diff --git a/CHANGELOG.md b/CHANGELOG.md index 77e69a9cd..c5c593b94 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ ## [Unreleased] +* Update PowerSTIG to include LegacyId to assist in determining Legacy Vuln Ids with the new DISA standard. [#788](https://github.com/microsoft/PowerStig/issues/788) + ## [4.6.0] - 2020-12-01 * Provide Method to install DoD Root Certs for Server OS and Client OS: [#755](https://github.com/microsoft/PowerStig/issues/755) diff --git a/Tests/Unit/Module/Rule.tests.ps1 b/Tests/Unit/Module/Rule.tests.ps1 index 9775446a4..2e0edd928 100644 --- a/Tests/Unit/Module/Rule.tests.ps1 +++ b/Tests/Unit/Module/Rule.tests.ps1 @@ -15,6 +15,9 @@ try It 'Should return the rule Id' { $stig.id | Should Be 'V-1000' } + It 'Should return the legacy Id' { + $stig.legacyid | Should Be 'V-1111' + } It 'Should return the Severity' { $stig.severity | Should Be 'medium' } diff --git a/Tests/Unit/Module/STIG.PowerStigXml.tests.ps1 b/Tests/Unit/Module/STIG.PowerStigXml.tests.ps1 index 72dda172b..7f03c871c 100644 --- a/Tests/Unit/Module/STIG.PowerStigXml.tests.ps1 +++ b/Tests/Unit/Module/STIG.PowerStigXml.tests.ps1 @@ -26,9 +26,9 @@ Describe 'Compare-PowerStigXml' { Describe 'Get-BaseRulePropertyName' { - It 'Should return 11 base rule types' { + It 'Should return 12 base rule types' { $baseRulePropertyName = Get-BaseRulePropertyName - $baseRulePropertyName.Count | Should -Be 11 + $baseRulePropertyName.Count | Should -Be 12 } } diff --git a/Tools/TestHelper/Data/samplegroup.xml.txt b/Tools/TestHelper/Data/samplegroup.xml.txt index c7d0499a8..f0949df6c 100644 --- a/Tools/TestHelper/Data/samplegroup.xml.txt +++ b/Tools/TestHelper/Data/samplegroup.xml.txt @@ -13,6 +13,7 @@ Technology 2350 + {6} CCE--12345-6 CCI-123456 {4} diff --git a/Tools/TestHelper/TestHelper.psm1 b/Tools/TestHelper/TestHelper.psm1 index be13b0de6..e7ee2beeb 100644 --- a/Tools/TestHelper/TestHelper.psm1 +++ b/Tools/TestHelper/TestHelper.psm1 @@ -136,6 +136,10 @@ function Get-TestStigRule [string] $FixText = 'This is a string of text that tells an admin how to fix an item if it is not currently configured properly and ignored by the parser', + [Parameter(Parametersetname = 'UseExisting')] + [string] + $LegacyId = 'V-1111', + [Parameter(Parametersetname = 'UseExisting')] [Parameter(Parametersetname = 'FileProvided')] [switch] @@ -162,7 +166,7 @@ function Get-TestStigRule { # Get the samplegroup element text and merge in the parameter strings $groupElement = Get-Content -Path "$PSScriptRoot\data\sampleGroup.xml.txt" -Encoding UTF8 -Raw - $groupElement = $groupElement -f $GroupId, $GroupTitle, $RuleTitle, $RuleDescription, $FixText, $CheckContent + $groupElement = $groupElement -f $GroupId, $GroupTitle, $RuleTitle, $RuleDescription, $FixText, $CheckContent, $LegacyId } # Get and merge the group element data into the xccdf xml document and create an xml object to return diff --git a/source/Module/Rule.HardCoded/Convert/HardCodedRule.Convert.psm1 b/source/Module/Rule.HardCoded/Convert/HardCodedRule.Convert.psm1 index 2021fd9c7..ee6ba380a 100644 --- a/source/Module/Rule.HardCoded/Convert/HardCodedRule.Convert.psm1 +++ b/source/Module/Rule.HardCoded/Convert/HardCodedRule.Convert.psm1 @@ -75,6 +75,13 @@ class HardCodedRuleConvert #> [object] SetRule ([xml.xmlelement] $XccdfRule, [string] $TypeName) { + # Support for HardCodedRule Split rule with Legacy Id present + $legacyId = ($XccdfRule.rule.ident | Where-Object -FilterScript {$PSItem.'#text' -match "^V-.*"}).'#text' + if ($XccdfRule.id -match '^V-.*\.[a-z]$' -and [string]::IsNullOrEmpty($legacyId) -eq $false) + { + $legacyId = '{0}.{1}' -f $legacyId, $XccdfRule.id.Split('.')[1] + } + $newRule = New-Object -TypeName $TypeName -ArgumentList $XccdfRule $propertyHashtable = Get-HardCodedRuleProperty -CheckContent $XccdfRule.Rule.Check.'check-content' foreach ($property in $propertyHashtable.Keys) @@ -85,6 +92,7 @@ class HardCodedRuleConvert { $newRule.set_OrganizationValueRequired($true) } + $newRule.set_LegacyId($legacyId) $newRule.set_Severity($XccdfRule.rule.severity) $newRule.set_Description($XccdfRule.rule.description) $newRule.set_RawString($XccdfRule.Rule.check.'check-content') diff --git a/source/Module/Rule/Convert/ConvertFactory.psm1 b/source/Module/Rule/Convert/ConvertFactory.psm1 index 7cd1e8c2d..9e4daa528 100644 --- a/source/Module/Rule/Convert/ConvertFactory.psm1 +++ b/source/Module/Rule/Convert/ConvertFactory.psm1 @@ -344,6 +344,10 @@ class ConvertFactory foreach ($convertedrule in $ruleTypeList) { $convertedrule.id = "$($Rule.id).$([CHAR][BYTE]$byte)" + if ([string]::IsNullOrEmpty($convertedrule.LegacyId) -eq $false) + { + $convertedrule.LegacyId = "$($convertedrule.LegacyId).$([CHAR][BYTE]$byte)" + } $byte ++ } } diff --git a/source/Module/Rule/Rule.psm1 b/source/Module/Rule/Rule.psm1 index 42c44db1c..bc2597efb 100644 --- a/source/Module/Rule/Rule.psm1 +++ b/source/Module/Rule/Rule.psm1 @@ -43,6 +43,7 @@ foreach ($supportFile in $supportFileList) class Rule : ICloneable { [string] $Id + [string] $LegacyId [string] $Title [severity] $Severity [status] $ConversionStatus @@ -102,6 +103,7 @@ class Rule : ICloneable { # This relaces the current Invokeclass method $this.Id = $Rule.Id + $this.LegacyId = ($rule.Rule.ident | Where-Object -FilterScript {$PSItem.'#text' -match "^V-.*"}).'#text' $this.Title = $Rule.Title $this.Severity = $Rule.rule.severity $this.Description = $Rule.rule.description diff --git a/source/StigData/Processed/IISServer-10.0-2.1.xml b/source/StigData/Processed/IISServer-10.0-2.1.xml index e0c1a97ea..c883cb351 100644 --- a/source/StigData/Processed/IISServer-10.0-2.1.xml +++ b/source/StigData/Processed/IISServer-10.0-2.1.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>Logging onto a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used. @@ -6,6 +6,7 @@ An alternative to remote administration of the web server is to perform web server administration locally at the console. Local administration at the console implies physical access to the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100103 False If web administration is performed at the console, this check is NA. @@ -38,6 +39,7 @@ If remote management is utilized and does not meet the criteria listed above, th The web server contains a minimal user management function, but the web server user management function does not offer enterprise-wide user management, and user management is not the primary function of the web server. User management for the hosted applications should be done through a facility built for enterprise-wide user management, such as LDAP and Active Directory.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100119 False Interview the System Administrator about the role of the IIS 10.0 web server. @@ -56,6 +58,7 @@ If the IIS 10.0 web server is hosting an application and the SA cannot provide s The web server must provide the capability to disable, uninstall, or deactivate functionality and services deemed non-essential to the web server mission or that adversely impact server performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100121 False Click “Start”. @@ -74,6 +77,7 @@ Note: If additional software is needed, supporting documentation must be signed <VulnDiscussion>As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. This is in addition to the anonymous web user account. The resources to which these accounts have access must also be closely monitored and controlled. Only the SA needs access to all the system’s capabilities, while the web administrator and associated staff require access and control of the web content and web server configuration files. The anonymous web user account must not have access to system resources as that account could then control the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100139 False Obtain a list of the user accounts with access to the system, including all local and domain accounts. @@ -96,6 +100,7 @@ If this IIS 10 installation is supporting Microsoft Exchange, and not otherwise When the web server does not offer a method to roll back to a clean baseline, external methods, such as a baseline snapshot or virtualizing the web server, can be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100147 False Interview the System Administrator for the IIS 10.0 web server. @@ -108,6 +113,7 @@ If documentation for a disaster recovery has not been established, this is a fin <VulnDiscussion>The indexing service can be used to facilitate a search function for websites. Enabling indexing may facilitate a directory traversal exploit and reveal unwanted information to a malicious user. Indexing must be limited to web document directories only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100153 False Access the IIS 10.0 Web Server. @@ -128,6 +134,7 @@ If so, this is a finding. <VulnDiscussion>Logging into a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100157 False If web administration is performed at the console, this check is NA. @@ -162,6 +169,7 @@ The web server must provide a capability to disconnect users to a hosted applica The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100161 False Interview the System Administrator and Web Manager. @@ -192,6 +200,7 @@ If the web server is not capable or cannot be configured to disconnect or disabl The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100165 False Open the IIS 10.0 Manager. @@ -222,6 +231,7 @@ The key web service administrative and configuration tools must only be accessib Satisfies: SRG-APP-000380-WSR-000072, SRG-APP-000435-WSR-000147, SRG-APP-000033-WSR-000169</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100167 False Right-click "InetMgr.exe", then click "Properties" from the "Context" menu. @@ -257,6 +267,7 @@ If any other access is observed, this is a finding. The web server must provide the capability to disable or deactivate network-related services deemed non-essential to the server mission, are too unsecure, or are prohibited by the PPSM CAL and vulnerability assessments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100169 False Review programs installed on the OS. @@ -281,6 +292,7 @@ Note: If additional software is needed and has supporting documentation signed b <VulnDiscussion>A Denial of Service (DoS) can occur when the web server is overwhelmed and can no longer respond to additional requests. A web server not properly tuned may become overwhelmed and cause a DoS condition even with expected traffic from users. To avoid a DoS, the web server must be tuned to handle the expected traffic for the hosted applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100173 False If the IIS 10.0 web server is not hosting any applications, this is Not Applicable. @@ -310,6 +322,7 @@ If explicit settings are not configured for "URIEnableCache", "UriMaxUriBytes" a NIST SP 800-52 defines the approved TLS versions for government applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100179 False Review the web server documentation and deployed configuration to determine which version of TLS is being used. @@ -320,6 +333,7 @@ If the TLS version is not TLS 1.2 or higher, according to NIST SP 800-52, or if <VulnDiscussion>Anonymous SMTP relays are strictly prohibited. An anonymous SMTP relay can be a vector for many types of malicious activity not limited to server exploitation for the sending of SPAM mail, access to emails, phishing, DoS attacks, etc. Enabling TLS, authentication, and strictly assigning IP addresses that can communicate with the relay greatly reduce the risk of the implementation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-102895 False Interview the System Administrator about the role of the IIS 10.0 web server. @@ -344,6 +358,7 @@ Without sufficient information establishing when the log event occurred, investi Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000097-WSR-000059</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100105 Date,Time,ClientIP,UserName,Method,UriQuery,HttpStatus,Referer @@ -371,6 +386,7 @@ In IIS 10.0, the administrator has the option of sending logging information to Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166, SRG-APP-000358-WSR-000063</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100107 @@ -396,6 +412,7 @@ Ascertaining the success or failure of an event is important during forensic ana Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100111 RequestHeader @@ -430,6 +447,7 @@ Determining user accounts, processes running on behalf of the user, and running Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100113 RequestHeader @@ -467,6 +485,7 @@ Ascertaining the correct source (e.g., source IP), of the events is important du A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every loggable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100109 False Interview the System Administrator to review the configuration of the IIS 10.0 architecture and determine if inbound web traffic is passed through a proxy. @@ -497,6 +516,7 @@ If provisions have been made to log the client IP via another field (i.e., utili Satisfies: SRG-APP-000120-WSR-000070, SRG-APP-000118-WSR-000068, SRG-APP-000118-WSR-000069</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100115 False This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. @@ -515,6 +535,7 @@ Administrators - Full Control <VulnDiscussion>Protection of log data includes ensuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system, or onto separate media than the system on which the web server is running, helps to ensure the log records will be retained in the event of a catastrophic system failure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100117 False The IIS 10.0 web server and website log files should be backed up by the system backup. @@ -540,6 +561,7 @@ If the paths of all log files are not part of the system backup and/or not backe <VulnDiscussion>A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that also proxy requests into an otherwise protected network is a common attack, making the attack anonymous.