STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jan 2024:

The vCenter Server must enable FIPS-validated cryptography.

DISA Rule

SV-256331r885604_rule

Vulnerability Number

V-256331

Group Title

SRG-APP-000172

Rule Version

VCSA-70-000077

Severity

CAT I

CCI(s)

• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.
• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-001188 - Generate a unique session identifier for each session with organization-defined randomness requirements.
• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

From the vSphere Web Client, go to Developer Center >> API Explorer.

From the "Select API" drop-down menu, select appliance.

Expand system/security/global_fips >> PUT.

In the response body under "Try it out", paste the following:

{
"enabled": true
}

Click "Execute".

Note: The vCenter server reboots after FIPS is enabled or disabled.

Check Contents

From the vSphere Web Client, go to Developer Center >> API Explorer.

From the "Select API" drop-down menu, select appliance.

Expand system/security/global_fips >> GET.

Click "Execute" and then "Copy Response"  to view the results.

Example response:

{
"enabled": true
}

If global FIPS mode is not enabled, this is a finding.

Vulnerability Number

V-256331

Documentable

False

Rule Version

VCSA-70-000077

Severity Override Guidance

From the vSphere Web Client, go to Developer Center >> API Explorer.

From the "Select API" drop-down menu, select appliance.

Expand system/security/global_fips >> GET.

Click "Execute" and then "Copy Response"  to view the results.

Example response:

{
"enabled": true
}

If global FIPS mode is not enabled, this is a finding.

Check Content Reference

M

Target Key

5517