Category: VMware

Apr 30

vSphere 6.7 – ESXi and TPM 2.0

With vSphere 6.7 I’m happy to announce the support of TPM 2.0! This blog will go into detail on how we are leveraging the TPM 2.0 chip found on most modern servers. I’ll also clarify some mis-conceptions and try to put into context what pieces are doing what during the boot of ESXi 6.7.

First, we’ll start out with “What is a TPM?” and what its capabilities are.

Trusted Platform Module or “TPM”

A TPM (Trusted Platform Module) is a computer chip/microcontroller that can securely store artifacts used to authenticate the platform (your PC or laptop). These artifacts can include measurements, passwords, certificates, or encryption keys. A TPM can also be used to digitally sign content and store platform measurements that help ensure that the platform remains trustworthy.  The  Trusted Computing Group has a great detailed overview of what a TPM is and does. I will attempt to provide a journeyman’s overview below.

Continue reading

Jun 15

vSphere Hardening Guide GA now available

It’s time to release the vSphere 6.0 Hardening Guide! As I mentioned back in April, there are a lot of changes that have been made. In talking with customers and auditors in detail for the past year, the conclusion was reached that the Hardening Guide was

  1. Difficult to understand
  2. Contained a mix of
    1. Operational Guidance – How you use the product in your environment
    2. Programmatic Guidance – What settings should be applied OR audited

Basically, it was NOT easy to implement. And if security is too difficult to implement, people will either not do it or will do it poorly.

Continue reading

Mar 13

vSphere 6.0 Lockdown Modes

Lockdown mode has been around in various forms for many releases. The behaviors have changed a few times since 5.1 with varying levels of usability success. For vSphere 6.0 we are trying to address some of these issues. Personally, what I’d love to see happen with all customers running V6.0 is that you run at a minimum the “Normal” Lockdown Mode.

Continue reading