system hardening recommendations_final
Post on 16-Jul-2015
289 Views
Preview:
TRANSCRIPT
Table of Contents
I. Windows 7 Workstation Hardening Recommendations
a. Account Policies
b. Local Policies
c. Windows Firewall
d. Network List Manager Policies
e. Public Key Policies
f. Software Restriction Policies
g. Application Control Policies
h. Advanced Audit Policy Configuration
II. Windows Server 2012 Hardening Recommendations
a. Additional Server Settings
b. Group Policy Object (GPO) Recommendations
III. Additional Hardening Recommendations
IV. Summary and Potential Impact
I. Windows 7 Workstation Recommendations – While many of these changes
are minor, some recommendations are more impactful. Although some
specifics are given, some areas include brief explanations and each setting
should be carefully considered before implementing.
a. Account Policies
i. Password Policy
Policy Security Settings (Recommended) Enforce password history 24 passwords remembered
Maximum password age ≤ 60 (days) Minimum password age ≥ 1 days Minimum password length
8 characters
Passwords must meet complexity requirements
Enabled
Store passwords using reversible encryption
Disabled
ii. Account Lockout Policy
Policy Security Settings (Recommended)
Account lockout duration 1440 minutes
Account lockout threshold <10 Invalid login attempts
Reset account lockout counter after
1440 minutes
b. Local Policies
i. Audit Policy
Setting Recommendation Audit account logon events Success, Failure
Audit account management Success, Failure
Audit directory service access Failure Audit logon events Success, Failure
Audit object access Failure Audit policy change Success, Failure
Audit privilege use Success, Failure
Audit process tracking Failure
Audit system events Success, Failure
ii. User Rights Assignment – These rights should be assigned by GPO to
include users or administrators as applicable.
iii. Security Options
1. Accounts
Setting Recommendations
Accounts: Administrator account status Disabled
Accounts: Guest account status Disabled
Accounts: Limit local account use of blank passwords to console logon only Enabled
Accounts: Rename administrator account Recommended
Accounts: Rename guest account Recommended
2. Audit
Setting Recommendation
Audit: Audit the access of global system objects Disabled
Audit: Audit the use of Backup and Restore privilege Disabled
Audit: Force audit policy subcategory settings Not Defined
Audit: Shut down system immediately if unable to log security audits Disabled
3. Devices
Setting Recommendation
Devices: Allow undock without having to log on Enabled
Devices: Allowed to format and eject removable media Administrator, Interactive Users
Devices: Prevent users from installing printer drivers Enabled
(*Disabled for laptops/mobile
devices)
Devices: Restrict CD-ROM access to locally logged on user only Not Defined
Devices: Restrict floppy access to locally logged on user only Not Defined
4. Domain Member
Setting Recommendation
Domain member: Digitally encrypt or sign secure channel data
(always)
Enabled
Domain member: Digitally encrypt secure channel data (when
possible)
Enabled
Domain member: Digitally sign secure channel data (when
possible)
Enabled
Domain member: Disable machine account password changes Disabled
Domain member: Maximum machine account password age 30 days
Domain member: Require strong
(Windows 2000 or later) session key
Enabled
5. Interactive Logon
Setting Recommendation
Interactive Logon: Do not display last user name Disabled
Interactive Logon: Display user information when the session is locked Display Name Only
Interactive Logon: Do not require CTRL+ALT+DEL Disabled
Interactive Logon: Message text for users attempting to log on Undefined
Interactive Logon: Message title for users attempting to log on
Legal Notice
Interactive Logon: Number of previous logons to cache (in case domain
controller is not available)
10 or less
Interactive Logon: Prompt user to change password before expiration 5 or less days
Interactive Logon: Require Domain Controller authentication to unlock
workstation
Enabled
(*Disabled for laptops/mobile
devices)
Interactive Logon: Smart card removal behavior Lock Workstation
6. Microsoft Network Client
Setting Recommendation
Microsoft network client: Digitally sign communications (always) Disabled
Microsoft network client: Digitally sign communications (if server agrees) Disabled
Microsoft network client: Send unencrypted password to third-party SMB servers Disabled
7. Network Access
Setting Recommendation
Network access: Allow anonymous SID/Name translation Disabled
Network access: Do not allow anonymous enumeration of SAM accounts Enabled
Network access: Do not allow anonymous enumeration of SAM accounts and
shares
Enabled
Network access: Do not allow storage of credentials or .NET Passports for network authentication
Enabled
Network access: Let Everyone permissions apply to anonymous users Disabled
Network access: Named Pipes
that can be accessed anonymously
Not Defined
Network access: Remotely accessible registry paths Not Defined
Network access: Restrict anonymous access to named Pipes and Shares Enabled
