The vCenter Server must require multifactor authentication.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-258910 | VCSA-80-000060 | SV-258910r934388_rule | CCI-000166 | medium |
| Description | ||||
| Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). Satisfies: SRG-APP-000080, SRG-APP-000149, SRG-APP-000150, SRG-APP-000391, SRG-APP-000402 | ||||
| STIG | Date | |||
| VMware vSphere 8.0 vCenter Security Technical Implementation Guide | 2023-10-11 | |||
Related Frameworks
2 paths across 2 frameworks
Related Frameworks
NIST 800-531 mapping
AU-10
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
CCI1 mapping
CCI-000166
1.00
- DISA · V1R1 · disa_xccdf · related
Details
Check Text (C-258910r934388_chk)
From the vSphere Web Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.
If the embedded identity provider is used, click on "Smart Card Authentication".
If the embedded identity provider is used and "Smart Card Authentication" is not enabled, this is a finding.
If a third-party identity provider is used, such as Microsoft ADFS, and it does not require multifactor authentication to log on to vCenter, this is a finding.
Fix Text (F-62559r934387_fix)
To configure smart card authentication for vCenter when using the embedded identity provider, refer to the vSphere documentation.
For vCenter Servers using a third-party identity provider, consult the product's documentation for enabling multifactor authentication.