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100123 False Open the IIS 10.0 Manager. @@ -560,6 +582,7 @@ If “Enable proxy" is selected under the "Application Request Routing" settings <VulnDiscussion>Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally necessary (i.e., compiled code, scripts, web content, etc.). Delete all directories containing samples and any scripts used to execute the samples.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100125 False Navigate to the following folders: @@ -578,6 +601,7 @@ These accounts become inactive, are not monitored through regular use, and passw The accounts used for web server features not installed must not be created and must be deleted when these features are uninstalled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100127 False Access the IIS 10.0 web server. @@ -596,6 +620,7 @@ If any local accounts are present and were created by features which have been u Individual productivity tools have no legitimate place or use on an enterprise production web server and are prone to security risks. The web server installation process must provide options allowing the installer to choose which utility programs, services, and modules are to be installed or removed. By having a process for installation and removal, the web server is guaranteed to be in a more stable and secure state than if these services and programs were installed and removed manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100129 False Consult with the System Administrator and review all of the IIS 10.0 and Operating System features installed. @@ -610,6 +635,7 @@ If any unnecessary Operating System features are installed, this is a finding.<VulnDiscussion>This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the website to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance the use of the certificate is valid, and therefore; the entire purpose of using a certificate is compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100135 False Open the IIS 10.0 Manager. @@ -630,6 +656,7 @@ Some mobile code technologies in use in today's applications are: Java, JavaScri Source code for a Java program is often stored in files with either .java or .jpp file extensions. From the .java and .jpp files the Java compiler produces a binary file with an extension of .class. The .java or .jpp file could therefore reveal sensitive information regarding an application's logic and permissions to resources on the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100137 False Search the system for files with either .java or .jpp extensions. @@ -642,6 +669,7 @@ If files with .java or .jpp extensions are found, this is a finding. By moving the management functionality, the possibility of accidental discovery of the management functions by non-privileged users during hosted application use is minimized.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100141 False Review the IIS 10.0 web server configuration with the System Administrator. @@ -662,6 +690,7 @@ If the IIS 10.0 web server management and the application's management functiona A web server can be accessed remotely and must be capable of restricting access from what the DoD defines as non-secure zones. Non-secure zones are defined as any IP, subnet, or region defined as a threat to the organization. The non-secure zones must be defined for public web servers logically located in a DMZ, as well as private web servers with perimeter protection devices. By restricting access from non-secure zones through internal web server access lists, the web server can stop or slow denial of service (DoS) attacks on the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100159 False Note: This requirement applies to the Web Management Service. If the Web Management Service is not installed, this is Not Applicable. @@ -684,6 +713,7 @@ If "IP Address Restrictions" are not configured or IP ranges configured to "Allo <VulnDiscussion>The use of IPP on an IIS web server allows client access to shared printers. This privileged access could allow remote code execution by increasing the web servers attack surface. Additionally, since IPP does not support SSL, it is considered a risk and will not be deployed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100171 False If the Print Services role and the Internet Printing role are not installed, this check is Not Applicable. @@ -710,6 +740,7 @@ The first things an attacker will try when presented with a logon screen are the Service accounts or system accounts that have no logon capability do not need to have passwords set or changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100181 False Access the IIS 10.0 web server. @@ -728,6 +759,7 @@ If passwords have not been changed from the default, this is a finding.<VulnDiscussion>Authorization rules can be configured at the server, website, folder (including Virtual Directories), or file level. It is recommended that URL Authorization be configured to only grant access to the necessary security principals. Configuring a global Authorization rule that restricts access ensures inheritance of the settings down through the hierarchy of web directories. This will ensure access to current and future content is only granted to the appropriate principals, mitigating risk of unauthorized access. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100185 False Open the IIS 10.0 Manager. @@ -744,6 +776,7 @@ If .NET is not installed, this is Not Applicable. <VulnDiscussion>Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service (DoS) attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100187 False Access the IIS 10.0 IIS Manager. @@ -765,6 +798,7 @@ If the maxconnections parameter is set to zero, this is a finding. <VulnDiscussion>HTTP Strict Transport Security (HSTS) ensures browsers always connect to a website over TLS. HSTS exists to remove the need for redirection configurations. HSTS relies on the browser, web server, and a public "Whitelist". If the browser does not support HSTS, it will be ignored.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100189 False Access the IIS 10.0 Web Server. @@ -797,6 +831,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .exe False + V-100131 application/octet-stream False @@ -818,6 +853,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .dll False + V-100131 application/x-msdownload False @@ -839,6 +875,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .com False + V-100131 application/octet-stream False @@ -860,6 +897,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .bat False + V-100131 application/x-bat False @@ -881,6 +919,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .csh False + V-100131 application/x-csh False @@ -963,6 +1002,7 @@ If any OS shell MIME types are configured, this is a finding. True False + V-100163 False %SystemDrive%\inetpub @@ -992,6 +1032,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server + V-100177.a False Access the IIS 10.0 Web Server. @@ -1028,6 +1069,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server + V-100177.b False Access the IIS 10.0 Web Server. @@ -1064,6 +1106,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server + V-100177.c False Access the IIS 10.0 Web Server. @@ -1100,6 +1143,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server + V-100177.d False Access the IIS 10.0 Web Server. @@ -1136,6 +1180,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server + V-100177.e False Access the IIS 10.0 Web Server. @@ -1172,6 +1217,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server + V-100177.f False Access the IIS 10.0 Web Server. @@ -1208,6 +1254,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server + V-100177.g False Access the IIS 10.0 Web Server. @@ -1244,6 +1291,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server + V-100177.h False Access the IIS 10.0 Web Server. @@ -1280,6 +1328,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server + V-100177.i False Access the IIS 10.0 Web Server. @@ -1322,6 +1371,7 @@ Satisfies: SRG-APP-000223-WSR-000011, SRG-APP-000220-WSR-000201</VulnDiscussi False cookieless + V-100143 False Open the IIS 10.0 Manager. @@ -1349,6 +1399,7 @@ When using the URI mode for cookie settings under session state, IIS will reject False timeout + V-100145 True '{0}' -le '00:20:00' Under Time-out (in minutes), verify “20 minutes or less” is selected. @@ -1363,6 +1414,7 @@ When using the URI mode for cookie settings under session state, IIS will reject V-218804 False cookieless + V-100145 False From the "Section:" drop-down list at the top of the configuration editor, locate "system.web/sessionState". @@ -1375,6 +1427,7 @@ Verify the "cookieless" is set to "UseCookies". False validation + V-100149 False Open the IIS 10.0 Manager. @@ -1391,6 +1444,7 @@ Verify "HMACSHA256" False decryption + V-100149 False Open the IIS 10.0 Manager. @@ -1407,6 +1461,7 @@ If .NET is not installed, this is Not Applicable. False enabled + V-100151 False Open the IIS 10.0 Manager. @@ -1426,6 +1481,7 @@ If “Directory Browsing” is not disabled, this is a finding. False errormode + V-100155 False Open the IIS 10.0 Manager. @@ -1445,6 +1501,7 @@ If the feature setting is not set to “Detailed errors for local requests and c False keepSessionIdSecure + V-100175 False Open the IIS 10.0 Manager. @@ -1468,6 +1525,7 @@ If the "keepSessionIdSecure" is not set to "True", this is a finding. False notListedCgisAllowed + V-100183 False Open the IIS 10.0 Manager. @@ -1483,6 +1541,7 @@ Verify the "Allow unspecified CGI modules" check box is not checked False notListedIsapisAllowed + V-100183 False Open the IIS 10.0 Manager. @@ -1501,6 +1560,7 @@ WebDAV is not widely used and has serious security concerns because it may allow Absent False + V-100133 Web-DAV-Publishing False diff --git a/source/StigData/Processed/IISServer-8.5-2.1.xml b/source/StigData/Processed/IISServer-8.5-2.1.xml index 822f454cd..f7b1ee70f 100644 --- a/source/StigData/Processed/IISServer-8.5-2.1.xml +++ b/source/StigData/Processed/IISServer-8.5-2.1.