Network access: Shares that can be accessed anonymously Not Defined
Network access: Sharing and security model for local accounts Classic – local
users authenticate
as themselves
8. Network Security
Setting Recommendation
Network security: Allow PKU2U authentication requests to this
computer to use online identities
Disabled
Network security: Configure encryption types allowed for
Kerberos
AES128 or 256 future
encryption types
Network security: Do not store LAN Manager hash value on next
password change
Enabled
Network security: LAN Manager authentication level Send NTLMv2
responses only\refuse
LM
Network security: LDAP client signing requirements Negotiate signing
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients
Require message confidentiality, Require message integrity, Require NTLMv2 session security, Require 128 bit
encryption
Network security: Minimum session security for NTLM SSP based (including secure RPC) servers
Require message confidentiality, Require message integrity, Require NTLMv2 session security, Require 128 bit
encryption
9. Recovery Console
Setting Recommendation
Recovery console: Allow automatic administrative logon Disabled
Recovery console: Allow floppy copy and access to all drives and all folders Disabled
10. Shutdown
Setting Recommendation
Shutdown: Allow system to be shut down without having to log on Enabled
Shutdown: Clear virtual memory pagefile Disabled
11. System Cryptography, System Objects, and User Account
Control
Setting Recommendation
System cryptography: Force strong key protection for user keys stored on the
computer
User must enter a
password each time
they use a key
System cryptography: Use FIPS compliant algorithms for encryption, hashing,
and signing
Enabled
System objects: Require case insensitivity for non-Windows subsystems Enabled
System objects: Strengthen default permissions of internal system objects Enabled
c. Windows Firewall
i. Windows Firewall – Local GPO
Profile: Setting Recommendation
Domain Profile Firewall State: ON
Inbound Connections: BLOCK
Outbound Connections: ALLOW
Private Profile: Firewall State: ON
Inbound Connections: BLOCK
Outbound Connections: ALLOW
Public Profile: Firewall State: ON
Inbound Connections: BLOCK
Outbound Connections: ALLOW
IPsec Settings: IPsec Defaults: CUSTOMIZE
Key Exchange (Main Mode): DEFAULT
Data Protection (Quick Mode): DEFAULT
Authentication Mode: Computer and User
(Kerberos V5)
IPsec Exemption:
Exempt ICMP IPsec: NO
IPsec Tunnel Authorization: NONE
d. Network List Manager Policies
Network Name: Setting Recommendation Network Properties Network Name: Identifies a network
Name: N/A
User Permissions: User Cannot Change Name
Network Icon: Provides a graphic or logo that represents the company or network
Icon: ICON
User Permissions: User Cannot Change Icon
Network Location: Identifies the type of network that a computer is connected to and automatically sets the appropriate firewall setting for that location.
Location Type: Private/Public
User Permissions: User Cannot Change
Location
Unidentified Networks: Networks that cannot be identified due to a network issue or lack of identifiable characteristics
Network Location: Identifies the type of network that a computer is connected to and automatically sets the appropriate firewall setting for that location.
Location Type: Private/Public
User Permissions: User Cannot Change
Location
Identifiable Networks: Temporary state of networks that are in the process of being identified.
Network Location: Identifies the type of network that a computer is connected to and automatically sets the firewall settings for that location.
Location Type: Private/Public
All Networks: All networks the user connects to.
User Permissions: These permissions control if users can change the network name, location, or icon.
Network Name: User Cannot Change Name
Network Location: User Cannot Change
Location
Network Icon: User Cannot Change Icon
e. Public Key Policies
i. Encrypting File System: Specific files/folders should be encrypted if
necessary to protect sensitive data (i.e. PHI, IP). We recommend this
setting be configured if sensitive/encrypted data will be saved in
specific directories/folders on the machine. A Data Recovery Agent
should be set – preferably to a local admin account.
ii. BitLocker Drive Encryption: As Verisk Health deals with sensitive
data on a daily basis (i.e. PHI/PII), we recommend that some form of
whole-disk encryption be used. In order to use BitLocker, a Data
Recovery Agent must be set – preferably to a local admin account.
f. Software Restriction Policies: If it is needed and feasible, strict controls
can be put in place to restrict the execution of specific file types. Since this
is an advanced set of policies, it may be avoided as long as mitigating
controls are in place. These would include restricting downloading and
executing software to local administrators only.
g. Application Control Policies
i. AppLocker:
AppLocker helps administrators control how users can access and use files, such as executable files, packaged apps, scripts, Windows Installer files, and DLLs.
