← Back to HPE 3PAR StoreServ 3.3.x Security Technical Implementation Guide

V-255294

CAT II (Medium)

The HPE 3PAR OS must be configured to disable nonessential VASA VVol services.

Rule ID

SV-255294r958478_rule

STIG

HPE 3PAR StoreServ 3.3.x Security Technical Implementation Guide

Version

V2R1

CCIs

CCI-000381

Discussion

It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. The HPE 3PAR OS does not, by default, operate nonessential services. The VASA VVol Provider service component must be configured for it to start. If it is not required by the mission, then it must be disabled.

Check Content

Check with the Information Owner whether the mission objectives require VASA VVol functionality.

If the mission requirements include VASA VVol functionality, this requirement is not applicable.

If mission requirements do not include this functionality, verify the state of the VASA VVol services capabilities on the array:

cli% showvasa

If the state is "enabled", this is a finding.

Fix Text

Verify with the Information Owner whether VASA VVol functionality is required by the mission objectives.

If the mission requires VASA VVol functionality, this requirement is not applicable.

If VASA VVol services functionality is not required by the mission, stop the VASA provider:

cli% stopvasa -f