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>Logging onto a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used. @@ -6,6 +6,7 @@ An alternative to remote administration of the web server is to perform web server administration locally at the console. Local administration at the console implies physical access to the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76679 False If web administration is performed at the console, this check is NA. @@ -38,6 +39,7 @@ If remote management is utilized and does not meet the criteria listed above, th The web server contains a minimal user management function, but the web server user management function does not offer enterprise-wide user management, and user management is not the primary function of the web server. User management for the hosted applications should be done through a facility that is built for enterprise-wide user management, like LDAP and Active Directory.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76699 False Interview the System Administrator about the role of the IIS 8.5 web server. @@ -56,6 +58,7 @@ If the IIS 8.5 web server is hosting an application and the SA cannot provide su The web server must provide the capability to disable, uninstall, or deactivate functionality and services that are deemed to be non-essential to the web server mission or can adversely impact server performance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76701 False Click on “Start”. @@ -74,6 +77,7 @@ Note: If additional software is needed supporting documentation must be signed b <VulnDiscussion>As a rule, accounts on a web server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the web server. This is in addition to the anonymous web user account. The resources to which these accounts have access must also be closely monitored and controlled. Only the SA needs access to all the system’s capabilities, while the web administrator and associated staff require access and control of the web content and web server configuration files. The anonymous web user account must not have access to system resources as that account could then control the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76719 False Obtain a list of the user accounts with access to the system, including all local and domain accounts. @@ -94,6 +98,7 @@ If undocumented non-administrator access to shell scripts and operating system f When the web server does not offer a method to roll back to a clean baseline, external methods, such as a baseline snapshot or virtualizing the web server, can be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76729 False Interview the System Administrator for the IIS 8.5 web server. @@ -106,6 +111,7 @@ If documentation for a disaster recovery has not been established, this is a fin <VulnDiscussion>The indexing service can be used to facilitate a search function for websites. Enabling indexing may facilitate a directory traversal exploit and reveal unwanted information to a malicious user. Indexing must be limited to web document directories only.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76735 False Access the IIS 8.5 Web Server. @@ -126,6 +132,7 @@ If so, this is a finding. <VulnDiscussion>Logging into a web server remotely using an unencrypted protocol or service when performing updates and maintenance is a major risk. Data, such as user account, is transmitted in plaintext and can easily be compromised. When performing remote administrative tasks, a protocol or service that encrypts the communication channel must be used.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76739 False If web administration is performed at the console, this check is Not Applicable. @@ -160,6 +167,7 @@ The web server must provide a capability to disconnect users to a hosted applica The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76743 False Interview the System Administrator and Web Manager. @@ -190,6 +198,7 @@ If the web server is not capable of or cannot be configured to disconnect or dis The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76747 False Open the IIS 8.5 Manager. @@ -220,6 +229,7 @@ The key web service administrative and configuration tools must only be accessib Satisfies: SRG-APP-000380-WSR-000072, SRG-APP-000435-WSR-000147, SRG-APP-000033-WSR-000169</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76749 False Right-click InetMgr.exe, then click “Properties” from the “Context” menu. @@ -253,6 +263,7 @@ If any other access is observed, this is a finding. The web server must provide the capability to disable or deactivate network-related services that are deemed to be non-essential to the server mission, are too unsecure, or are prohibited by the PPSM CAL and vulnerability assessments.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76751 False Review programs installed on the OS. @@ -277,6 +288,7 @@ Note: If additional software is needed and has supporting documentation signed b <VulnDiscussion>A Denial of Service (DoS) can occur when the web server is so overwhelmed that it can no longer respond to additional requests. A web server not properly tuned may become overwhelmed and cause a DoS condition even with expected traffic from users. To avoid a DoS, the web server must be tuned to handle the expected traffic for the hosted applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76755 False If the IIS 8.5 web server is not hosting any applications, this is Not Applicable. @@ -306,6 +318,7 @@ If explicit settings are not configured for "URIEnableCache", "UriMaxUriBytes" a NIST SP 800-52 defines the approved TLS versions for government applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76761 False Review the web server documentation and deployed configuration to determine which version of TLS is being used. @@ -316,6 +329,7 @@ If the TLS version is not TLS 1.2 or higher, according to NIST SP 800-52, or if <VulnDiscussion>Anonymous SMTP relays are strictly prohibited. An anonymous SMTP relay can be a vector for many types of malicious activity not limited to server exploitation for the sending of SPAM mail, access to emails, phishing, DoS attacks, etc. Enabling TLS, authentication, and strictly assigning IP addresses that can communicate with the relay greatly reduce the risk of the implementation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-102893 False Interview the System Administrator about the role of the IIS 8.5 web server. @@ -340,6 +354,7 @@ Without sufficient information establishing when the log event occurred, investi Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000097-WSR-000059</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76681 Date,Time,ClientIP,UserName,Method,UriQuery,HttpStatus,Referer @@ -367,6 +382,7 @@ In IIS 8.5, the administrator has the option of sending logging information to E Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166, SRG-APP-000358-WSR-000063</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76683 @@ -392,6 +408,7 @@ Ascertaining the success or failure of an event is important during forensic ana Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76687 RequestHeader @@ -435,6 +452,7 @@ Determining user accounts, processes running on behalf of the user, and running Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76689 RequestHeader @@ -473,6 +491,7 @@ Ascertaining the correct source, e.g. source IP, of the events is important duri A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every logable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76685 False Interview the System Administrator to review the configuration of the IIS 8.5 architecture and determine if inbound web traffic is passed through a proxy. @@ -501,6 +520,7 @@ If provisions have been made to log the client IP via another field (i.e., utili <VulnDiscussion>A major tool in exploring the website use, attempted use, unusual conditions, and problems are the access and error logs. In the event of a security incident, these logs can provide the SA and the web manager with valuable information. Failure to protect log files could enable an attacker to modify the log file data or falsify events to mask an attacker's activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76695 False This check does not apply to service account IDs utilized by automated services necessary to process, manage, and store log files. @@ -524,6 +544,7 @@ If log access is not restriced as listed above, this is a finding. <VulnDiscussion>Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up log records to an unrelated system or onto separate media than the system the web server is actually running on helps to assure that, in the event of a catastrophic system failure, the log records will be retained.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76697 False The IIS 8.5 web server and website log files should be backed up by the system backup. @@ -550,6 +571,7 @@ If the paths of all log files are not part of the system backup and/or not backe <VulnDiscussion>A web server should be primarily a web server or a proxy server but not both, for the same reasons that other multi-use servers are not recommended. Scanning for web servers that will also proxy requests into an otherwise protected network is a very common attack making the attack anonymous.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76703 False Open the IIS 8.5 Manager. @@ -570,6 +592,7 @@ If “Enable proxy" is selected under the "Application Request Routing" settings <VulnDiscussion>Web server documentation, sample code, example applications, and tutorials may be an exploitable threat to a web server. A production web server may only contain components that are operationally necessary (i.e., compiled code, scripts, web content, etc.). Delete all directories containing samples and any scripts used to execute the samples.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76705 False Navigate to the following folders: @@ -588,6 +611,7 @@ These accounts become inactive, are not monitored through regular use, and passw The accounts used for web server features not installed must not be created and must be deleted when these features are uninstalled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76707 False Access the IIS 8.5 web server. @@ -606,6 +630,7 @@ If any local accounts are present and were created by features which have been u Individual productivity tools have no legitimate place or use on an enterprise, production web server and they are also prone to their own security risks. The web server installation process must provide options allowing the installer to choose which utility programs, services, and modules are to be installed or removed. By having a process for installation and removal, the web server is guaranteed to be in a more stable and secure state than if these services and programs were installed and removed manually.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76709 False Consult with the System Administrator and review all of the IIS 8.5 and Operating System features installed. @@ -620,6 +645,7 @@ If any unnecessary Operating System features are installed, this is a finding.<VulnDiscussion>This check verifies the server certificate is actually a DoD-issued certificate used by the organization being reviewed. This is used to verify the authenticity of the website to the user. If the certificate is not issued by the DoD or if the certificate has expired, then there is no assurance the use of the certificate is valid. The entire purpose of using a certificate is, therefore, compromised.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76715 False Open the IIS 8.5 Manager. @@ -636,6 +662,7 @@ Some mobile code technologies in use in today's applications are: Java, JavaScri Source code for a Java program is, many times, stored in files with either .java or .jpp file extensions. From the .java and .jpp files the Java compiler produces a binary file with an extension of .class. The .java or .jpp file could therefore reveal sensitive information regarding an application's logic and permissions to resources on the server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76717 False Search the system for files with either .java or .jpp extensions. @@ -648,6 +675,7 @@ If files with .java or .jpp extensions are found, this is a finding. By moving the management functionality, the possibility of accidental discovery of the management functions by non-privileged users during hosted application use is minimized.