NIST SPECIAL PUBLICATION 1800-19

---

Trusted Cloud:

Trusted Cloud

Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments

---

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Michael Bartock

Donna Dodson*

Murugiah Souppaya

Daniel Carroll

Robert Masten

Gina Scinta

Paul Massis

Hemma Prafullchandra*

Jason Malnar

Harmeet Singh

Rajeev Ghandi

Laura E. Storey

Raghuram Yeluri

Tim Shea

Michael Dalton

Rocky Weber

Karen Scarfone

Anthony Dukes

Jeff Haskins

Carlos Phoenix

Brenda Swarts

*Former employee; all work for this publication was done while at employer

April 2022

FINAL

This publication is available free of charge from https://doi.org/10.6028/NIST.SP.1800-19

The draft publication is available free of charge from https://www.nccoe.nist.gov/publications/practice-guide/trusted-cloud-vmware-hybrid-cloud-iaas-environments-nist-sp-1800-19-draft

NIST SPECIAL PUBLICATION 1800-19

Trusted Cloud: Security Practice Guide for VMware Hybrid Cloud Infrastructure as a Service (IaaS) Environments

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Michael Bartock

Donna Dodson*

Murugiah Souppaya

NIST

Daniel Carroll

Robert Masten

Dell/EMC

Gina Scinta

Paul Massis

Gemalto

Hemma Prafullchandra*

Jason Malnar

HyTrust

Harmeet Singh

Rajeev Ghandi

Laura E. Storey

IBM

Raghuram Yeluri

Intel

Tim Shea

Michael Dalton

Rocky Weber

RSA

Karen Scarfone

Scarfone Cybersecurity

Anthony Dukes

Jeff Haskins

Carlos Phoenix

Brenda Swarts

VMware

FINAL

April 2022

U.S. Department of Commerce

Gina M. Raimondo, Secretary

National Institute of Standards and Technology

Laurie Locasio, Under Secretary of Commerce for Standards and Technology & Director, National Institute of Standards and Technology

Volume A

• Executive Summary
  • Challenge
  • Solution
  • How To Use This Guide
  • Share Your Feedback
  • Collaborators

Volume B

• 1 Summary
  • 1.1 Challenge
  • 1.2 Solution
  • 1.3 Benefits
• 2 How to Use This Guide
  • 2.1 Typographical Conventions
• 3 Approach
  • 3.1 Audience
  • 3.2 Scope
  • 3.3 Assumptions
  • 3.4 Risk Assessment
    • 3.4.1 Threats
    • 3.4.2 Vulnerabilities
    • 3.4.3 Risk
• 4 Architecture
  • 4.1 Architecture Components
  • 4.2 Technologies
    • 4.2.1 Dell EMC
    • 4.2.2 Gemalto
    • 4.2.3 HyTrust
    • 4.2.4 IBM
    • 4.2.5 Intel
    • 4.2.6 RSA
    • 4.2.7 VMware
    • 4.2.8 Products and Technologies Summary
  • 4.3 NCCoE Cloud Solution Architecture
    • 4.3.1 VMware Cluster Architectures
    • 4.3.2 RSA Cluster Architecture
    • 4.3.3 HSM Architecture
    • 4.3.4 HyTrust Architecture
    • 4.3.5 Dell Leaf and Spine Switch Architecture
  • 4.4 IBM Cloud Solution Architecture
• 5 Security Characteristics Analysis
  • 5.1 Assumptions and Limitations
  • 5.2 Demonstration of the Capabilities
    • 5.2.1 Use Case Scenario 1: Demonstrate Control and Visibility for the Trusted Hybrid Cloud Environment
    • 5.2.2 Use Case Scenario 2: Demonstrate Control of Workloads and Data Security
    • 5.2.3 Use Case Scenario 3: Demonstrate a Workload Security Policy in a Hybrid Cloud
    • 5.2.4 Use Case Scenario 4: Demonstrate Recovery From an Unexpected Infrastructure Outage
    • 5.2.5 Use Case Scenario 5: Demonstrate Providing Visibility into Network Traffic Patterns
    • 5.2.6 Use Case Scenario 6: Demonstrate Application Zero Trust
• Appendix A Mappings
• Appendix B List of Acronyms
• Appendix C Glossary
• Appendix D References

