AIX must be configured to only boot from the system boot device.

The ability to boot from removable media is the same as being able to boot into single user or maintenance mode without a password. This ability could allow a malicious user to boot the system and perform changes possibly compromising or damaging the system. It could also allow the system to be used for malicious purposes by a malicious anonymous user.

Determine if the system is configured to boot from devices other than the system startup media by running command: # bootlist -m normal -o

The returned values should be "hdisk{x}".

If the system is setup to boot from a non-hard disk device, this is a finding.

Additionally, ask the SA if the machine is setup for "multi-boot" in the SMS application. If multi-boot is enabled, the firmware will stop at boot time and request which image to boot from the user.

If "multi-boot" is enabled, this is a finding.

Configure the system to only boot from system startup media: # bootlist -m normal hdisk<x>

Set "multi-boot" to "off" in the SMS application.