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76721 False Review the IIS 8.5 web server configuration with the System Administrator. @@ -666,6 +694,7 @@ If the IIS 8.5 web server management and the application's management functional A web server can be accessed remotely and must be capable of restricting access from what the DoD defines as nonsecure zones. Nonsecure zones are defined as any IP, subnet, or region that is defined as a threat to the organization. The nonsecure zones must be defined for public web servers logically located in a DMZ, as well as private web servers with perimeter protection devices. By restricting access from nonsecure zones, through internal web server access list, the web server can stop or slow denial of service (DoS) attacks on the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76741 False Note: This requirement applies to the Web Management Service. If the Web Management Service is not installed, this is Not Applicable. @@ -688,6 +717,7 @@ If "IP Address Restrictions" are not configured or IP ranges configured to be "A <VulnDiscussion>The use of Internet Printing Protocol (IPP) on an IIS web server allows client’s access to shared printers. This privileged access could allow remote code execution by increasing the web servers attack surface. Additionally, since IPP does not support SSL, it is considered a risk and will not be deployed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76753 False If the Print Services role and the Internet Printing role are not installed, this check is Not Applicable. @@ -714,6 +744,7 @@ The first things an attacker will try when presented with a logon screen are the Service accounts or system accounts that have no logon capability do not need to have passwords set or changed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76765 False Access the IIS 8.5 web server. @@ -732,6 +763,7 @@ If passwords have not been changed from the default, this is a finding.<VulnDiscussion>Authorization rules can be configured at the server, website, folder (including Virtual Directories), or file level. It is recommended that URL Authorization be configured to only grant access to the necessary security principals. Configuring a global Authorization rule that restricts access ensures inheritance of the settings down through the hierarchy of web directories. This will ensure access to current and future content is only granted to the appropriate principals, mitigating risk of unauthorized access.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76771 False Open the IIS 8.5 Manager. @@ -750,6 +782,7 @@ If the server is hosting WSUS, this is Not Applicable. <VulnDiscussion>Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a Denial of Service attack. Mitigating this kind of attack will include limiting the number of concurrent HTTP/HTTPS requests per IP address and may include, where feasible, limiting parameter values associated with keepalive (i.e., a parameter used to limit the amount of time a connection may be inactive).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-95633 False Access the IIS 8.5 IIS Manager. @@ -779,6 +812,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .exe False + V-76711 application/octet-stream False @@ -800,6 +834,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .dll False + V-76711 application/x-msdownload False @@ -821,6 +856,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .com False + V-76711 application/octet-stream False @@ -842,6 +878,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .bat False + V-76711 application/x-bat False @@ -863,6 +900,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .csh False + V-76711 application/x-csh False @@ -945,6 +983,7 @@ If any OS shell MIME types are configured, this is a finding. True False + V-76745 False %SystemDrive%\inetpub @@ -973,6 +1012,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server + V-76759.a False Access the IIS 8.5 Web Server. @@ -1010,6 +1050,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server + V-76759.b False Access the IIS 8.5 Web Server. @@ -1047,6 +1088,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server + V-76759.c False Access the IIS 8.5 Web Server. @@ -1084,6 +1126,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server + V-76759.d False Access the IIS 8.5 Web Server. @@ -1121,6 +1164,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server + V-76759.e False Access the IIS 8.5 Web Server. @@ -1158,6 +1202,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server + V-76759.f False Access the IIS 8.5 Web Server. @@ -1195,6 +1240,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server + V-76759.g False Access the IIS 8.5 Web Server. @@ -1232,6 +1278,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server + V-76759.h False Access the IIS 8.5 Web Server. @@ -1269,6 +1316,7 @@ NIST SP 800-52 specifies the preferred configurations for government systems.< Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server + V-76759.i False Access the IIS 8.5 Web Server. @@ -1308,6 +1356,7 @@ Cookies associate session information with client information for the duration o False cookieless + V-76725 False Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable. @@ -1336,6 +1385,7 @@ Cookies associate session information with client information for the duration o V-214419 False cookieless + V-76727 False Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable. @@ -1359,6 +1409,7 @@ Cookies associate session information with client information for the duration o False timeout + V-76727 True '{0}' -le '00:20:00' Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does not allow users to connect to interface, and is restricted to specific system IPs, this is Not Applicable. @@ -1380,6 +1431,7 @@ If the "Use Cookies” mode is selected and Time-out (in minutes) is configured False validation + V-76731 False If .NET is not installed, this is Not Applicable. @@ -1396,6 +1448,7 @@ Verify "HMACSHA256" False decryption + V-76731 False If .NET is not installed, this is Not Applicable. @@ -1412,6 +1465,7 @@ If "HMACSHA256" or stronger encryption is not selected for the Validation method False enabled + V-76733 False If the Directory Browsing IIS Feature is disabled, this is Not Applicable. @@ -1430,6 +1484,7 @@ If “Directory Browsing” is not disabled, this is a finding. False errormode + V-76737 False Open the IIS 8.5 Manager. @@ -1449,6 +1504,7 @@ If the feature setting is not set to “Detailed errors for local requests and c False keepSessionIdSecure + V-76757 False Open the IIS 8.5 Manager. @@ -1472,6 +1528,7 @@ If the "keepSessionIdSecure" is not set to "True", this is a finding. False notListedCgisAllowed + V-76769 False Open the IIS 8.5 Manager. @@ -1487,6 +1544,7 @@ Verify the "Allow unspecified CGI modules" check box is not checked False notListedIsapisAllowed + V-76769 False Open the IIS 8.5 Manager. @@ -1505,6 +1563,7 @@ WebDAV is not widely used and has serious security concerns because it may allow Absent False + V-76713 Web-DAV-Publishing False diff --git a/source/StigData/Processed/IISSite-10.0-2.1.xml b/source/StigData/Processed/IISSite-10.0-2.1.xml index 6d542c110..2d8e799b8 100644 --- a/source/StigData/Processed/IISSite-10.0-2.1.xml +++ b/source/StigData/Processed/IISSite-10.0-2.1.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>IIS 10.0 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 10.0, Request Filtering and Handler Mappings. @@ -6,6 +6,7 @@ For Handler Mappings, the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 8. Handler Mappings at the site level take precedence over Handler Mappings at the server level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100209 False For Handler Mappings, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 10.0. Handler Mappings at the site level take precedence over Handler Mappings at the server level. @@ -24,6 +25,7 @@ If any script file extensions from the black list are enabled, this is a finding For Request Filtering, the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the Request Filtering in IIS 10.0. Request Filtering at the site level take precedence over Request Filtering at the server level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100211 False For Request Filtering, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Request Filtering in IIS 10.0. Request Filtering at the site level take precedence over Request Filtering at the server level. @@ -44,6 +46,7 @@ If any script file extensions from the black list are not denied, this is a find Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100217 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -70,6 +73,7 @@ The web server must provide a capability to disconnect users to a hosted applica The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100249 False Interview the System Administrator and Web Manager. @@ -100,6 +104,7 @@ If there are not documented procedures with, at a minimum, the mentioned steps f The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100251 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -130,6 +135,7 @@ Failure to comply with DoD ports, protocols, and services (PPS) requirements can The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, PPSM, and the associated PPS Assurance Category Assignments List.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100253 False Review the website to determine if HTTP and HTTPs (e.g., 80 and 443) are used in accordance with those ports and services registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM. @@ -154,6 +160,7 @@ In IIS 10.0, the administrator has the option of sending logging information to Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100199 @@ -184,6 +191,7 @@ Ascertaining the success or failure of an event is important during forensic ana Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100203 RequestHeader @@ -226,6 +234,7 @@ Determining user accounts, processes running on behalf of the user, and running Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100205 RequestHeader @@ -272,6 +281,7 @@ Ascertaining the correct source (e.g., source IP), of the events is important du A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every loggable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100201 False Interview the System Administrator to review the configuration of the IIS 10.0 architecture and determine if inbound web traffic is passed through a proxy. @@ -300,6 +310,7 @@ If provisions have been made to log the client IP via another field (i.e., utili <VulnDiscussion>Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data stored on the web server must be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100221 False Check the account used for anonymous access to the website. @@ -349,6 +360,7 @@ If the IUSR account or any account noted above used for anonymous access is a me <VulnDiscussion>The web document (home) directory is accessed by multiple anonymous users when the web server is in production. By locating the web document (home) directory on the same partition as the web server system file, the risk for unauthorized access to these protected files is increased. Additionally, having the web document (home) directory path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100225 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -369,6 +381,7 @@ Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not ot <VulnDiscussion>The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100255 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -395,6 +408,7 @@ If HTTPS is not an available type under site bindings, and the Web Server ONLY c <VulnDiscussion>Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100263 False Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -413,6 +427,7 @@ If any Application Pools are being used for more than one website, this is a fin <VulnDiscussion>CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the System Administrator (SA) control over what goes into those folders and to facilitate access control at the folder level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100279 False Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vbs, .class, .c, .php, and .asp. @@ -433,6 +448,7 @@ If scripts are not segregated from web content and in their own unique folders, The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the System Administrator (SA) or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100281 False Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, and .asp. @@ -465,6 +481,7 @@ If the permissions are less restrictive than listed above, this is a finding.