Title

The IAO/SA does not document and approve virtual machine renames. (Cat III impact)

Discussion

It may become necessary to rename a virtual machine at some point during the course of testing to production. To rename a virtual machine, the virtual machine must be powered down before proceeding with the renaming feature. It is also good practice to backup virtual machines before renaming any virtual machine. The configuration files for VMware are typically located on the service console in /root/VMware/ directory, and the virtual disks will be in the /vmfs/ directory. Renaming virtual machines may cause communication issues on the network with other servers, users, etc. To prevent communication disruptions to the network or virtual machine, all virtual machine renames will be documented and approved by the change control board.

Check Content

Request a copy of the virtual machine rename approval documentation from the IAO/SA. If no documentation can be produced, this is a finding.

Fix Text

Develop approval documentation for all virtual machine renames.

Additional Identifiers

Rule ID: SV-16840r1_rule

Vulnerability ID: V-15898

Group Title: IAO/SA doesn't document and approve renames

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.