What changed in Virtual Machine Manager Security Requirements Guide V2R5V2R5 changes

Discussion

If temporary user accounts remain active when no longer needed or for an excessive period, these accounts may be used to gain unauthorized access. To mitigate this risk, automated termination of all temporary accounts must be set upon account creation. Temporary accounts are established as part of normal account activation procedures when there is a need for short-term accounts without the demand for immediacy in account activation. If temporary accounts are used, the VMM must be configured to automatically terminate these types of accounts after a DoDDoW-defined time period of 72 hours. To address access requirements, many VMMs may be integrated with enterprise level authentication/access mechanisms that meet or exceed access control policy requirements.

V-207339 in V2R5

Title

The VMM must display the Standard Mandatory DoDW Notice and Consent Banner before granting access to the system.

Check text

Verify the VMM displays the Standard Mandatory DoDDoW Notice and Consent Banner before granting access to the system. If it does not, this is a finding. The banner must be formatted in accordance with applicable DoDDoW policy. Use the following verbiage for a VMM that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) VMM (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for VMMs that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

Fix text

Configure the VMM to display the Standard Mandatory DoDDoW Notice and Consent Banner before granting access to the system. The banner must be formatted in accordance with applicable DoDDoW policy. Use the following verbiage for a VMM that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) VMM (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for VMMs that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

Discussion

Display of a standardized and approved use notification before granting access to the VMM ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via logon interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with applicable DoDDoW policy. Use the following verbiage for a VMM that can accommodate banners of 1300 characters: "You are accessing a U.S. Government (USG) VMM (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details." Use the following verbiage for VMMs that have severe limitations on the number of characters that can be displayed in the banner: "I've read & consent to terms in IS user agreem't."

V-207343 in V2R5

Title

The VMM must retain the Standard Mandatory DoDDoW Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.

Check text

Verify the VMM retains the Standard Mandatory DoDDoW Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access. If it does not, this is a finding.

Fix text

Configure the VMM to retain the Standard Mandatory DoDDoW Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.

Discussion

The banner must be acknowledged by the user prior to allowing the user access to the VMM. This provides assurance that the user has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the user, DoDDoW will not be in compliance with system use notifications required by law. To establish acceptance of the application usage policy, a click-through banner at system logon is required. The system must prevent further activity until the user executes a positive action to manifest agreement by clicking on a box indicating "OK".

V-207344 in V2R5

Discussion

Remote access services, such as those providing remote access to network devices and VMMs, which lack automated capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DoDDoW VMMs by an authorized user (or another VMM) communicating through an external, nonnonorganization-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Automated monitoring of remote access sessions allows organizations to detect cyber attacks and also ensure ongoing compliance with remote access policies by auditing connection activities of remote access capabilities, such as Remote Desktop Protocol (RDP), on a variety of VMM components.

V-207350 in V2R5

Title

The VMM must use DoDW-approved encryption to protect the confidentiality of remote access sessions.

Check text

Verify the VMM uses DoDW-approved encryption to protect the confidentiality of remote access sessions. If it does not, this is a finding.

Fix text

Configure the VMM to use DoDW-approved encryption to protect the confidentiality of remote access sessions.

Discussion

Without confidentiality protection mechanisms, unauthorized individuals may gain access to sensitive information via a remote access session. Remote access is access to DoDDoW non-publicnonpublic VMMs by an authorized user (or another VMM) communicating through an external, nonnonorganization-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Encryption provides a means to secure the remote connection to prevent unauthorized access to the data traversing the remote access connection (e.g., RDP), thereby providing a degree of confidentiality. The encryption strength of mechanism is selected based on the security categorization of the information.

V-207351 in V2R5

Title

The VMM must provide audit record generation capability for DoDW-defined auditable events for all VMM components.

Check text

Verify the VMM provides audit record generation capability for DoDDoW-defined auditable events for all VMM components. If it does not, this is a finding. DoDDoW has defined the list of events for which the VMM will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the VMM; (iii) All account creations, modifications, disabling, and terminations; and (iv) All kernel module load, unload, and restart actions.

Fix text

Configure the VMM to provide audit record generation capability for DoDDoW-defined auditable events for all VMM components. DoDDoW has defined the list of events for which the VMM will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the VMM; (iii) All account creations, modifications, disabling, and terminations; and (iv) All kernel module load, unload, and restart actions.

Discussion

Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit records can be generated from various components within the VMM (e.g., module or policy filter). The list of audited events is the set of events for which audits are to be generated. This set of events is typically a subset of the list of all events for which the system is capable of generating audit records. DoDDoW has defined the list of events for which the VMM will provide an audit record generation capability as the following: (i) Successful and unsuccessful attempts to access, modify, or delete privileges, security objects, security levels, or categories of information (e.g., classification levels); (ii) Access actions, such as successful and unsuccessful logon attempts, privileged activities or other system level access, starting and ending time for user access to the system, concurrent logons from different workstations, successful and unsuccessful accesses to objects, all program initiations, and all direct access to the VMM; (iii) All account creations, modifications, disabling, and terminations; and (iv) All kernel module load, unload, and restart actions.