<VulnDiscussion>Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100283 False Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx. The scope of this requirement is to analyze only within the web server content directories, not the entire underlying operating system. @@ -485,6 +502,7 @@ If files with these extensions are found, this is a finding. <VulnDiscussion>A consent banner will be in place to inform prospective entrants the website they are about to enter is a DoD website and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100285 False Note: This requirement is only applicable for private DoD websites. @@ -527,6 +545,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .exe False + V-100207 application/octet-stream False @@ -549,6 +568,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .dll False + V-100207 application/x-msdownload False @@ -571,6 +591,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .com False + V-100207 application/octet-stream False @@ -593,6 +614,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .bat False + V-100207 application/x-bat False @@ -615,6 +637,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .csh False + V-100207 application/x-csh False @@ -635,6 +658,7 @@ If any OS shell MIME types are configured, this is a finding. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100195 False Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable. @@ -657,6 +681,7 @@ If the "Require SSL" check box is not selected, this is a finding. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-218737 False + V-100197 False Note: If the server being reviewed is a private IIS 10.0 web server, this is Not Applicable. @@ -680,6 +705,7 @@ If the "Require SSL" check box is not selected, this is a finding. Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100219 False Note: If the server being reviewed is a public IIS 10.0 web server, this is Not Applicable. @@ -702,6 +728,7 @@ If the "Clients Certificate Required" check box is not selected, this is a findi Satisfies: SRG-APP-000429-WSR-000113, SRG-APP-000439-WSR-000151, SRG-APP-000441-WSR-000181, SRG-APP-000442-WSR-000182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-100257 False Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 10.0 server, and the IIS 10.0 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server. @@ -737,6 +764,7 @@ By default, the World Wide Web (WWW) service establishes an overlapped recycle, False idleTimeout + V-100245 True [TimeSpan]{0} -le [TimeSpan]'00:20:00' -and [TimeSpan]{0} -gt [TimeSpan]'00:00:00' Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -755,6 +783,7 @@ If the "Idle Time-out" is set to "0", this is a finding. False restartRequestsLimit + V-100265 True {0} -ne 0 Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -780,6 +809,7 @@ If the "Request Limit" is set to a value of "0", this is a finding. False restartMemoryLimit + V-100267 True {0} -ne 0 Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -805,6 +835,7 @@ If the value for "Virtual Memory Limit" is set to "0", this is a finding. False restartPrivateMemoryLimit + V-100269 True {0} -ne 0 Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -830,6 +861,7 @@ If the "Private Memory Limit" is set to a value of "0", this is a finding. False logEventOnRecycle + V-100271 False Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -856,6 +888,7 @@ If both the "Regular time interval" and "Specific time" options are not set to " False pingingEnabled + V-100273 False Open the Internet Information Services (IIS) Manager. @@ -876,6 +909,7 @@ If the value for "Ping Enabled" is not set to "True", this is a finding. False rapidFailProtection + V-100275 False Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -900,6 +934,7 @@ If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.< False rapidFailProtectionInterval + V-100277 True [TimeSpan]{0} -le [TimeSpan]'00:05:00' Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -932,6 +967,7 @@ ASP.NET provides a session state, which is available as the HttpSessionState cla False mode + V-100191 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -973,6 +1009,7 @@ When using the URI mode for cookie settings under session state, IIS will reject False cookieless + V-100193 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1001,6 +1038,7 @@ The session ID generator must be a FIPS 140-2-approved generator.</VulnDiscus V-218735 False mode + V-100223 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1036,6 +1074,7 @@ If the system being reviewed is part of a Web Farm, interview the System Adminis False maxUrl + V-100227 True {0} -le 4096 Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1058,6 +1097,7 @@ If the "maxUrl" value is not set to "4096" or less, this is a finding. False maxAllowedContentLength + V-100229 True {0} -le 30000000 Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1080,6 +1120,7 @@ If the "maxAllowedContentLength" value is not explicitly set to "30000000" or le False maxQueryString + V-100231 True {0} -le 2048 Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1102,6 +1143,7 @@ If the "Maximum Query String" value is not set to "2048" or less, this is a find False allowHighBitCharacters + V-100233 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1125,6 +1167,7 @@ Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not ot False allowDoubleEscaping + V-100235 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1146,6 +1189,7 @@ If the "Allow double escaping" check box is checked, this is a finding. False allowUnlisted + V-100237 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1169,6 +1213,7 @@ Note: If this IIS 10.0 installation is supporting Microsoft Exchange, and not ot False enabled + V-100239 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1190,6 +1235,7 @@ If "Directory Browsing" is not "Disabled", this is a finding. False errormode + V-100241 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1211,6 +1257,7 @@ If any error message is not set to "Detailed errors for local requests and custo False debug + V-100243 False Note: If the ".NET feature" is not installed, this check is Not Applicable. @@ -1236,6 +1283,7 @@ Acceptable values are 5 minutes for high-value applications, 10 minutes for medi False timeout + V-100247 True '{0}' -le '00:20:00' Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1261,6 +1309,7 @@ If "timeout" is not set to "00:20:00 or less”, this is a finding. False keepSessionIdSecure + V-100259 False Follow the procedures below for each site hosted on the IIS 10.0 web server: @@ -1288,6 +1337,7 @@ Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439- False requireSSL + V-100261 False From the "Section:" drop-down list, select "system.web/httpCookies". @@ -1302,6 +1352,7 @@ Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439- False compressionEnabled + V-100261 False From the "Section:" drop-down list, select "system.web/sessionState". @@ -1317,6 +1368,7 @@ WebDAV is not widely used and has serious security concerns because it may allow Absent False + V-100213 Web-DAV-Publishing False diff --git a/source/StigData/Processed/IISSite-8.5-2.1.xml b/source/StigData/Processed/IISSite-8.5-2.1.xml index def20de87..1dfca8ea8 100644 --- a/source/StigData/Processed/IISSite-8.5-2.1.xml +++ b/source/StigData/Processed/IISSite-8.5-2.1.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>IIS 8.5 will either allow or deny script execution based on file extension. The ability to control script execution is controlled through two features with IIS 8.5, “Request Filtering” and "Handler Mappings". @@ -6,6 +6,7 @@ For "Request Filtering", the ISSO must document and approve all allowable file extensions the website allows (white list) and denies (black list) by the website. The white list and black list will be compared to the "Request Filtering" in IIS 8. "Request Filtering" at the site level take precedence over "Request Filtering" at the server level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76799 False For Handler Mappings, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Handler Mappings in IIS 8.5. Handler Mappings at the site level take precedence over Handler Mappings at the server level. @@ -26,6 +27,7 @@ By not specifying which files can and which files cannot be served to a user, th The web server must only allow hosted application file types to be served to a user and all other types must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76801 False For Request Filtering, the ISSO must document and approve all allowable scripts the website allows (white list) and denies (black list). The white list and black list will be compared to the Request Filtering in IIS 8.5. Request Filtering at the site level take precedence over Request Filtering at the server level. @@ -44,6 +46,7 @@ If any script file extensions from the black list are not denied, this is a find Accessing the hosted application through an IP address normally used for non-application functions opens the possibility of user access to resources, utilities, files, ports, and protocols that are protected on the desired application IP address.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76807 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -68,6 +71,7 @@ The web server must provide a capability to disconnect users to a hosted applica The web server capabilities used to disconnect or disable users from connecting to hosted applications and the web server must be documented to make certain that, during an attack, the proper action is taken to conserve connectivity to any other hosted application if possible and to make certain log data is conserved for later forensic analysis.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76843 False Interview the System Administrator and Web Manager. @@ -98,6 +102,7 @@ If there are not documented procedures with, at a minimum, the mentioned steps f The task of allocating log record storage capacity is usually performed during initial installation of the logging mechanism. The system administrator will usually coordinate the allocation of physical drive space with the web server administrator along with the physical location of the partition and disk. Refer to NIST SP 800-92 for specific requirements on log rotation and storage dependent on the impact of the web server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76845 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -128,6 +133,7 @@ Failure to comply with DoD ports, protocols, and services (PPS) requirements can The ISSM will ensure web servers are configured to use only authorized PPS in accordance with the Network Infrastructure STIG, DoD Instruction 8551.1, Ports, Protocols, and Services Management (PPSM), and the associated Ports, Protocols, and Services (PPS) Assurance Category Assignments List.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76847 False Review the website to determine if HTTP and HTTPs (e.g., 80 and 443) are used in accordance with those ports and services registered and approved for use by the DoD PPSM. Any variation in PPS will be documented, registered, and approved by the PPSM. @@ -154,6 +160,7 @@ Without sufficient information establishing when the log event occurred, investi Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000093-WSR-000053</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76783 Date,Time,ClientIP,UserName,Method,UriQuery,HttpStatus,Referer @@ -183,6 +190,7 @@ In IIS 8.5, the administrator has the option of sending logging information to E Satisfies: SRG-APP-000092-WSR-000055, SRG-APP-000108-WSR-000166</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76785 @@ -210,6 +218,7 @@ Ascertaining the success or failure of an event is important during forensic ana Without sufficient information establishing the success or failure of the logged event, investigation into the cause of event is severely hindered. The success or failure also provides a means to measure the impact of an event and help authorized personnel to determine the appropriate response. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to, time stamps, source and destination IP addresses, user/process identifiers, event descriptions, application-specific events, success/fail indications, file names involved, access control, or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76789 RequestHeader @@ -252,6 +261,7 @@ Determining user accounts, processes running on behalf of the user, and running Log record content that may be necessary to satisfy the requirement of this control includes: time stamps, source and destination addresses, user/process identifiers, event descriptions, success/fail indications, file names involved, and access control or flow control rules invoked.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76791 RequestHeader @@ -298,6 +308,7 @@ Ascertaining the correct source, e.g. source IP, of the events is important duri A web server behind a load balancer or proxy server, when not configured correctly, will record the load balancer or proxy server as the source of every logable event. When looking at the information forensically, this information is not helpful in the investigation of events. The web server must record with each event the client source of the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76787 False Interview the System Administrator to review the configuration of the IIS 8.5 architecture and determine if inbound web traffic is passed through a proxy. @@ -326,6 +337,7 @@ If provisions have been made to log the client IP via another field (i.e., utili <VulnDiscussion>Many of the security problems that occur are not the result of a user gaining access to files or data for which the user does not have permissions, but rather users are assigned incorrect permissions to unauthorized data. The files, directories, and data that are stored on the web server need to be evaluated and a determination made concerning authorized access to information and programs on the server. Only authorized users and administrative accounts will be allowed on the host server in order to maintain the web server, applications, and review the server operations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76811 False Check the account used for anonymous access to the website. @@ -379,6 +391,7 @@ By being able to guess session IDs, an attacker can easily perform a man-in-the- The session ID generator also needs to be a FIPS 140-2-approved generator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76813 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -411,6 +424,7 @@ If the system being reviewed is part of a Web Farm, interview the System Adminis <VulnDiscussion>The web document (home) directory is accessed by multiple anonymous users when the web server is in production. By locating the web document (home) directory on the same partition as the web server system file the risk for unauthorized access to these protected files is increased. Additionally, having the web document (home) directory path on the same drive as the system folders also increases the potential for a drive space exhaustion attack.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76815 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -429,6 +443,7 @@ If the Path is on the same partition as the OS, this is a finding. <VulnDiscussion>The use of a DoD PKI certificate ensures clients the private website they are connecting to is legitimate, and is an essential part of the DoD defense-in-depth strategy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76849 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -457,6 +472,7 @@ For systems with load balancers that perform SSL offloading, this is Not Applica <VulnDiscussion>Application pools isolate sites and applications to address reliability, availability, and security issues. Sites and applications may be grouped according to configurations, although each site will be associated with a unique application pool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76865 False Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -475,6 +491,7 @@ If any Application Pools are being used for more than one website, this is a fin <VulnDiscussion>CGI and ASP scripts represent one of the most common and exploitable means of compromising a web server. All CGI and ASP program files must be segregated into their own unique folder to simplify the protection of these files. ASP scripts must be placed into a unique folder only containing other ASP scripts. JAVA and other technology-specific scripts must also be placed into their own unique folders. The placement of CGI, ASP, or equivalent scripts to special folders gives the Web Manager or the SA control over what goes into those folders and to facilitate access control at the folder level.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76885 False Determine whether scripts are used on the web server for the target website. Common file extensions include, but are not limited to: .cgi, .pl, .vbs, .class, .c, .php, and .asp. @@ -495,6 +512,7 @@ If scripts are not segregated from web content and in their own unique folders, The use of CGI scripts represent one of the most common and exploitable means of compromising a web server. By definition, CGI scripts are executable by the operating system of the host server. While access control is provided via the web service, the execution of CGI programs is not limited unless the SA or the Web Manager takes specific measures. CGI programs can access and alter data files, launch other programs, and use the network.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76887 False Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx. @@ -526,6 +544,7 @@ If the permissions are less restrictive than listed above, this is a finding.<VulnDiscussion>Copies of backup files will not execute on the server, but they can be read by the anonymous user if special precautions are not taken. Such backup copies contain the same sensitive information as the actual script being executed and, as such, are useful to malicious users. Techniques and systems exist today to search web servers for such files and are able to exploit the information contained in them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76889 False Determine whether scripts are used on the web server for the subject website. Common file extensions include, but are not limited to: .cgi, .pl, .vb, .class, .c, .php, .asp, and .aspx. @@ -546,6 +565,7 @@ If files with these extensions are found, this is a finding. <VulnDiscussion>A consent banner will be in place to make prospective entrants aware that the website they are about to enter is a DoD web site and their activity is subject to monitoring. The document, DoDI 8500.01, establishes the policy on the use of DoD information systems. It requires the use of a standard Notice and Consent Banner and standard text to be included in user agreements. The requirement for the banner is for websites with security and access controls. These are restricted and not publicly accessible. If the website does not require authentication/authorization for use, then the banner does not need to be present. A manual check of the document root directory for a banner page file (such as banner.html) or navigation to the website via a browser can be used to confirm the information provided from interviewing the web staff.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76891 False Note: This requirement is only applicable for private DoD websites. @@ -588,6 +608,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .exe False + V-76797 application/octet-stream False @@ -610,6 +631,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .dll False + V-76797 application/x-msdownload False @@ -632,6 +654,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .com False + V-76797 application/octet-stream False @@ -654,6 +677,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .bat False + V-76797 application/x-bat False @@ -676,6 +700,7 @@ A shell is a program that serves as the basic interface between the user and the Absent .csh False + V-76797 application/x-csh False @@ -696,6 +721,7 @@ If any OS shell MIME types are configured, this is a finding. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76779 False Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable. @@ -720,6 +746,7 @@ If the "Require SSL" check box is not selected, this is a finding. NIST SP 800-52 specifies the preferred configurations for government systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-214446 False + V-76781 False Note: If the server being reviewed is a private IIS 8.5 web server, this is Not Applicable. @@ -741,6 +768,7 @@ If the "Require SSL" check box is not selected, this is a finding. Satisfies: SRG-APP-000172-WSR-000104, SRG-APP-000224-WSR-000135, SRG-APP-000427-WSR-000186</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76809 False Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable. @@ -767,6 +795,7 @@ If data is transmitted unencrypted, the data then becomes vulnerable to disclosu Also satisfies: SRG-APP-000439-WSR-000151</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-76851 False Note: If SSL is installed on load balancer/proxy server through which traffic is routed to the IIS 8.5 server, and the IIS 8.5 server receives traffic from the load balancer/proxy server, the SSL requirement must be met on the load balancer/proxy server. @@ -803,6 +832,7 @@ The web server must utilize approved encryption when receiving transmitted data. Also satisfies: SRG-APP-000442-WSR-000182</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-214480 False + V-76861 False Note: If the server being reviewed is a public IIS 8.5 web server, this is Not Applicable. @@ -836,6 +866,7 @@ By default, the World Wide Web (WWW) service establishes an overlapped recycle, False idleTimeout + V-76839 True [TimeSpan]{0} -le [TimeSpan]'00:20:00' -and [TimeSpan]{0} -gt [TimeSpan]'00:00:00' Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -855,6 +886,7 @@ If the "Idle Time-out" is set to "0", this is a finding. False restartRequestsLimit + V-76867 True {0} -ne 0 Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -880,6 +912,7 @@ If the "Request Limit" is set to a value of "0", this is a finding. False restartMemoryLimit + V-76869 True {0} -ne 0 Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -905,6 +938,7 @@ If the value for "Virtual Memory Limit" is set to "0", this is a finding. False restartPrivateMemoryLimit + V-76871 True {0} -ne 0 Note: If the IIS Application Pool is hosting Microsoft SharePoint, this is Not Applicable. @@ -930,6 +964,7 @@ If the "Private Memory Limit" is set to a value of "0", this is a finding. False logEventOnRecycle + V-76873 False Note: Recycling Application Pools can create an unstable environment in a 64-bit SharePoint environment. If operational issues arise, with supporting documentation from the ISSO this check can be downgraded to a Cat III. @@ -954,6 +989,7 @@ If both the "Regular time interval" and "Specific time" options are not set to " False queueLength + V-76875 True {0} -le 1000 Open the IIS 8.5 Manager. @@ -975,6 +1011,7 @@ If the "Queue Length" is set to "1000" or less, this is not a finding. False pingingEnabled + V-76877 False Open the Internet Information Services (IIS) Manager. @@ -995,6 +1032,7 @@ If the value for "Ping Enabled" is not set to "True", this is a finding. False rapidFailProtection + V-76879 False Open the IIS 8.5 Manager. @@ -1015,6 +1053,7 @@ If the "Rapid Fail Protection:Enabled" is not set to "True", this is a finding.