RECOMMENDATION: Define rules based on file attributes derived from the digital signature, including the publisher, product name, file name, and file version. Assign a rule to a security group or an individual user. Create exceptions to rules. Use audit-only mode to deploy the policy and understand its impact before enforcing it. Import and export rules. Simplify creating and managing AppLocker rules by using AppLocker PowerShell cmdlets.
ii. IP Security Policies: These required advanced configuration but
should be used in cases where a system needs to communicate
securely with either another computer or group of computers
(subnet).
h. Advanced Audit Policy
i. System Audit Policies – Local GPO
System Audit Policy: Setting Recommendation
Account Logon Audit Credential Validation: allows you to audit events generated by validation tests on user account logon credentials.
Success, Failure
Audit Kerberos Authentication Services: allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests.
Failure
Audit Kerberos Service Ticket Operations: allows you to audit events generated by Kerberos authentication ticket-granting ticket (TGT) requests submitted for user accounts.
Failure
Account Logon (continued):
Audit Other Account Logon Events: allows you to audit events generated by responses to credential requests submitted for a user account logon that are not credential validation or Kerberos tickets.
Failure
Account Management
Audit Application Group Management: allows you to audit events generated by changes to application groups such as the following: Application group created, changed, or deleted. Member is added or removed from an application group
Success, Failure
Audit Computer Account Management: allows you to audit events generated by changes to computer accounts such as when a computer account is created, changed, or deleted.
Success, Failure
Audit Distribution Group Management: allows you to audit events generated by changes to distribution groups.
Failure
Audit Other Account Management Events: allows you to audit events generates by other user account changes that are not covered in this category. The password hash of a user account was accessed. The Password Policy Checking API was called. Changes to the Default Domain Group Policy were made.
Success, Failure
Audit Security Group Management: allows you to audit events generated by changes to security groups such as the following: Security group is created, changed, or deleted. Member is added or removed from a security group. Group type is changed
Success, Failure
Audit user Account Management: allows you to audit changes to user accounts. Events.
Success, Failure
Detailed Tracking Audit DPAPI Activity: allows you to audit events generated when encryption or decryption requests are made to the Data Protection application interface (DPAPI). DPAPI is used to protect secret information such as stored password and key information.
Success, Failure
Audit Process Creation: allows you to audit events generated when a process is created or starts. The name of the application or user that created the process is also audited.
Failure
Audit Process Termination: allows you to audit events generated when a process ends.
Failure
Audit RPC Events: allows you to audit inbound remote procedure call (RPC) connections.
Success, Failure
DS Access Audit Detailed Directory Service Replication: allows you to audit events generated by detailed Active Directory Domain Services (AD DS) replication between domain controllers.
Workstation: No Auditing Server: Failure
Audit Directory Service Access: allows you to audit events generated when an Active Directory Domain Services (AD DS) object is accessed.
Workstation: No Auditing Server: Failure
Audit Directory Service Changes: allows you to audit events generated by changes to objects in Active Directory Domain Services (AD DS). Events are logged when an object is created, deleted, modified, moved, or undeleted.
Workstation: No Auditing Server: Success, Failure
Audit Directory Service Replication: allows you to audit replication between two Active Directory Domain Services (AD DS) domain controllers.
Workstation: No Auditing Server: Failure
Logon/Logoff Audit Account Lockout: allows you to audit events generated by a failed attempt to log on to an account that is locked out.
Success.
Logon/Logoff (continued):
Audit User / Device Claims: allows you to audit user and device claims information in the user's logon token. Events in this subcategory are generated on the computer on which a logon session is created. For an interactive logon, the security audit event is generated on the computer that the user logged on to. For a network logon, such as accessing a shared folder on the network, the security audit event is generated on the computer hosting the resource.
Workstation: Failure Server: Failure
Audit IPsec Extended Mode: allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Extended Mode negotiations.
No Auditing
Audit IPsec Main Mode: allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Main Mode negotiations.
No Auditing
Audit IPsec Quick Mode: allows you to audit events generated by Internet Key Exchange protocol (IKE) and Authenticated Internet Protocol (AuthIP) during Quick Mode negotiations.
No Auditing
Audit Logoff: allows you to audit events generated by the closing of a logon session. These events occur on the computer that was accessed. For an interactive logoff the security audit event is generated on the computer that the user account logged on to.
Success.
Audit Logon: allows you to audit events generated by user account logon attempts on the computer.
