Title

Virtual machine moved to removable media are not documented. (Cat II impact)

Discussion

From a theft perspective, virtual machines are easy to copy and move to a person’s USB drive, portable hard drive, etc. An insider could potentially move the organization’s entire data center on any type of removable media that had sufficient space.

Check Content

Ask the IAO/SA if virtual machines have been copied to removable media (DVD, CD-ROM, USB drives). If so, request the documentation for all virtual machine moves to removable media. If no documentation exists, this is a finding.

Fix Text

Document all virtual machine moves to removable media.

Additional Identifiers

Rule ID: SV-16844r1_rule

Vulnerability ID: V-15902

Group Title: Virtual machine moved to removable media not doc

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.