Page History

...

106.1 1.9.6 101.9.37!5.5 1.9.385.5 121.9.5!5.12 1.9.405.12 5.12 1.9.43 12 1445.12 1.9.455.12 231.9.46 Audit Policy

		Preparation and Installation
Step	√	To Do	CIS	UT Note	Cat I	Cat II Cat III	Min Std
1		If machine is a new install, protect it from hostile network traffic, until the operating system is installed and hardened.		§	!	!	5.1
2		Consider using the Security Configuration Wizard to assist in hardening the host.		§
		Service Packs and Hotfixes
3		Install the latest service packs and hotfixes from Microsoft.		§	!	!	5.2
4		Enable automatic notification of patch availability.	1.6.1	§	!	!	5.3
		User Account Policies
5	Configure the account management audit policy.	17.2	§	!		6.1	6		Set minimum password length.	1.1.4	§	!	!
76		Enable password complexity requirements.	1.1.5	§	!
87		Do not store passwords using reversible encryption. (Default)	1.1.6	§	!	!
98		Configure account lockout policy.	1.2	§	!	!
	Event Log Policies	User Rights Assignment
9		Configure Event Log settings.		§	!		Restrict the ability to access this computer from the network to Administrators and Authenticated Users.	2.2.2			Security Settings
10			9		Disable anonymous SID/Name translation. (default)	Do not grant any users the 'act as part of the operating system' right. (Default)	2.2.3		!	!
11		Do not allow Anonymous Enumeration of SAM accounts (Default)	Restrict local logon access to Administrators.	2.2.6	§
12	11		Do not allow Anonymous Enumeration of SAM accounts and shares.	Deny guest accounts the ability to logon as a service, a batch job, locally, or via RDP.	2.2.18-21		!
		Disable the guest account. (Default)	Security Settings
13		Digitally Encrypt or Sign Secure Channel Data (Always). (Default)	1.9.12				5.6
14		Digitally Encrypt Secure Channel Data (When Possible). (Default)	1.9.13		!		5.6
15		Digitally Sign Secure Channel Data (When Possible). (Default)	1.9.14		!		5.6
16		Place the University warning banner in the Message Text for Users Attempting to log on.	1.9.27-28	§	!		5.10
17		Disable the sending of unencrypted password to connect to Third-Party SMB Servers. (Default)	1.9.32		!		5.6
Place the University warning banner in the Message Text for users attempting to log on.	2.3.7.4	§	!	!	5.10
14		Disallow users from creating and logging in with Microsoft accounts.	2.3.1.1	§	!	!
15		Disable the guest account. (Default)	2.3.1.2		!	!
16		Require Ctrl+Alt+Del for interactive logins. (Default)	2.3.7.2		!	!
17		Configure machine inactivity limit to protect idle interactive sessions.	2.3.7.3		!	!
18		Configure Microsoft Network Client to always digitally sign communications.	2.3.8.1	18		Do not allow Everyone permissions to apply to anonymous users. (Default)			!
19		Do not allow any named pipes to be accessed anonymously.	1.9.41	Configure Microsoft Network Client to digitally sign communications if server agrees. (Default)	2.3.8.2		!		!
20	20		Restrict anonymous access to Named Pipes and Shares.	Disable the sending of unencrypted passwords to third party SMB servers.	2.3.8.3		!	!	5.	6
21		Ensure that no shares can be accessed anonymously.	Configure Microsoft Network Server to always digitally sign communications.	2.3.9.	2		!
22		Choose "Classic" as the sharing and security model for local accounts. (Default)	Configure Microsoft Network Server to digitally sign communications if client agrees.	2.3.9.3		!
		Do not store LAN Manager hash values	Network Access Controls			!		5.13	24		Set LAN Manager Authentication level to NTLMv2 only	1.9.47
!23		5.13	Disable anonymous SID/Name translation. (Default)	2.3.11.1			!	!
24
		Configure Account Logon audit policy	17.1
		Configure Account Management audit policy	17.2
		Configure Logon/Logoff audit policy	17.5
		Configure Policy Change audit policy	17.7
		Configure Privilege Use audit policy	17.8
		Additional Security Protection
25		Disable or uninstall unused services.			!		5.4
26		Disable or delete unused users.			!		5.4
27		Configure User Rights to be as secure as possible.	1.81	§	!
28		Ensure all volumes are using the NTFS file system.		§	!
29		Use the Internet Connection Firewall or other methods to limit connections to the server.	1.5	§	!		5.5
30		Configure file system permissions.		§	!
31		Configure registry permissions.		§	!
		Additional Steps
32		Set the system date/time and configure it to synchronize against campus time servers.		§	!
33		Install and enable anti-virus software.		§	!	!	3.1
34		Install and enable anti-spyware software.		§	!		3.2
35		Configure anti-virus software to update daily.		§	!		3.3
36		Configure anti-spyware software to update daily.		§	!		3.3
37		Configure a screen-saver to lock the console's screen automatically if the host is left unattended.		§
38		If the machine is not physically secured against unauthorized tampering, set a BIOS/firmware password to prevent alterations in system startup settings.			!		4.1
39		Configure the device boot order to prevent unauthorized booting from alternate media.			!		4.1
40		Systems will provide secure storage for Category-I data as required by confidentiality, integrity, and availability needs. Security can be provided by means such as, but not limited to, encryption, access controls, filesystem audits, physically securing the storage media, or any combination thereof as deemed appropriate.		§	!		5.7
41		Install software to check the integrity of critical operating system files.		§	!		5.8
42		If RDP is utilized, set RDP connection encryption level to high.		§	!		5.6

