6.0.3

Security Best Practices and Resources
If you follow best practices, your ESXi and vCenter Server can be as secure as or even more secure than an
environment that does not include virtualization.
This manual includes best practices for the dierent components of your vSphere infrastructure.
Table 1‑1. Security Best Practices
vSphere component Resource
ESXi host “ESXi Security Best Practices,” on page 198
vCenter Server system “vCenter Server Security Best Practices,” on page 209
Virtual machine “Virtual Machine Security Best Practices,” on page 218
vSphere Networking “vSphere Networking Security Best Practices,” on page 243
This manual is only one of the sources you need to ensure a secure environment.
VMware security resources, including security alerts and downloads, are available on the Web.
Table 1‑2. VMware Security Resources on the Web
Topic Resource
VMware security policy, up-to-date security
alerts, security downloads, and focus
discussions of security topics.
hp://www.vmware.com/go/security
Corporate security response policy hp://www.vmware.com/support/policies/security_response.html
VMware is commied to helping you maintain a secure environment.
Security issues are corrected in a timely manner. The VMware Security
Response Policy states our commitment to resolve possible
vulnerabilities in our products.
Third-party software support policy hp://www.vmware.com/support/policies/
VMware supports a variety of storage systems, software agents such as
backup agents, system management agents, and so forth. You can nd
lists of agents, tools, and other software that supports ESXi by
searching hp://www.vmware.com/vmtn/resources/ for ESXi
compatibility guides.
The industry oers more products and congurations than VMware
can test. If VMware does not list a product or conguration in a
compatibility guide, Technical Support will aempt to help you with
any problems, but cannot guarantee that the product or conguration
can be used. Always evaluate security risks for unsupported products
or congurations carefully.
Compliance and security standards, as well as
partner solutions and in-depth content about
virtualization and compliance
hp://www.vmware.com/go/compliance
Information on security certications and
validations such as CCEVS and FIPS for
dierent versions of the components of
vSphere.
hps://www.vmware.com/support/support-
resources/certications.html
Hardening guides for dierent versions of
vSphere and other VMware products.
hps://www.vmware.com/support/support-resources/hardening-
guides.html
Security of the VMware vSphere Hypervisor white
paper
hp://www.vmware.com/les/pdf/techpaper/vmw-wp-secrty-vsphr-
hyprvsr-uslet-101.pdf
Chapter 1 Security in the vSphere Environment
VMware, Inc. 17