To secure your virtual machines, keep the guest operating systems patched and protect your environment just as you protect your physical machine. Consider disabling unnecessary functionality, minimize the use of the virtual machine console, and follow other best practices.

Protect the guest operating system

To protect your guest operating system, make sure that it uses the most recent patches and, if appropriate, anti-spyware and anti-malware applications. See the documentation from your guest operating system vendor and, potentially, other information available in books or on the Internet for that operating system.

Disable unnecessary functionality

Check that unnecessary functionality is disabled to minimize potential points of attack. Many of the features that are used infrequently are disabled by default. Remove unnecessary hardware and disable certain features such as host-guest filesystem (HGFS) or copy and paste between the virtual machine and a remote console.

See Disable Unnecessary Functions Inside Virtual Machines.

Use templates and scripted management

Virtual machine templates enable you to set up the operating system so that it meets your requirements, and to create other virtual machines with the same settings.

If you want to change settings after initial deployment, consider using scripts, for example, PowerCLI. This documentation explains many tasks by using the vSphere Web Client to illustrate the process. Using scripts instead of the vSphere Web Client can help you keep your environment consistent. In large environments, you can group virtual machines into folders to optimize scripting.

See Use Templates to Deploy Virtual Machines. See vSphere Virtual Machine Administration for details.

Minimize use of the virtual machine console

The virtual machine console provides the same function for a virtual machine that a monitor on a physical server provides. Users with access to the virtual machine console have access to virtual machine power management and to removable device connectivity controls. This access might allow a malicious attack on a virtual machine.

Consider UEFI secure boot

Starting with vSphere 6.5, you can configure your virtual machine to use UEFI boot. If the operating system supports secure UEFI boot, you can select that option for your virtual machines for additional security. See #GUID-898217D4-689D-4EB5-866C-888353FE241C.