...

		Network Security Settings
Do not allow anonymous enumeration of SAM accounts. (Default)	2.3.11.2		!	!	5.5
25		Do not allow anonymous enumeration of SAM accounts and shares.	2.3.11.3		!		5.5
26		Do not allow Everyone permissions to apply to anonymous users. (Default)	2.3.11.4		!	!	5.12
27		Do not allow any named pipes to be accessed anonymously.	2.3.11.5		!		5.12
28		Restrict anonymous access to named pipes and shares. (Default)	2.3.11.8		!	!	5.12
29		Do not allow any shares to be accessed anonymously.	2.3.11.9		!
30		Require the "Classic" sharing and security model for local accounts. (Default)	2.3.11.10		!	!	5.12
31		Allow Local System to use computer identity for NTLM.	2.3.12.1
32		Disable Local System NULL session fallback.	2.3.12.2
33		Configure allowable encryption types for Kerberos.	2.3.12.4
34		Do not store LAN Manager hash values.	2.3.12.5		!	!	5.13
35		Set LAN Manager authentication level to only allow NTLMv2 and refuse LM and NTLM.	2.3.12.7		!		5.13
36		Enable the Windows Firewall in all profiles (domain, private, public). (Default)	9.[1-3].1		!	!	5.5
37		Configure the Windows Firewall in all profiles to block inbound traffic by default. (Default)	9.[1-3].2		!	!
		Active Directory Domain Member Security Settings			!		5.12
38		Digitally encrypt or sign secure channel data (always). (Default)	2.3.6.1		!		5.6
39		Digitally encrypt secure channel data (when possible). (Default)	2.3.6.2		!	!	5.6
40		Digitally sign secure channel data (when possible). (Default)	2.3.6.3		!	!	5.6
41		Require strong (Windows 2000 or later) session keys.	2.3.6.6		!
42		Configure the number of previous logons to cache.	2.3.7.6	§
		Audit Policy Settings
43		Configure Account Logon audit policy.	17.1	§	!
44		Configure Account Management audit policy.	17.2	§	!	!
45		Configure Logon/Logoff audit policy.	17.5	§	!	!
46		Configure Policy Change audit policy.	17.7	§	!	!
47		Configure Privilege Use audit policy.	17.8	§	!
		Event Log Settings
48		Configure Event Log retention method and size.	18.7.19	§	!	!	6.1
49		Configure log shipping (e.g. to Splunk).		§
		Additional Security Protection
50		Disable or uninstall unused services.			!		5.4
51		Disable or delete unused users.			!		5.4
52		Configure User Rights to be as secure as possible.		§	!
53		Ensure all volumes are using the NTFS file system.		§	!
54		Configure file system permissions.		§	!
55		Configure registry permissions.		§	!
56		Disallow remote registry access if not required.	2.3.11.6	§
		Additional Steps
57		Set the system date/time and configure it to synchronize against campus time servers.		§	!
58		Install and enable anti-virus software.		§	!	!	3.1
59		Install and enable anti-spyware software.		§	!		3.2
60		Configure anti-virus software to update daily.		§	!	!	3.3
61		Configure anti-spyware software to update daily.		§	!		3.3
62		Provide secure storage for Category-I data as required by confidentiality, integrity, and availability needs. Security can be provided by means such as, but not limited to, encryption, access controls, filesystem audits, physically securing the storage media, or any combination thereof as deemed appropriate.		§	!		5.7
63		Install software to check the integrity of critical operating system files.		§	!		5.8
64		If RDP is utilized, set RDP connection encryption level to high.		§	!		5.6
		Physical Security
65		Set a BIOS/firmware password to prevent alterations in system start up settings.					4.1
66		Disable automatic administrative logon to recovery console.	2.3.13.1		!
67		Do not allow the system to be shut down without having to log on. (Default)	2.3.14.1		!	!
68		Configure the device boot order to prevent unauthorized booting from alternate media.			!		4.1
69		Configure a screen-saver to lock the console's screen automatically if the host is left unattended.		§	!	!

