Attached is the Release Candidate of the vSphere 6.5 Security Configuration Guide. Yes, it's no longer called the "Hardening Guide" because only a subset of it is actual "hardening".
I'm about to post a blog article on this release at https://blogs.vmware.com/vsphere that explains in more detail. This post is a landing spot for the guide so folks can download it. We have the GA version next week and at that time it will get uploaded to its regular home.
Please post your feedback here or as a reply to the blog. As I mentioned, I'm looking to have the GA version next Thursday (April 13th).
[Update 14 April 2017] The GA of the guide is now available at Security Hardening Guides - VMware Security
Message was edited by: mikefoley
The guide has been around for around a decade and Pre-dates directives such as PCI. In fact, most PCI, HIPAA & DISA type directives use this guide as the basis for their requirements. This guide would be considered "vendor best practices" or something similar.
Applying guide settings but found a typo under heading Vulnerability Discussion for Guideline ID "VM.Enable-VGA-Only-Mode". The description is taken from the previous 3 settings "VM.disconnect-devices-serial" etc. IT starts "Ensure that no device is connected to a virtual machine if it is not required" but doesn't describe why VGA only should be used.
Thanks for catching this. I'll update the vulnerability discussion and it will come out in the next update of the guide.
The updated Vulnerability Discussion will be:
Many Server-class virtual machines need only a standard VGA console (typically a Unix/Linux server system). Enabling this setting removes additional unnecessary (for a server workload) functionality beyond disabling 3D.
In vRops 6.7 I get the "ESXi.config-ntp - NTP firewall rule is not configured" alert because the firewall of the NTP service is set to allow "ALL".
Though I can't find a mention to this anywhere in the security guide. Do you have some extra info about it? What's recommended and what's not?
 By the way in the SCG the default value of Security.AccountLockFailures is set to 10. The value in a fresh ESXi 6.5 install is 5.