Best Practices – VMware vSphere Security Hardening & Health

Quick basics: What are VMware vSphere and ESXi?

What is VMware vSphere?

VMware vSphere, also known as VMware Infrastructure, is the product name for VMware's suite of server virtualization products that includes its ESXi hypervisor and vCenter management software. vSphere undergoes periodic revisions and updates to add features, fixes and modifications to the application program interface (API) and changes to the ESXi.

What is VMware ESXi?

VMware ESXi (formerly ESX) is a hypervisor developed by VMware for deploying and serving virtual computers. As a hypervisor, ESXi is not a software application that is installed on an operating system (OS). Instead, it is installed on bare-metal and it creates anew layer between classical operating systems and applications and underlying hardware of the physical server. ESXi is more efficient than hosted architectures and can effectively partition hardware to increase consolidation.It helps to run multiple operating systems and applications on the same underlying hardware simultaneously and control access to the hardware resources.

An evolving complexity of VMware vSphere best practices

VMware vSphere is often implemented with default configurations and standard features. And, once deployed, many vSphere implementations are not regularly evaluated to determine potential weaknesses or improvements that can be made in terms of performance or security.

‍

In most cases the vSphere admins also wear other hats to keep mission-critical data center operations running. The thought of reviewing vSphere best practices for security and performance, across a medium to large cluster infrastructure, is the last thing on their mind. Overtime, that vSphere infrastructure has changed and, without full-time care, its performance and security are probably already lacking. The types of VMware best practices to implement in vCenter, ESXi or virtual machines are those that should be implemented in any traditional datacenter infrastructure:

●     Performance for compute, storage (iscsi)and networking VMware best practices

●     Management & monitoring

●     Availability

●     Security

●     Performance

●     Data protection

‍

VMware best practices come from IT professionals who have learned through trial and error – from people who already made a mistake and reported to VMware or shared with VMUG community –so that others do not have to fall into the same problems again.

‍

Best practices and hardening standards for VMware vSphere, vCenter and ESXi security auditing

Minimizing risk and defending the VMware environment against security incidents has to be a priority of every IT admin. Auditing data centers for security can be approached many ways, starting with 3rd-party consultants coming to the IT floor and ending by manual and complicated implementation of certifications or best-practice audit checklists.

VMware Security Hardening Guides were created by VMware experts and provide prescriptive guidance for customers on how to deploy and operate VMware products in a secure manner. As such it creates an ideal checklist for a security audit in a virtualized data center.

Guides for vSphere are normally provided in spreadsheet format, with rich metadata to allow for guideline classification and risk assessment. They also include script examples for enabling security automation. Implementing VMware security best practices is very time consuming and requires continuous validation of the implementation as the environment configuration changes. This situation repeats for other security guides likePCI DSS, DISA-STIG, HIPAA, BSI, NIST, or CIS. Thankfully, there is a tool which can automate data center security audits and tell admins what to do to improve the security standards.

VMware security audit checklists and tools

How to do vSphere security auditing is a question every IT admin has to answer sooner or later. Auditing data centers for security can be approached in many ways, starting with 3rd party consultants squatting in server rooms, ending by manual and complicated implementation of certification or best-practice auditing checklist.

Runecast to the Rescue

VMware best practices analyzer for ESXi, data centers and clusters

How to learn vSphere best practices? It can be via trial and error on production infrastructure (if you want to risk losing your job :-) or it could mean reading hundreds of pages of complex best practices documentation from VMware or taking expensive 3rd-party vendor courses. Thankfully, there is another option that is the best, easiest, and least time consuming method: Use Runecast Analyzer which scans, detects and suggests missing best practices in data centers and provides a clear list of patching steps.

Proactive monitoring of VMware vSphere and ESXi

Runecast Analyzer scans your VMware vSphere, vCenter and ESXi systems and provides health monitoring analysis information in a clear dashboard and even lets you create reports based on what it finds. The analyzer sorts issues into three categories based on type and lists the number of affected objects for each issue. This combination helps you prioritize each detected issue and react accordingly.

Runecast Analyzer uses VMware KBs, security advisory, and best practices to power its health check metrics. Its scan engine uses that knowledge to detect problems before they become visible(even to you), making it easier to troubleshoot them all at once rather than reacting to them as they randomly occur.

VMware vCenter security and best practices ‘health-check’ monitoring automation platform

Runecast analyzes the health of VMware vSphere systems and creates a report with recommended actions based on best practices. Use the Runecast Analyzer web health analysis dashboard to review active alerts from your vCenter servers and ESXi hypervisors.

Runecast Analyzer draws upon an extensive database of VMware Security Hardening checks, plus standards such as DISA-STIG,PCI DSS, HIPAA, BSI, NIST, or CIS, as well as best practices which help to implement GPDR. It audits thousands of combinations in a data center environment. The result is a list of issues that need to be implemented andalso those which are already successfully applied. The entire scan doesn’t take more than a minute or two and can be scheduled periodically to report on best practice and run data center security audits, which helps to catch any misconfigurations.

Integration with existing vSphere health analyzer software

The Runecast health check platform offers arich REST API and vCenter plugin, making it simple to share its assess menthealth with all major status and performance monitoring tools. And Runecast Analyzer is always updated with latest best practices according to vSphere(vCenter or ESXi) version, which removes the problem with obsoletebest-practices.

If your organization is looking for secureon-premises, predictive, real-time issue analysis and security compliance checks for vSphere, vSAN, NSX, Horizon and AWS environments, try Runecast for free today.

Your Runecast Team