V-256324
SV-256324r885583_rule
CAT II
The vCenter Server must require multifactor authentication.
From: VMware vSphere 7.0 vCenter Security Technical Implementation Guide (V1R3)
Description
<VulnDiscussion>Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased.
Multifactor authentication requires using two or more factors to achieve authentication.
Factors include:
(i) something a user knows (e.g., password/PIN);
(ii) something a user has (e.g., cryptographic identification device, token); or
(iii) something a user is (e.g., biometric).
Satisfies: SRG-APP-000149, SRG-APP-000080, SRG-APP-000150, SRG-APP-000391, SRG-APP-000402</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
Check Procedure
From the vSphere Web Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.
If the embedded identity provider is used, click on "Smart Card Authentication".
If the embedded identity provider is used and "Smart Card Authentication" is not enabled, this is a finding.
If a third-party identity provider is used, such as Microsoft ADFS, and it does not require multifactor authentication to log on to vCenter, this is a finding.
Fix Text
To configure smart card authentication for vCenter when using the embedded identity provider, refer to the supplemental document.
For vCenter Servers using a third-party identity provider, consult the product's documentation for enabling multifactor authentication.
CCI Reference
CCI-000166,CCI-000765,CCI-000766,CCI-001953,CCI-002009- Created
- 2026-04-07 20:08:39
- Last Updated
- 2026-04-07 20:08:39