V-207366 in V2R5

Title

The VMM must enforce a 6180-day maximum password lifetime restriction.

Check text

Verify the VMM enforces a 6180-day maximum password lifetime restriction. If it does not, this is a finding.

Fix text

Configure the VMM to enforce a 6180-day maximum password lifetime restriction.

V-207379 in V2R5

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DODDoW-approved PKIs, all DODDoW systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. VMMs use access control policies and enforcement mechanisms to implement this requirement. Access control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the VMM. This requirement also applies to Zero Trust initiatives.

V-207383 in V2R5

Discussion

Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). A privileged account is defined as a VMM account with authorizations of a privileged user. Network access is defined as access to a VMM by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the Internet). The DoDDoW CAC with DoDDoW-approved PKI is an example of multifactor authentication.

V-207387 in V2R5

Title

The VMM must use multifactor authentication for network access to non-privileged accounts.

Check text

Verify the VMM uses multifactor authentication for network access to non-privileged accounts. If it does not, this is a finding.

Fix text

Configure the VMM to use multifactor authentication for network access to non-privileged accounts.

Discussion

To assureensure accountability and prevent unauthenticated access, non-privilegednonprivileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: (i) Something you know (e.g., password/PIN); (ii) Something you have (e.g., cryptographic identification device, token); or (iii) Something you are (e.g., biometric). A non-privilegednonprivileged account is any VMM account with authorizations of a non-privilegednonprivileged user. Network access is any access to an application by a user (or process acting on behalf of a user) where said access is obtained through a network connection. The DoDDoW CAC with DoDDoW-approved PKI is an example of multifactor authentication.

V-207388 in V2R5

Discussion

To assureensure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication is defined as using two or more factors to achieve authentication. Factors include: (i) Something you know (e.g., password/PIN); (ii) Something you have (e.g., cryptographic identification device, token); or (iii) Something you are (e.g., biometric). A privileged account is defined as a VMM account with authorizations of a privileged user. Local access is defined as access to an organizational VMM by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network. The DODDoW CAC with DODDoW-approved PKI is an example of multifactor authentication.

V-207389 in V2R5

Discussion

To assureensure accountability, prevent unauthenticated access, and prevent misuse of the system, privileged users must utilize multifactor authentication for local access. Multifactor authentication is defined as using two or more factors to achieve authentication. Factors include: (i) Something you know (e.g., password/PIN); (ii) Something you have (e.g., cryptographic identification device or token); or (iii) Something you are (e.g., biometric). A nonprivileged account is defined as a VMM account with authorizations of a regular or nonprivileged user. Local access is defined as access to an organizational VMM by a user (or process acting on behalf of a user) communicating through a direct connection without the use of a network. The DODDoW CAC with DODDoW-approved PKI is an example of multifactor authentication.

V-207390 in V2R5

Discussion

Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied upon to provide confidentiality or integrity, and DoDDoW data may be compromised. VMMs utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules. FIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DoDDoW requirements.

V-207396 in V2R5

Discussion

Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of information, produced by the actions of prior users/roles (or the actions of processes acting on behalf of prior users/roles) from being available to any current users/roles (or current processes) that obtain access to shared system resources (e.g., registers, main memory, hard disks) after those resources have been released back to the VMM. The control of information in shared resources is also commonly referred to as object reuse and residual information protection. This requirement generally applies to the design of an information technology product, but it can also apply to the configuration of particular VMM components that are, or use, such products. This can be verified by acceptance/validation processes in DODDoW or other government agencies. There may be shared resources with configurable protections (e.g., files in storage) that may be assessed on specific VMM components. This requirement also applies to Zero Trust initiatives.

V-207403 in V2R5

Discussion

Without cryptographic integrity protections, information can be altered by unauthorized users without detection. Remote access (e.g., RDP) is access to DoDDoW nonpublic VMMs by an authorized user (or another VMM) communicating through an external, nonnonorganization-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. Cryptographic mechanisms used for protecting the integrity of information include, for example, signed hash functions using asymmetric cryptography enabling distribution of the public key to verify the hash information while maintaining the confidentiality of the secret key used to generate the hash.

V-207418 in V2R5

Discussion

Remote access services, such as those providing remote access to network devices and VMMs, which lack automated control capabilities, increase risk and make remote user access management difficult at best. Remote access is access to DoDDoW nonpublic VMMs by an authorized user (or another VMM) communicating through an external, nonnonorganization-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless. VMM functionality (e.g., RDP) must be capable of taking enforcement action if the audit reveals unauthorized activity. Automated control of remote access sessions allows organizations to ensure ongoing compliance with remote access policies by enforcing connection rules of remote access applications on a variety of VMM components (e.g., servers, workstations, notebook computers, smart phones, and tablets).

