“Falls Far Short” - Ouch! :)

Thanks for your valuable feedback concerning our virtualization benchmarks. We agree that the CIS ESX is not a virtualization security panacea and like all security guides there is room for additional coverage. CIS is a non-profit organization with a single purpose – provide actionable security information to the community. At the core of our guidance process you will find consensus teams comprised of volunteer developers, authors, vendors, geeks, consultants, auditors, security researchers, and spooky three letter government folks. The beating hearts behind these labels believe as CIS does – the ability to make good security decisions increases with perspective. CIS is a couple months into creating an update to the ESX security guide you reviewed and I’ve passed your feedback to the consensus team for incorporation. You are an ESX virtualization ninja and your perspective would enhance our team’s decision making ability and ultimately the guidance provided to our mutual audience - the VMWare community. Feel free to call or email and I’ll introduce you to the team. We would be excited to have you actively participate.

CIS guides are living documents that are updated as feedback is provided. As you and your many readers discover errors or omissions within CIS guides, please get involved by reporting them to cis-feedback@cisecurity.org.

Thanks,

Blake Frantz
Chief Technical Officer
The Center for Internet Security
Voice: 206-384-3023
Fax: 206-260-7528
bfrantz@cisecurity.org

I enjoyed the article but believe most people are trying to get their arms around virtualization security basics. See my blog post.
http://www.tripwire.org/?p=76

Please also note a new version of the Tripwire ConfigCheck will be out in a few weeks to support VMware 3.0.X systems.

Mark Gaydos
Vice-President, Marketing
Tripwire
mgaydos@tripwire.com

Hello,

I agree many people are still trying to get their head around virtualization security, but they are applying that to just the Virtualization Server and not everything it touches. That is the main caveat. I define the Virtual Environment to include everything that touches the virtualization server directly or indirectly and now we have a slightly bigger problem. We could close the doors on the virtualization server, but end up leaving other windows wide open.

These guides are all a great start, and am glad that ConfigCheck now support v3.0.x.

Best regards,
Edward L. Haletky
Author