STIGQter: STIG Summary: VMware NSX 4.x Manager NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 30 Jan 2025:

The NSX Manager must assign users/accounts to organization-defined roles configured with approved authorizations.

DISA Rule

SV-265292r994099_rule

Vulnerability Number

V-265292

Group Title

SRG-APP-000033-NDM-000212

Rule Version

NMGR-4X-000010

Severity

CAT I

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.
• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.
• CCI-001499 - Limit privileges to change software resident within software libraries.
• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
• CCI-002169 - Enforce a role-based access control policy over defined subjects and objects based upon organization-defined roles and users authorized to assume such roles.
• CCI-002235 - Prevent non-privileged users from executing privileged functions.
• CCI-001813 - Enforce access restrictions using organization-defined mechanisms.
• CCI-002883 - Restrict the use of maintenance tools to authorized personnel only.
• CCI-000345 - Enforce logical access restrictions associated with changes to the system.

Weight

10

Fix Recommendation

To create a new role with reduced permissions, do the following:

From the NSX Manager web interface, go to System >> Settings >> User Management >> Roles.

Click "Add Role", provide a name and the required permissions, and then click "Save".

To update user or group permissions to an existing role with reduced permissions, do the following:

From the NSX Manager web interface, go to System >> User Management >> User Role Assignment.

Click the menu dropdown next to the target user or group and select "Edit".

Remove the existing role, select the new one, and then click "Save".

Check Contents

From the NSX Manager web interface, go to System >> Settings >> User Management >> User Role Assignment.

View each user and group and verify the role assigned has authorization limits as appropriate to the role and in accordance with the site's documentation.

If any user/group or service account are assigned to roles with privileges that are beyond those required and authorized by the organization, this is a finding.

Vulnerability Number

V-265292

Documentable

False

Rule Version

NMGR-4X-000010

Severity Override Guidance

From the NSX Manager web interface, go to System >> Settings >> User Management >> User Role Assignment.

View each user and group and verify the role assigned has authorization limits as appropriate to the role and in accordance with the site's documentation.

If any user/group or service account are assigned to roles with privileges that are beyond those required and authorized by the organization, this is a finding.

Check Content Reference

M

Target Key

5633