V-207435 in V2R5

Discussion

If the audit reduction capability does not support after-the-fact investigations, it is difficult to establish, correlate, and investigate the events leading up to an outage or attack or identify those responses for one. This capability is also required to comply with applicable Federal laws and DoDDoW policies. Audit reduction capability must support after-the-fact investigations of security incidents either natively or through the use of third-party tools This requirement is specific to VMMs with audit reduction capabilities

V-207457 in V2R5

Discussion

If the report generation capability does not support after-the-fact investigations, it is difficult to establish, correlate, and investigate the events leading up to an outage or attack or identify those responses for one. This capability is also required to comply with applicable Federal laws and DoDDoW policies. The report generation capability must support after-the-fact investigations of security incidents either natively or through the use of third-party tools.

V-207460 in V2R5

Discussion

Changes to any software components can have significant effects on the overall security of the VMM. This requirement ensures the software has not been tampered with and that it has been provided by a trusted vendor. Accordingly, guest VMs, patches, service packs, device drivers, or VMM components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The VMM should not have to verify the software again. This requirement does not mandate DODDoW certificates for this purpose; however, the certificate used to verify the software must be from an approved certificate authority (CA).

V-207472 in V2R5

Discussion

Using an authentication device, such as a CAC or token that is separate from the VMM, ensures that even if the VMM is compromised, that compromise will not affect credentials stored on the authentication device. Multifactor solutions that require devices separate from VMMs gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DODDoW common access card. A privileged account is defined as a VMM account with authorizations of a privileged user. Remote access is access to DODDoW nonpublic VMMs by an authorized user (or a VMM) communicating through an external, nonnonorganization-organization-controlled network. Remote access methods include, for example, dial-up, broadband, and wireless.

V-207480 in V2R5

Discussion

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DoDDoW has mandated the use of the CAC to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12 and as a primary component of layered protection for national security systems.

V-207481 in V2R5

Discussion

The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DoDDoW has mandated the use of the CAC to support identity management and personal authentication for systems covered under Homeland Security Presidential Directive (HSPD) 12 and as a primary component of layered protection for national security systems.

V-207482 in V2R5

Title

The VMM must only allow the use of DoDW PKI-established certificate authorities for verification of the establishment of protected sessions.

Check text

Verify the VMM only allows the use of DoDDoW PKI-established certificate authorities for verification of the establishment of protected sessions. If it does not, this is a finding.

Fix text

Configure the VMM to only allow the use of DoDW PKI-established certificate authorities for verification of the establishment of protected sessions.

Discussion

Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DoDDoW systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not a DoDDoW-approved CA, trust of this CA has not been established. The DoDDoW will only accept PKI certificates obtained from a DoDDoW-approved internal or external certificate authority. Reliance on CAs for the establishment of secure sessions includes, for example, the use of SSL/TLS certificates. This requirement is not applicable to VMM-internal sessions between components not identified as "Key Terrain" for "Non-Person Entities" per DoDDoW policy.

V-207493 in V2R5

Title

The VMM must be configured in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

Check text

Verify the VMM is configured in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs. If it does not, this is a finding.

Fix text

Configure the VMM to be configured in accordance with the security configuration settings based on DoDDoW security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.

Discussion

Configuring the VMM to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoDDoW that reflects the most restrictive security posture consistent with operational requirements. Configuration settings are the set of parameters that can be changed in hardware, software, or firmware components of the system that affect the security posture and/or functionality of the system. Security-related parameters are those parameters impacting the security state of the system, including the parameters required to satisfy other security control requirements. Security-related parameters include, for example: registry settings; account, file, directory permission settings; and settings for functions, ports, protocols, services, and remote connections.

V-207528 in V2R5

Discussion

Without protection of communications with wireless peripherals, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read, altered, or used to compromise the VMM. This requirement applies to wireless peripheral technologies (e.g., wireless mice, keyboards, displays, etc.) used with a VMM. Wireless peripherals (e.g., Wi-Fi/Bluetooth/IR keyboards, mice, pointing devices, and Near Field Communications [NFC]) present a unique challenge by creating an open, unsecured port on a computer. Wireless peripherals must meet DoDDoW requirements for wireless data transmission and be approved for use by the AO. Even though some wireless peripherals, such as mice and pointing devices, do not ordinarily carry information that needs to be protected, modification of communications with these wireless peripherals may be used to compromise the VMM. Communication paths outside the physical protection of a controlled boundary are exposed to the possibility of interception and modification. Protecting the confidentiality and integrity of communications with wireless peripherals can be accomplished by physical means (e.g., employing physical barriers to wireless radio frequencies) or by logical means (e.g., employing cryptographic techniques). If physical means of protection are employed, then logical means (cryptography) do not have to be employed, and vice versa. If the wireless peripheral is only passing telemetry data, encryption of the data may not be required.

V-207529 in V2R5