Versions Compared

Old Version 28

changes.mady.by.user Jason M Ragland

Saved on

compared with

New Version 29

changes.mady.by.user Jason M Ragland

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Step

√

To Do

CIS

UT Note

Cat I

Cat II Cat III

Min Std

 

 

Preparation and Installation

 

 

 

 

 

1

 

If machine is a new install, protect it from hostile network traffic, until the operating system is installed and hardened.

 

§

!

 !

5.1

2

 

Consider using the Security Configuration Wizard to assist in hardening the host.

 

§

 

 

 

 

 

Service Packs and Hotfixes

 

 

 

 

 

3

 

Install the latest service packs and hotfixes from Microsoft.

 

§

!

!

5.2

4

 

Enable automatic notification of patch availability.

 

§

!

!

5.3

 

 

User Account Policies

 

 

 

 

 

5

 

Set minimum password length.

1.1.4

§

!

 !

 

6

 

Enable password complexity requirements.

1.1.5

§

!

 

 

7 Do not store passwords using reversible encryption.1.1.6§! ! 
8 Configure account lockout policy.1.2§!! 
  User Rights Assignment     
 9 Restrict the ability to access this computer from the network to Administrators and Authenticated Users.2.2.2     
10 Do not grant any users the 'act as part of the operating system' right. (Default)2.2.3  ! !  
11 Restrict local logon access to Administrators.2.2.6     
12 Deny guest accounts the ability to logon as a service, a batch job, locally, or via RDP.2.2.18-21  !  
  Security Settings     

1613

 

Place the University warning banner in the Message Text for users attempting to log on.

2.3.7.4

§

!

!

5.10

 14 Disallow users from creating and logging in with Microsoft accounts.2.3.1.1 !!  
15 Disable the guest account. (Default)2.3.1.2 !!  
16 Require Ctrl+Alt+Del for interactive logins. (Default)2.3.7.2 !!  
17 Configure machine inactivity limit to protect idle interactive sessions.2.3.7.3 !!  
18 Configure Microsoft Network Client to always digitally sign communications.2.3.8.1 !   
19 Configure Microsoft Network Client to digitally sign communications if server agrees. (Default)2.3.8.2 !!  
20 Disable the sending of unencrypted password passwords to third party SMB servers.2.3.8.3 !!5.6
 21 Configure Microsoft Network Server to always digitally sign communications.2.3.9.2 !   
22 Configure Microsoft Network Server to digitally sign communications if client agrees.2.3.9.3 !! 

 

 

Network Access Controls

 

 

 

 

 

923

 

Disable anonymous SID/Name translation. (Default)

2.3.11.1

 

!

 !

 

1024

 

Do not allow anonymous enumeration of SAM accounts. (Default)

2.3.11.2

 

!

 !

5.5

1125

 

Do not allow anonymous enumeration of SAM accounts and shares.

2.3.11.3

 

!

 

5.5

1826

 

Do not allow Everyone permissions to apply to anonymous users. (Default)

2.3.11.4

 

!

 !

5.12

1927

 

Do not allow any named pipes to be accessed anonymously.

2.3.11.5

 

!

 

5.12

2128

 

Restrict anonymous access to named pipes and shares. (Default)

2.3.11.8

 

!

 !

5.12

 29 Do not allow any shares to be accessed anonymously.2.3.11.9  !  

2230

 

Require the "Classic" sharing and security model for local accounts. (Default)

12.3.911.4510

 

!

 !

5.12

  Network Security Settings     
 31 Allow Local System to use computer identity for NTLM2.3.12.1     
32 Disable Local System NULL session fallback2.3.12.2     
33 Configure allowable encryption types for Kerberos2.3.12.4    

2334

 

Do not store LAN Manager hash values

2.3.12.5

 

!

 !

5.13

2435

 

Set LAN Manager authentication level to only allow NTLMv2 and refuse LM and NTLM

2.3.12.7

 

!

 

5.13

 36 Enable the Windows Firewall in all profiles (domain, private, public)9.[1-3].1  ! !5.5
 37 Configure the Windows Firewall in all profiles to block inbound traffic by default. (Default)9.[1-3].2  ! ! 

 

 

Active Directory Domain Member Security Settings

 

 

!

 

5.12

1338

 

Digitally encrypt or sign secure channel data (always). (Default)

2.3.6.1

 

!

 

5.6

1439

 

Digitally encrypt secure channel data (when possible). (Default)

2.3.6.2

 

!

 !

5.6

1540

 

Digitally sign secure channel data (when possible). (Default)

2.3.6.3

 

!

 !

5.6

 41 Require strong (Windows 2000 or later) session keys.2.3.6.6 !   
42 Configure the number of previous logons to cache.2.3.7.6    

 

 

Audit Policy Settings

 

 

 

 

 

 43 Configure Account Logon audit policy17.1  !   
44 Configure Account Management audit policy17.2  ! !  
45 Configure Logon/Logoff audit policy17.5  ! !  
46 Configure Policy Change audit policy17.7  ! !  
47 Configure Privilege Use audit policy17.8  !  
  Event LoggingLog Settings
     

948

 

Configure Event Log retention method and size.

18.7.19

§

!

 !

6.1

1049 Configure log shipping (e.g. to Splunk).     

 

 

Additional Security Protection

 

 

 

 

 

2550

 

Disable or uninstall unused services.

 

 

!

 

5.4

2651

 

Disable or delete unused users.

 

 

!

 

5.4

2752

 

Configure User Rights to be as secure as possible.

 

§

!

 

 

2853

 

Ensure all volumes are using the NTFS file system.

 

§

!

 

 

3054

 

Configure file system permissions.

 

§

!

 

 

3155

 

Configure registry permissions.

 

§

!

 

 

 56 Disallow remote registry access if not required.2.3.11.6    

 

 

Additional Steps

 

 

 

 

 

3257

 

Set the system date/time and configure it to synchronize against campus time servers.

 

§

!

 

 

3358

 

Install and enable anti-virus software.

 

§

!

!

3.1

3459

 

Install and enable anti-spyware software.

 

§

!

 

3.2

3560

 

Configure anti-virus software to update daily.

 

§

!

 !

3.3

3661

 

Configure anti-spyware software to update daily.

 

§

!

 

3.3

4062

 

Provide secure storage for Category-I data as required by confidentiality, integrity, and availability needs. Security can be provided by means such as, but not limited to, encryption, access controls, filesystem audits, physically securing the storage media, or any combination thereof as deemed appropriate.

 

§

!

 

5.7

4163

 

Install software to check the integrity of critical operating system files.

 

§

!

 

5.8

4264

 

If RDP is utilized, set RDP connection encryption level to high.

 

§

!

 

5.6

  Physical Security     

3865

 

Set a BIOS/firmware password to prevent alterations in system start up settings.

 

 

!

 

4.1

 66 Disable automatic administrative logon to recovery console.2.3.13.1  !  
 67 Do not allow the system to be shut down without having to log on. (Default)2.3.14.1  !  

3968

 

Configure the device boot order to prevent unauthorized booting from alternate media.

 

 

!

 

4.1

3769

 

Configure a screen-saver to lock the console's screen automatically if the host is left unattended.

 

§

 ! 

!

 

Anchor
note
note
UT Note: Addendum

...