– BobĪ3: Both features need a Key Management Server (KMS) so there’s some architectural considerations there. You can use the two together – enable VM Encryption to get the permissions and other features, and vSAN Encryption to do the disk part. – BobĪ3: vSAN Encryption is a native part of vSAN and preserves the ability to deduplicate and compress, which is really nice. Want to prevent someone from taking a copy of an Active Directory DC? That’ll help a lot with that. – BobĪ3: VM Encryption also gets you vTPMs and extra permissions in vCenter to help prevent things like decryption. Downside is that the VM becomes a big random blob of data on your storage array, so if you’re using deduplication that may be an issue.

– BobĪ3: VM Encryption can protect a VM in-place, on the storage you have. I need data at rest encryption, what are my options? Can I just run Bitlocker inside the guest? #vSphereChat /iGKhktO1TVĪ3: Don’t run Bitlocker inside the guest when you have great options in VM Encryption and vSAN Encryption! Both of those are completely guest-agnostic, meaning you’ll have one process to protect your workloads, versus different processes for different releases of OSes. They will point you to the latest info on security issues with VMware products and were to get more info. – BobĪ1: Sign up for the VMware Security Advisories here. If you have to do those sorts of things, then it becomes an organizational discussion about how to patch. – BobĪ1: Patching is political insofar as it’s easy to make decisions that disable vMotion for some guest OSes, and then that throws a wrench into seamless updates. Capacity planning being that we need spare capacity in the cluster to vMotion, so a rolling cluster restart can happen without issues. – BobĪ1: People get scared of patching but it’s really a capacity planning issue, and a political one. Beyond that, defense in depth (multiple layers of protections), isolation and firewalling are big helps, too. What's the best way to keep vSphere infrastructure secure? #vSphereChat /8aoGqK7KJHĪ1: Routine and regular patching and good account & password hygiene practices are the two biggest ways you can stay secure.

Vmware esxi 6.7 buffer too small 2019