What changed in VMware vRealize Automation 7.x vAMI STIG V1R2V1R2 changes

VMware vRealize Automation 7.x vAMI STIG V1R2 (2023-10-25) replaced V1R1 (2018-09-28): 44 checks added, 44 removed. It has 44 checks, against 44 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 44 added
  • 44 removed
  • 0 updated

Added in V1R2 (44)

  • V-240926CAT IThe vAMI must use FIPS 140-2 approved ciphers when transmitting management data during remote access management sessions.
  • V-240927CAT IThe vAMI must restrict inbound connections from nonsecure zones.
  • V-240928CAT IIThe vAMI configuration file must be owned by root.
  • V-240929CAT IIThe vAMI must have sfcb logging enabled.
  • V-240930CAT IIThe vAMI must protect log information from unauthorized read access.
  • V-240931CAT IIThe vAMI must protect log information from unauthorized modification.
  • V-240932CAT IIThe vAMI must protect log information from unauthorized deletion.
  • V-240933CAT IIThe vAMI log records must be backed up at least every seven days onto a different system or system component than the system or component being logged.
  • V-240934CAT IIPatches, service packs, and upgrades to the vAMI must be verifiably signed using a digital certificate that is recognized and approved by the organization.
  • V-240935CAT IIThe vAMI executable files and library must not be world-writeable.
  • V-240936CAT IIThe vAMI installation procedures must be capable of being rolled back to a last known good configuration.
  • V-240937CAT IThe vAMI must not contain any unnecessary functions and only provide essential capabilities.
  • V-240938CAT IIThe vAMI must use the sfcb HTTPS port for communication with Lighttpd.
  • V-240939CAT IIThe vAMI must use a site-defined, user management system to uniquely identify and authenticate users (or processes acting on behalf of organizational users).
  • V-240940CAT IThe vAMI must transmit only encrypted representations of passwords.
  • V-240941CAT IThe vAMI private key must only be accessible to authenticated system administrators or the designated PKI Sponsor.
  • V-240942CAT IThe vAMI must use approved versions of TLS.
  • V-240943CAT IIThe vAMI must use sfcBasicPAMAuthentication for authentication of the remote administrator.
  • V-240944CAT IIThe vAMI must use _sfcBasicAuthenticate for initial authentication of the remote administrator.
  • V-240945CAT IIThe vAMI must have the correct authentication set for HTTPS connections.
  • V-240946CAT IIThe vAMI installation procedures must be part of a complete vRealize Automation deployment.
  • V-240947CAT IIThe vAMI must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.
  • V-240948CAT IIThe vAMI error logs must be reviewed.
  • V-240949CAT IIThe vAMI account credentials must protected by site policies.
  • V-240950CAT IIThe vAMI must utilize syslog.
  • V-240951CAT IIThe vAMI configuration file must be protected from unauthorized access.
  • V-240952CAT IIThe vAMI must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
  • V-240953CAT IIThe vAMI must have the keepaliveTimeout enabled.
  • V-240954CAT IIThe vAMI must have the keepaliveMaxRequest enabled.
  • V-240955CAT IIThe vAMI must use approved versions of TLS.
  • V-240956CAT IIThe vAMI sfcb must have HTTPS enabled.
  • V-240957CAT IIThe vAMI sfcb must have HTTP disabled.
  • V-240958CAT IIThe vAMI must have security-relevant software updates installed within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).
  • V-240959CAT IIThe vAMI must log all successful login events.
  • V-240960CAT IIThe vAMI must enable logging.
  • V-240961CAT IIThe vAMI must have PAM logging enabled.
  • V-240962CAT IIThe vAMI must log all login events.
  • V-240963CAT IIThe vAMI sfcb server certificate must only be accessible to authenticated system administrators or the designated PKI Sponsor.
  • V-240964CAT IIIf the vAMI uses PKI Class 3 or Class 4 certificates, the certificates must be DoD- or CNSS-approved. If the vAMI does not use PKI Class 3 or Class 4 certificates, this requirement is Not Applicable.
  • V-240965CAT IIThe vAMI must utilize syslog.
  • V-240966CAT IIThe vAMI must be configured to listen on a specific IPv4 address.
  • V-240967CAT IIThe vAMI must be configured to listen on a specific network interface.
  • V-240968CAT IIThe application server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.
  • V-258455CAT IThe version of vRealize Automation 7.x vAMI running on the system must be a supported version.