Workstation: Success Server: Success, Failure
Logon/Logoff (continued):
Audit Network Policy Server: allows you to audit events generated by RADIUS (IAS) and Network Access Protection (NAP) user access requests. These requests can be Grant, Deny, Discard, Quarantine, Lock, and Unlock.
Success, Failure
Audit Other Logon/Logoff Events: allows you to audit other logon/logoff-related events that are not covered in the “Logon/Logoff” policy setting such as the following: Terminal Services session disconnections. New Terminal Services sessions. Locking and unlocking a workstation. Invoking a screen saver. Dismissal of a screen saver.
Success, Failure
Audit Special Logon: allows you to audit events generated by special logons such as the following: The use of a special logon, which is a logon that has administrator-equivalent privileges and can be used to elevate a process to a higher level.
Success, Failure
Object Access Audit Application Generated: allows you to audit applications that generate events using the Windows Auditing application programming interfaces (APIs). Applications designed to use the Windows Auditing API use this subcategory to log auditing events related to their function.
No Auditing
Audit Certification Services: allows you to audit Active Directory Certificate Services (AD CS) operations.
No Auditing
Audit Detailed File Share: allows you to audit attempts to access files and folders on a shared folder. The Detailed File Share setting logs an event every time a file or folder is accessed, whereas the File Share setting only records one event for any connection established between a client and file share. Detailed File Share audit events include detailed information about the
Success, Failure
permissions or other criteria used to grant or deny access.
Object Access (continued):
Audit File Share: allows you to audit attempts to access a shared folder. If you configure this policy setting, an audit event is generated when an attempt is made to access a shared folder. If this policy setting is defined, the administrator can specify whether to audit only successes, only failures, or both successes and failures.
Success, Failure
Audit File System: allows you to audit user attempts to access file system objects. A security audit event is generated only for objects that have system access control lists (SACL) specified, and only if the type of access requested, such as Write, Read, or Modify and the account making the request match the settings in the SACL.
Success, Failure
Audit Filtering Platform Connection: allows you to audit connections that are allowed or blocked by the Windows Filtering Platform (WFP).
Success, Failure
Audit Filtering Platform Packet Drop: allows you to audit packets that are dropped by Windows Filtering Platform (WFP).
Failure
Audit Handle Manipulation: allows you to audit events generated when a handle to an object is opened or closed. Only objects with a matching system access control list (SACL) generate security audit events.
Success, Failure
Audit Kernel Object: allows you to audit attempts to access the kernel, which include mutexes and semaphores. Only kernel objects with a matching system access control list (SACL) generate security audit events.
Failure
Audit Other Object Access Event: allows you to audit events generated by the management of task scheduler jobs or COM+ objects.
Failure
Object Access (continued):
Audit Registry: allows you to audit attempts to access registry objects. A security audit event is generated only for objects that have system access control lists (SACLs) specified, and only if the type of access requested, such as Read, Write, or Modify, and the account making the request match the settings in the SACL.
Success, Failure
Audit Removable Storage: allows you to audit user attempts to access file system objects on a removable storage device. A security audit event is generated only for all objects for all types of access requested.
Success, Failure
Audit SAM: allows you to audit events generated by attempts to access to Security Accounts Manager (SAM) objects.
Success, Failure
Policy Change Audit Audit Policy Change: allows you to audit changes in the security audit policy settings.
Success
Audit Authentication Policy Change: allows you to audit events generated by changes to the authentication policy.
Success
Audit Authorization Policy Change: allows you to audit events generated by changes to the authorization policy.
No Auditing
Audit Filtering Platform Policy Change: allows you to audit events generated by changes to the Windows Filtering Platform (WFP).
Success
Audit MPSSVC Rule-Level Policy Change: allows you to audit events generated by changes in policy rules used by the Microsoft Protection Service (MPSSVC). This service is used by Windows Firewall.
No Auditing
Audit Other Policy Change Events: allows you to audit events generated by other security policy changes that are not audited in the policy change category.
Success
Privilege Use Audit Non Sensitive Privilege Use: allows you to audit events generated by the use of non-sensitive privileges (user rights).
No Auditing
Audit Other Privilege Use Events: No Auditing
Audit Sensitive Privilege Use: allows you to audit events generated when sensitive privileges (user rights) are used.
Success, Failure
System Audit IPsec Driver: allows you to audit events generated by the IPsec filter driver.
Success
Audit Other System Events: allows you to audit any of the following events: Startup and shutdown of the Windows Firewall service and driver. Security policy processing by the Windows Firewall Service. Cryptography key file and migration operations.
