Safeguarding Installation Kits; Vcm Installation Kits Are Obtained From Vmware Or Secure Sources; Vcm Installation Kits Are Protected From Tampering Or Verified - VMware VCM 5.3 - CONFIGURATION MANAGER SECURITY ENVIRONMENT REQUIREMENTS Configuration

7.0 Safeguarding Installation Kits

7.1 VCM installation kits are obtained from VMware or secure sources

Secure operation of VCM requires that the product's software be untampered with and intact as delivered by VMware.
VMware ships VCM and add-on products on CD/DVD in packages signed by the VMware Software Publisher
Certificate. This software reaches customer machines in various ways:
Delivery of the CD/DVD
l
Download from http://downloads.vmware.com/d/info/datacenter_downloads/vmware_vcenter_configuration_
l
manager/5_0
ClickOnce™ download from the server zone
l
Agent push install by the Collector service
l
Patching Agent push by Patching
l
Thin client UI by HTTP
l
VCM Remote updates
l
Patching deployed patches and updates
l
VMware VCM Software Provisioning
l
SMS
l
Group Policy
l
VCM Remote Command file attachments
l
The best practice is to ensure that each kit is either obtained from a secure channel, or is verified.
Executables and MSI installers can be verified by using the Certificate Verification Tool available on the Microsoft
7
Developer's Network.
The VMware Software Publisher Certificate is available at http://downloads.vmware.com/d/info/datacenter_
downloads/vmware_vcenter_configuration_manager/5_0.

7.2 VCM installation kits are protected from tampering or verified

When VCM installation kits are stored on writable media, they must be protected from tampering prior to installation.
Compliance rules and other content exported using the VCM import/export tool likewise should be protected while in
transit to other sites. Authenticode signatures on installation kits are verified just prior to installation. For example:
signtool verify /a /v "CMAgent<version>.msi"
vCenter Configuration Manager Security Environment Requirements
TECHNICAL WHITE PAPER / 17