Volume C

• 1 Introduction
  • 1.1 Practice Guide Structure
  • 1.2 Build Overview
  • 1.3 Typographic Conventions
  • 1.4 Logical Architecture Summary
• 2 Dell EMC Product Installation and Configuration Guide
  • 2.1 Dell EMC Unity Hardening Guidance
  • 2.2 Dell Networking S4048-ON, S3048-ON, OS9 Hardening
    • 2.2.1 Functionality and interoperability (layer 3 access)
    • 2.2.2 VLANs
  • 2.3 Dell PowerEdge Hardening
  • 2.4 Avamar Security Hardening
• 3 Gemalto Product Installation and Configuration Guide
  • 3.1 Gemalto Luna 6 Initialization
  • 3.2 Create HSM Partition
• 4 HyTrust Product Installation and Configuration Guide
  • 4.1 HyTrust KeyControl Setup
  • 4.2 HyTrust DataControl Setup
  • 4.3 HyTrust CloudControl Appliance Setup
    • 4.3.1 Provisioning PolicyTags
      • 4.3.1.1 Collect UUIDs of Good Known Hosts (GKHs) and Trusted Hosts
      • 4.3.1.2 Generate esxcli Commands
      • 4.3.1.3 Run esxcli Commands
    • 4.3.2 Policy Interaction
  • 4.4 HyTrust CloudAdvisor Appliance Setup
• 5 IBM Product Installation and Configuration Guide
  • 5.1 ICSV Deployment
    • 5.1.1 Pre-deployment
    • 5.1.2 Automation deployment
    • 5.1.3 Post-deployment
  • 5.2 Enable Hardware Root of Trust on ICSV Servers
    • 5.2.1 Enable Managed Object Browser (MOB) for each ESXi Server
    • 5.2.2 Enable TPM/TXT on SuperMicro hosts
    • 5.2.3 Enable TPM/TXT in IBM Cloud
    • 5.2.4 Validate the TPM/TXT is enabled
    • 5.2.5 Check the vCenter MOB to see if the TPM/TXT is enabled
    • 5.2.6 Set up Active Directory users and groups
    • 5.2.7 Join vCenter to the AD domain
    • 5.2.8 Add AD HyTrust-vCenter service user to vCenter as Administrator
    • 5.2.9 Add AD HyTrust-vCenter service user to vCenter Global Permissions
    • 5.2.10 Configure HTCC for AD authentication
  • 5.3 Add Hosts to HTCC and Enable Good Known Host (GKH)
• 6 Intel Product Installation and Configuration Guide
• 7 RSA Product Installation and Configuration Guide
  • 7.1 RSA SecurID
  • 7.2 RSA NetWitness
    • 7.2.1 Configure the VMware ESX/ESXi Event Source
    • 7.2.2 Configure the RSA NetWitness Log Collector for VMware Collection
• 8 VMware Product Installation and Configuration Guide
  • 8.1 Prerequisites
  • 8.2 Installation and Configuration
  • 8.3 Configuration Customization Supporting the Use Cases and Security Capabilities
    • 8.3.1 Example VVD 5.0.1 Configuration: Configure the Password and Policy Lockout Setting in vCenter Server in Region A
    • 8.3.2 Example VVD 5.0.1 Configuration: Configure Encryption Management in Region A
    • 8.3.3 Example vRealize Automation DISA STIG Configuration: Configure SLES for vRealize to protect the confidentiality and integrity of transmitted information
    • 8.3.4 Example vRealize Operations Manager DISA STIG Configuration: Configure the vRealize Operations server session timeout
  • 8.4 Operation, Monitoring, and Maintenance
    • 8.4.1 Operation
    • 8.4.2 Monitoring
    • 8.4.3 Maintenance
  • 8.5 Product Configuration Overview
• Appendix A Security Configuration Settings
• Appendix B List of Acronyms
• Appendix C Glossary