

Severity

CAT II

CCI(s)

• CCI-000048 - Display an organization-defined system use notification message or banner to users before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidelines.
• CCI-000050 - Retain the notification message or banner on the screen until users acknowledge the usage conditions and take explicit actions to log on to or further access the system.
• CCI-001384 - For publicly accessible systems, display system use information with organization-defined conditions before granting further access to the publicly accessible system.

Weight

10

Fix Recommendation

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Login Message.

Click "Edit".

Click the "Show login message" slider to enable.

Configure the "Login message" to "DOD User Agreement".

Click the "Consent checkbox" slider to enable.

Set the "Details of login message" to the Standard Mandatory DOD Notice and Consent Banner text.

Click "Save".

Check Contents

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Login Message.

If the selection box next to "Show login message" is disabled, "Details of login message" is not configured to the standard DOD User Agreement, or the "Consent checkbox" is disabled, this is a finding.

Note: Refer to vulnerability discussion for user agreement language.

Vulnerability Number

V-256320

Documentable

False

Rule Version

VCSA-70-000024

Severity Override Guidance

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Login Message.

If the selection box next to "Show login message" is disabled, "Details of login message" is not configured to the standard DOD User Agreement, or the "Consent checkbox" is disabled, this is a finding.

Note: Refer to vulnerability discussion for user agreement language.

Check Content Reference

M

Target Key

5517