Anchor
note
note
UT Note: Addendum

...

This list provides specific tasks related to the computing environment at The University of Texas at Austin.

1

Anchor

	r1
	r1

If other alternatives are unavailable, this can be accomplished by installing a SOHO router/firewall in between the network and the host to be protected.

2

Anchor

	r2
	r2

The Security Configuration Wizard can greatly simplify the hardening of the server. Once the role for the host is defined, the Security Configuration Wizard can help create a system configuration based specifically on that role. It does not completely get rid of the need to make other configuration changes, though. More information is available at: Security Configuration Wizard.

3

Anchor

	r3
	r3

There are several methods available to assist you in applying patches in a timely fashion:

Microsoft Update Service

Microsoft Update checks your machine to identify missing patches and allows you to download and install them.
This is different than the "Windows Update" that is the default on Windows. Microsoft Update includes updates for many more Microsoft products, such as Office and Forefront Client Security.
This service is compatible with Internet Explorer only.

Windows AutoUpdate via WSUS
ITS offers a Windows Server Update Services Server for campus use using Microsoft's own update servers. It includes updates for additional Microsoft products, just like Microsoft Update, and provides additional administrative control for software deployment.

Microsoft Baseline Security Analyzer
This is a free host-based application that is available to download from Microsoft. In addition to detailing missing patches, this tool also performs checks on basic security settings and provides information on remediating any issues found.

4

Anchor

	r4
	r4

Configure Automatic Updates from the Automatic Updates control panel

On most servers, you should choose either "Download updates for me, but let me choose when to install them," or "Notify me but don't automatically download or install them."
The campus Windows Server Update Services server can be used as the source of automatic updates.

5

Anchor

	r5
	r5

Configuring the minimum password length settings is important only if another method of ensuring compliance with university password standards is not in place. The Information Resources Use and Security Policy requires passwords be a minimum of 8 characters in length. It is strongly recommended that passwords be at least 14 characters in length (which is also the recommendation of CIS).

6

Anchor

	r6
	r6

Configuring the password complexity setting is important only if another method of ensuring compliance with university password standards is not in place. The Information Resources Use and Security Policy requires that passwords contain letters, numbers, and special characters.

7

Anchor

	r7
	r7

If this option is enabled, the system will store passwords using a weak form of encryption that is susceptible to compromise. This configuration is disabled by default.

8

Anchor

	r8
	r8

Instead of the CIS recommended values, the account lockout policy should be configured as follows:

Account lockout duration — 5 minutes
Account lockout threshold — 5 failed attempts
Reset account lockout counter — 5 minutes

11

Anchor

	r11
	r11

Any account with this role is permitted to log in to the console. By default, this includes users in the Administrators, Users, and Backup Operators groups. It's unlikely that non-administrative users require this level of access and, in cases where the server is not physically secured, granting this right may facilitate a compromise of the device.

13

Anchor

	r13
	r13

The text of the university's official warning banner can be found on the ITS Web site. You may add localized information to the banner as long as the university banner is included.

14

Anchor

	r14
	r14

The use of Microsoft accounts can be blocked by configuring the group policy object at:

Code Block
Computer Configuration\Windows Settings\Security Settings\Local Policies\ Security Options\Accounts: Block Microsoft accounts

This setting can be verified by auditing the registry key:

Code Block
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\NoConnectedUser

42

Anchor

	r42
	r42

Logon information for domain accounts can be cached locally to allow users who have previously authenticated to do so again even if a domain controller cannot be contacted. By default 10 accounts will be cached locally, but there is a risk that in the event of a compromise an attacker could locate the cached credentials and use a brute force attack to discover the passwords. Therefore, it is recommended that this value be reduced so that fewer credentials will be placed at risk, and credentials will be cached for shorter periods of time in the case of devices that are logged into frequently by multiple users.

The group policy object below should be set to 4 or fewer logons:

Code Block
Computer Configuration\Windows Settings\Security Settings\Local Policies\ Security Options\Interactive logon: Number of previous logons to cache (in case domain controller is not available)

43

Anchor

	r43
	r43

The Account Logon audit policy logs the results of validation tests of credentials submitted for user account logon requests. The server that is authoritative for the credentials must have this audit policy enabled. For domain member machines, this policy will only log events for local user accounts.