Removed since V1R1 (44)

  • V-90195CAT IThe vAMI must use FIPS 140-2 approved ciphers when transmitting management data during remote access management sessions.
  • V-90197CAT IThe vAMI must restrict inbound connections from nonsecure zones.
  • V-90199CAT IIThe vAMI configuration file must be owned by root.
  • V-90201CAT IIThe vAMI must have sfcb logging enabled.
  • V-90203CAT IIThe vAMI must protect log information from unauthorized read access.
  • V-90205CAT IIThe vAMI must protect log information from unauthorized modification.
  • V-90207CAT IIThe vAMI must protect log information from unauthorized deletion.
  • V-90209CAT IIThe vAMI log records must be backed up at least every seven days onto a different system or system component than the system or component being logged.
  • V-90211CAT IIPatches, service packs, and upgrades to the vAMI must be verifiably signed using a digital certificate that is recognized and approved by the organization.
  • V-90213CAT IIThe vAMI executable files and library must not be world-writeable.
  • V-90215CAT IIThe vAMI installation procedures must be capable of being rolled back to a last known good configuration.
  • V-90217CAT IThe vAMI must not contain any unnecessary functions and only provide essential capabilities.
  • V-90219CAT IIThe vAMI must use the sfcb HTTPS port for communication with Lighttpd.
  • V-90221CAT IIThe vAMI must use a site-defined, user management system to uniquely identify and authenticate users (or processes acting on behalf of organizational users).
  • V-90223CAT IThe vAMI must transmit only encrypted representations of passwords.
  • V-90225CAT IThe vAMI private key must only be accessible to authenticated system administrators or the designated PKI Sponsor.
  • V-90227CAT IThe vAMI must use approved versions of TLS.
  • V-90229CAT IIThe vAMI must use sfcBasicPAMAuthentication for authentication of the remote administrator.
  • V-90231CAT IIThe vAMI must use _sfcBasicAuthenticate for initial authentication of the remote administrator.
  • V-90233CAT IIThe vAMI must have the correct authentication set for HTTPS connections.
  • V-90235CAT IIThe vAMI installation procedures must be part of a complete vRealize Automation deployment.
  • V-90237CAT IIThe vAMI must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.
  • V-90239CAT IIThe vAMI error logs must be reviewed.
  • V-90241CAT IIThe vAMI account credentials must protected by site policies.
  • V-90243CAT IIThe vAMI sfcb config file must be group-owned by root.
  • V-90245CAT IIThe vAMI must utilize syslog.
  • V-90247CAT IIThe vAMI configuration file must be protected from unauthorized access.
  • V-90249CAT IIThe vAMI must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
  • V-90251CAT IIThe vAMI must have the keepaliveTimeout enabled.
  • V-90253CAT IIThe vAMI must have the keepaliveMaxRequest enabled.
  • V-90255CAT IIThe vAMI must use approved versions of TLS.
  • V-90257CAT IIThe vAMI sfcb must have HTTPS enabled.
  • V-90259CAT IIThe vAMI sfcb must have HTTP disabled.
  • V-90261CAT IIThe vAMI must have security-relevant software updates installed within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).
  • V-90263CAT IIThe vAMI must log all successful login events.
  • V-90265CAT IIThe vAMI must enable logging.
  • V-90267CAT IIThe vAMI must have PAM logging enabled.
  • V-90269CAT IIThe vAMI must log all login events.
  • V-90271CAT IIThe vAMI sfcb server certificate must only be accessible to authenticated system administrators or the designated PKI Sponsor.
  • V-90273CAT IIIf the vAMI uses PKI Class 3 or Class 4 certificates, the certificates must be DoD- or CNSS-approved. If the vAMI does not use PKI Class 3 or Class 4 certificates, this requirement is Not Applicable.
  • V-90275CAT IIThe vAMI must utilize syslog.
  • V-90277CAT IIThe vAMI must be configured to listen on a specific IPv4 address.
  • V-90279CAT IIThe vAMI must be configured to listen on a specific network interface.
  • V-90281CAT IIThe application server must remove all export ciphers to protect the confidentiality and integrity of transmitted information.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.