Check: GEN008380
VMware ESX 3 Server:
GEN008380
(in version v1 r2)
Title
A root kit check tool must be run on the system at least weekly. (Cat II impact)
Discussion
Root kits are software packages designed to conceal the compromise of a system from the SA. Root kit checking tools examine a system for evidence that a root kit is installed. Dedicated root kit detection software or root kit detection capabilities included in anti-virus packages may be used to satisfy this requirement.
Check Content
Ask the SA if a root kit check tool is run on the system weekly. If this is not performed, this is a finding.
Fix Text
Create an automated job or establish a site-defined procedure to check the system weekly with a root kit check tool.
Additional Identifiers
Rule ID: SV-26250r1_rule
Vulnerability ID: V-22575
Group Title: GEN008380
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001199 |
The information system protects the confidentiality and/or integrity of organization-defined information at rest. |
Controls
Number | Title |
---|---|
SC-28 |
Protection Of Information At Rest |