Success, Failure
Audit Security State Change: allows you to audit events generated by changes in the security state of the computer such as the following events: Startup and shutdown of the computer. Change of system time. Recovering the system from CrashOnAuditFail, which is logged after a system restarts when the security event log is full and the CrashOnAuditFail registry entry is configured.
Success
Audit Security System Change: allows you to audit events related to security system extensions or services.
Workstation: No Auditing. Server: Success, Failure
Audit System Integrity: allows you to audit events that violate the integrity of the security subsystem
Success, Failure
* For more details on how these policies may effect end users visit:
http://technet.microsoft.com/en-us/library/cc875814.aspx
Global Object Access Auditing
File System: allows you to apply a comprehensive object access audit policy to every file and folder on the file system for a computer. Configuring this setting also allows you to demonstrate that every file and folder on the computer is monitored by an audit policy that is managed from a central location. This setting applies a global system access control list (SACL) to every file and folder. If either a file or folder SACL and a global SACL are configured on a computer, the effective SACL is derived by combining the file or folder SACL and the global SACL. This means that an audit event is generated when an activity matches either the file or folder SACL or the global SACL.
Depends on the effective SACL and the level of user activity
Registry: allows you to apply a global object access audit policy to the registry for an entire computer. This policy setting allows you to demonstrate that every registry object on the computer is protected by an audit policy that is managed from a central location. This setting applies a global system access control list (SACL) to every registry object. If both a registry SACL and a global SACL are configured on a computer, the effective SACL is derived by combining the registry SACL and the global SACL. This means that an audit event is generated when an activity matches either the registry key SACL or the global SACL.
Depends on the effective SACL and the level of user activity.
II. Windows Server 2012 Hardening Recommendations
a. Additional Server Settings – In addition to the standard system build
guidelines above, servers should use the following:
i. Firewall configuration – host-based software firewalls such as
Windows Firewall will have to be configured based on the purpose
of the server. There should be standard rules/Access Control Listings
(ACL’s) for each type of server (i.e. database, web server)
ii. Services – depending on the purpose/use of the server, specific
services should be disabled. This will provide defense-in-depth and
lessen the computing load.
iii. Add/Remove Role s & Features – only enable the relevant features:
b. Group Policy Object (GPO) Recommendations
i. Rename the Local Administrator Account
ii. Disable the Guest Account
iii. Disable LM and NTLM v1
iv. Disable LM hash storage
v. Set minimum password length
vi. Set maximum password age
vii. Enable event logs
viii. Disable anonymous SID enumeration
ix. Disallow the anonymous account from residing in the everyone
group
x. Enable User Account Control
III. Additional Recommendations – In addition to the specific configurations
mentioned above, we would recommend considering the following:
a. Workstations:
i. Use GPO’s – to simplify implementing security policies, use Group
Policy Objects, particularly for settings like password complexity.
ii. Have a workstation list – include assigned user, service tag, etc.
iii. Force encryption – particularly for mobile devices (i.e.
tablets/laptops), this is a must.
iv. Configure BIOS – set to boot from local hard drive only and set a
BIOS password.
v. Disable USB ports on any systems that will access sensitive data.
vi. Install and utilize performance tools:
1. Stand-alone optimization tool (CCleaner, Registry Editor, etc.)
a. Registry cleaning
b. Malware scanning
c. Cleans up temp files
2. Disc Defragmentation
a. Consolidates fragmented files improving overall
performance and system function
b. Servers:
i. Use Static IP addresses – this makes terminal/remote services,
web/application servers, etc. much easier to access and manage
ii. Create a detailed server list – this should include server name, IP,
purpose, service tag, OS and responsible party.
iii. Centralize security – before being fully deployed, verify that servers
have been appropriately patched and have been added to
centralized anti-malware and vulnerability scanning consoles.
iv. UPS and power-saving – critical servers should have power back-ups
to ensure availability directly after an outage until the generator
restores long-term power.
v. Reset defaults – rename the default local admin accounts and reset
the passwords
vi. Backups/Restores – no production data should ever get onto a
server without being backed up. Data restoration should be tested.
IV. Summary and Potential Impact
Each of these points and their potential impact should be carefully considered for
implementation on some or all of Verisk Health’s workstation builds to eliminate
or mitigate attacks or other security risks and keep Verisk Health in compliance
with security standards. If Verisk Health were to implement all changes, it
would be able to bring workstations to 86% and servers to 93% compliance
with the corresponding CIS-CAT benchmarks.
top related