< False rapidFailProtectionInterval + V-76881 True [TimeSpan]{0} -le [TimeSpan]'00:05:00' Open the IIS 8.5 Manager. @@ -1043,6 +1082,7 @@ ASP.NET provides a session state, which is available as the HttpSessionState cla False mode + V-76775 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1084,6 +1124,7 @@ Cookies associate session information with client information for the duration o False cookieless + V-76777 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1108,6 +1149,7 @@ Note: If IIS 8.5 server/site is used only for system-to-system maintenance, does False maxUrl + V-76817 True {0} -le 4096 Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1130,6 +1172,7 @@ If the "maxUrl" value is not set to "4096" or less, this is a finding. False maxAllowedContentLength + V-76819 True {0} -le 30000000 Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1153,6 +1196,7 @@ If the "maxAllowedContentLength" value is not explicitly set to "30000000" or le False maxQueryString + V-76821 True {0} -le 2048 Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1175,6 +1219,7 @@ If the "Maximum Query String" value is not set to "2048" or less, this is a find False allowHighBitCharacters + V-76823 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1196,6 +1241,7 @@ If the "Allow high-bit characters" check box is checked, this is a finding. False allowDoubleEscaping + V-76825 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1217,6 +1263,7 @@ If the "Allow double escaping" check box is checked, this is a finding. False allowUnlisted + V-76827 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1238,6 +1285,7 @@ If "Allow unlisted file name extensions" check box is checked, this is a finding False enabled + V-76829 False Note: If the Directory Browsing feature is not enabled, this is Not Applicable. @@ -1261,6 +1309,7 @@ If "Directory Browsing" is not "Disabled", this is a finding. False errormode + V-76835 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1282,6 +1331,7 @@ If any error message is not set to “Detailed errors for local requests and cus False debug + V-76837 False Note: If the ".NET feature" is not installed, this check is Not Applicable. @@ -1307,6 +1357,7 @@ Acceptable values are 5 minutes for high-value applications, 10 minutes for medi False timeout + V-76841 True '{0}' -le '00:20:00' Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1334,6 +1385,7 @@ If "timeout" is not set to "00:20:00 or less”, this is a finding. False keepSessionIdSecure + V-76855 False Follow the procedures below for each site hosted on the IIS 8.5 web server: @@ -1369,6 +1421,7 @@ Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439- False requireSSL + V-76859 False From the "Section:" drop-down list, select "system.web/httpCookies". @@ -1391,6 +1444,7 @@ Satisfies: SRG-APP-000439-WSR-000154, SRG-APP-000439-SSR-000155, SRG-APP-000439- False compressionEnabled + V-76859 False From the "Section:" drop-down list, select "system.web/sessionState". @@ -1406,6 +1460,7 @@ WebDAV is not widely used and has serious security concerns because it may allow Absent False + V-76803 Web-DAV-Publishing False diff --git a/source/StigData/Processed/Office-Outlook2016-2.1.xml b/source/StigData/Processed/Office-Outlook2016-2.1.xml index 43b76a61e..6bcdcb90b 100644 --- a/source/StigData/Processed/Office-Outlook2016-2.1.xml +++ b/source/StigData/Processed/Office-Outlook2016-2.1.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>The Uniform Resource Locator (URL) standard allows user authentication to be included in URL strings in the form http://username:password@example.com. A malicious user might use this URL syntax to create a hyperlink that appears to open a legitimate website but actually opens a deceptive (spoofed) website. For example, the URL http://www.wingtiptoys.com@example.com appears to open http://www.wingtiptoys.com but actually opens http://example.com. To protect users from such attacks, Internet Explorer usually blocks any URLs using this syntax. @@ -8,6 +8,7 @@ This functionality can be controlled separately for instances of Internet Explor Present False HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE + V-71109 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security "Disable user name and password" is set to "Enabled" and 'outlook.exe' is checked. @@ -27,6 +28,7 @@ This functionality can be controlled separately for instances of Internet Explor Present False HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SAFE_BINDTOOBJECT + V-71111 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security "Bind to Object" is set to "Enabled" and 'outlook.exe' is checked. @@ -46,6 +48,7 @@ Criteria: If the value outlook.exe is REG_DWORD = 1, this is not a finding.Present False HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_UNC_SAVEDFILECHECK + V-71113 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security "Saved from URL" is set to "Enabled" and 'outlook.exe' is checked. @@ -65,6 +68,7 @@ Criteria: If the value outlook.exe is REG_DWORD = 1, this is not a finding.Present False HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL + V-71115 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security "Navigate URL" is set to "Enabled" and 'outlook.exe' is checked. @@ -87,6 +91,7 @@ Criteria: If the value outlook.exe is REG_DWORD = 1, this is not a finding.Present False HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS + V-71117 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security "Scripted Window Security Restrictions" is set to "Enabled" and 'outlook.exe' is checked. @@ -106,6 +111,7 @@ Criteria: If the value outlook.exe is REG_DWORD = 1, this is not a finding.Present False HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT + V-71119 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security "Add-on Management" is set to "Enabled" and 'outlook.exe' is checked. @@ -125,6 +131,7 @@ Criteria: If the value outlook.exe is REG_DWORD = 1, this is not a finding.Present False HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT + V-71121 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security "Block popups" is set to "Enabled" and 'outlook.exe' is checked. @@ -144,6 +151,7 @@ Criteria: If the value outlook.exe is REG_DWORD = 1, this is not a finding.Present False HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_FILEDOWNLOAD + V-71123 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security "Restrict File Download" is set to "Enabled" and 'outlook.exe' is checked. @@ -163,6 +171,7 @@ Criteria: If the value of outlook.exe is REG_DWORD = 1, this is not a finding.Present False HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ZONE_ELEVATION + V-71125 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security "Protection From Zone Elevation" is set to "Enabled" and 'outlook.exe' is checked. @@ -182,6 +191,7 @@ Criteria: If the value outlook.exe is REG_DWORD = 1, this is not a finding.Present False HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESTRICT_ACTIVEXINSTALL + V-71127 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2016 (Machine) -> Security Settings -> IE Security "Restrict ActiveX Install" is set to "Enabled" and 'outlook.exe' is checked. @@ -201,6 +211,7 @@ Criteria: If the value outlook.exe is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\pubcal + V-71129 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Outlook Options -> Preferences -> Calendar Options -> Office.com Sharing Service "Prevent publishing to Office.com" is set to "Enabled". @@ -220,6 +231,7 @@ Criteria: If the value DisableOfficeOnline is REG_DWORD = 1, this is not a findi Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\pubcal + V-71131 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Outlook Options -> Preferences -> Calendar Options -> Office.com Sharing Service "Prevent publishing to a DAV server" is set to "Enabled". @@ -240,6 +252,7 @@ Criteria: If the value DisableDav is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\pubcal + V-71133 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Outlook Options -> Preferences -> Calendar Options -> Office.com Sharing Service "Restrict level of calendar details users can publish" is set to "Enabled (Disables 'Full details' and 'Limited details')". @@ -259,6 +272,7 @@ Criteria: If the value PublishCalendarDetailsPolicy is REG_DWORD = 4000 (hex) or Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\pubcal + V-71135 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Outlook Options -> Preferences -> Calendar Options -> Office.com Sharing Service "Access to published calendars" is set to "Enabled". @@ -278,6 +292,7 @@ Criteria: If the value RestrictedAccessOnly is REG_DWORD = 1, this is not a find Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71145 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Outlook Options -> Other -> Advanced "Do not allow Outlook object model scripts to run for shared folders" is set to "Enabled". @@ -298,6 +313,7 @@ Criteria: If the value SharedFolderScript is REG_DWORD = 0, this is not a findin Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71147 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Outlook Options -> Other -> Advanced "Do not allow Outlook object model scripts to run for public folders" is set to "Enabled". @@ -317,6 +333,7 @@ Criteria: If the value PublicFolderScript is REG_DWORD = 0, this is not a findin Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71149 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security "Allow Active X One Off Forms" is set to "Enabled: Load only Outlook Controls". @@ -336,6 +353,7 @@ Criteria: If the value AllowActiveXOneOffForms is REG_DWORD = 0, this is not a f Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71151 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security "Configure Add-In Trust Level" is set to "Enabled (Trust all loaded and installed COM addins)". @@ -355,6 +373,7 @@ Criteria: If the value AddinTrust is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71153 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security "Disable 'Remember password' for Internet e-mail accounts" is set to "Enabled". @@ -374,6 +393,7 @@ Criteria: If the value EnableRememberPwd is REG_DWORD = 0, this is not a finding Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook + V-71155 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security "Prevent users from customizing attachment security settings" is set to "Enabled". @@ -393,6 +413,7 @@ Criteria: If the value DisallowAttachmentCustomization is REG_DWORD = 1, this is Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71157 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings "Outlook Security Mode" is set to "Enabled (Use Outlook Security Group Policy)". @@ -412,6 +433,7 @@ Criteria: If the value AdminSecurityMode is REG_DWORD = 3, this is not a finding Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71159 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Attachment Security "Display Level 1 attachments" is set to "Disabled". @@ -431,6 +453,7 @@ Criteria: If the value ShowLevel1Attach is REG_DWORD = 0, this is not a finding. Absent False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71161 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Attachment Security "Remove file extensions blocked as Level 1" is set to "Disabled". @@ -451,6 +474,7 @@ Criteria: If the registry key exists, this is a finding. Absent False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71163 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Attachment Security "Remove file extensions blocked as Level 2" is set to "Disabled". @@ -471,6 +495,7 @@ Criteria: If the registry key exists, this is a finding. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71165 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Custom Form Security "Allow scripts in one-off Outlook forms" is set to "Disabled". @@ -490,6 +515,7 @@ Criteria: If the value EnableOneOffFormScripts is REG_DWORD = 0, this is not a f Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71167 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Custom Form Security "Set Outlook object model Custom Actions execution prompt" is set to "Enabled (Automatically Deny)". @@ -509,6 +535,7 @@ Criteria: If the value PromptOOMCustomAction is REG_DWORD = 0, this is not a fin Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71169 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Programmatic Security "Configure Outlook object model prompt when sending mail" is set to "Enabled (Automatically Deny)". @@ -529,6 +556,7 @@ Criteria: If the value PromptOOMSend is REG_DWORD = 0, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71171 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Programmatic Security "Configure Outlook object model prompt when accessing an address book" is set to "Enabled (Automatically Deny)". @@ -549,6 +577,7 @@ Criteria: If the value PromptOOMAddressBookAccess is REG_DWORD = 0, this is not Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71173 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Programmatic Security "Configure Outlook object model prompt when reading address information" is set to "Enabled (Automatically Deny)". @@ -569,6 +598,7 @@ Criteria: If the value PromptOOMAddressInformationAccess is REG_DWORD = 0, this Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71175 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Programmatic Security "Configure Outlook object model prompt when responding to meeting and task requests" is set to "Enabled (Automatically Deny)". @@ -589,6 +619,7 @@ Criteria: If the value PromptOOMMeetingTaskRequestResponse is REG_DWORD = 0, thi Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71177 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Programmatic Security "Configure Outlook object model prompt when executing Save As" is set to "Enabled (Automatically Deny)". @@ -610,6 +641,7 @@ Criteria: If the value PromptOOMSaveAs is REG_DWORD = 0, this is not a finding. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71179 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Programmatic Security "Configure Outlook object model prompt When accessing the Formula property of a UserProperty object" is set to "Enabled (Automatically Deny)". @@ -629,6 +661,7 @@ Criteria: If the value PromptOOMFormulaAccess is REG_DWORD = 0, this is not a fi Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Outlook\security + V-71193 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Security Form Settings -> Programmatic Security -> Trusted Add-ins "Configure trusted add-ins" is set to "Disabled". @@ -653,6 +686,7 @@ In some reported configurations, the value remains after disabling the setting b Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71195 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Cryptography "S/MIME interoperability with external clients" is set to "Enabled (Handle internally)". @@ -672,6 +706,7 @@ Criteria: If the value ExternalSMime is REG_DWORD = 0, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71227 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Cryptography "Message Formats" is set to "Enabled (S\MIME)". @@ -695,6 +730,7 @@ FIPS mode in Windows enforces 3DES, AES 256/192/128, SHA1, and SHA 512/384/256. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71229 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Cryptography "Run in FIPS compliant mode" is set to "Enabled". @@ -714,6 +750,7 @@ Criteria: If the value FIPSMode is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71231 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Cryptography "Send all signed messages as clear signed messages" is set to "Enabled". @@ -733,6 +770,7 @@ Criteria: If the value ClearSign is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71233 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Cryptography "S/MIME receipt requests behavior" is set to "Enabled (Never send S\MIME receipts)". @@ -753,6 +791,7 @@ Criteria: If the value RespondToReceiptRequests is REG_DWORD = 2, this is not a Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71235 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Cryptography -> Signature Status dialog box "Retrieving CRLs (Certificate Revocation Lists)" is set to "Enabled (When online always retrieve the CRL)". @@ -772,6 +811,7 @@ Criteria: If the value UseCRLChasing is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\mail + V-71237 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Outlook 2016 >> Security >> Automatic Picture Download Settings "Display pictures and external content in HTML e-mail" is set to "Enabled". @@ -792,6 +832,7 @@ Criteria: If the value BlockExtContent is REG_DWORD = 1, this is not a finding.< Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\mail + V-71239 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Automatic Picture Download Settings "Automatically download content for e-mail from people in Safe Senders and Safe Recipients Lists" is set to "Disabled". @@ -811,6 +852,7 @@ Criteria: If the value UnblockSpecificSenders is REG_DWORD = 0, this is not a fi Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\mail + V-71241 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Automatic Picture Download Settings "Do not permit download of content from safe zones" is set to "Disabled". @@ -830,6 +872,7 @@ Criteria: If the value UnblockSafeZone is REG_DWORD = 1, this is not a finding.< Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\mail + V-71243 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Automatic Picture Download Settings "Block Trusted Zones" is set to "Enabled". @@ -849,6 +892,7 @@ Criteria: If the value TrustedZone is REG_DWORD = 0, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\mail + V-71245 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Automatic Picture Download Settings "Include Internet in Safe Zones for Automatic Picture Download" is set to "Disabled". @@ -868,6 +912,7 @@ Criteria: If the value Internet is REG_DWORD = 0, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\mail + V-71247 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Automatic Picture Download Settings "Include Intranet in Safe Zones for Automatic Picture Download" is set to "Disabled". @@ -887,6 +932,7 @@ Criteria: If the value Intranet is REG_DWORD = 0, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71249 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Trust Center "Security setting for macros" is set to "Enabled (Warn for signed, disable unsigned)". @@ -906,6 +952,7 @@ Criteria: If the value Level is REG_DWORD = 3, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\mail + V-71251 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Trust Center "Allow hyperlinks in suspected phishing e-mail messages" is set to "Disabled". @@ -925,6 +972,7 @@ Criteria: If the value JunkMailEnableLinks is REG_DWORD = 0, this is not a findi Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\rpc + V-71253 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Account Settings -> Exchange "Enable RPC encryption" is set to "Enabled". @@ -944,6 +992,7 @@ Criteria: If the value EnableRPCEncryption is REG_DWORD = 1, this is not a findi Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71255 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Account Settings -> Exchange "Authentication with Exchange Server" is set to "Enabled (Kerberos Password Authentication)". @@ -963,6 +1012,7 @@ Criteria: If the value AuthenticationService is REG_DWORD = 16 (decimal) or 10 ( Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\rss + V-71259 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Account Settings -> RSS Feeds "Download full text of articles as HTML attachments" is set to "Disabled". @@ -982,6 +1032,7 @@ Criteria: If the value EnableFullTextHTML is REG_DWORD = 0, this is not a findin Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\webcal + V-71261 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Account Settings -> Internet Calendars "Automatically download attachments" is set to "Disabled". @@ -1001,6 +1052,7 @@ Criteria: If the value EnableAttachments is REG_DWORD = 0, this is not a finding Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\webcal + V-71263 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Account Settings -> Internet Calendars "Do not include Internet Calendar integration in Outlook" is set to "Enabled". @@ -1020,6 +1072,7 @@ Criteria: If the value Disable is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\meetings\profile + V-71265 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Meeting Workspace "Disable user entries to server list" is set to "Enabled (Publish default, disallow others)". @@ -1039,6 +1092,7 @@ Criteria: If the value ServerUI is REG_DWORD = 2, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\options\rss + V-71267 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Account Settings -> RSS Feeds "Automatically download enclosures" is set to "Disabled". @@ -1058,6 +1112,7 @@ Criteria: If the value EnableAttachments is REG_DWORD = 0, this is not a finding Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71271 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security "Prompt user to choose security settings if default settings fail" is set to "Disabled". @@ -1077,6 +1132,7 @@ Criteria: If the value ForceDefaultProfile is REG_DWORD = 0, this is not a findi Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71273 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Cryptography "Minimum encryption settings" is set to "Enabled: 168 bits". @@ -1096,6 +1152,7 @@ Criteria: If the value MinEncKey is REG_DWORD = a8 (hex) or 168 (decimal), this Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71275 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Cryptography "Replies or forwards to signed/encrypted messages are signed/encrypted" is set to "Enabled". @@ -1117,6 +1174,7 @@ Criteria: If the value NoCheckOnSessionSecurity is REG_DWORD = 1, this is not a Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\outlook\security + V-71277 False Verify the policy value for User Configuration -> Administrative Templates -> Microsoft Outlook 2016 -> Security -> Cryptography "Do not check e-mail address against address of certificates being used" is set to "Enabled". diff --git a/source/StigData/Processed/Office-System2013-2.1.xml b/source/StigData/Processed/Office-System2013-2.1.xml index 48d57be2d..7e320dd2a 100644 --- a/source/StigData/Processed/Office-System2013-2.1.xml +++ b/source/StigData/Processed/Office-System2013-2.1.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>Users of Office applications can see and use links to Microsoft Office SharePoint Server sites from those applications. Administrators configure published links to Office applications during initial deployment, and can add or change links as part of regular operations. These links appear on the My SharePoint Sites tab of the Open, Save, and Save As dialog boxes when opening and saving documents from these applications. Links can be targeted so that they only appear to users who are members of particular audiences. @@ -7,6 +7,7 @@ If a malicious person gains access to the list of published links, they could mo Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\portal + V-17670 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Server Settings "Disable the Office client from polling the SharePoint Server for published links" is set to "Enabled". @@ -25,6 +26,7 @@ By default, this feature is enabled, if users choose to participate in the Custo Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\ptwatson + V-17627 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Tools >> Options >> Spelling >> Proofing Data Collection "Improve Proofing Tools" is set to "Disabled". @@ -43,6 +45,7 @@ By default, users can specify any location as a trusted location, and a computer Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\security\trusted locations + V-17560 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings >> Trust Center "Allow mix of policy and user locations" is set to "Disabled". @@ -62,6 +65,7 @@ XML expansion packs can be used to initialize and load malicious code, which mig Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\Common\Smart Tag + V-17669 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Smart Documents (Word, Excel) "Disable Smart Document's use of manifests" is set to "Enabled". @@ -79,6 +83,7 @@ If the value 'NeverLoadManifests' is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\signatures + V-17749 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Signing "Legacy format signatures" is set to "Enabled". @@ -98,6 +103,7 @@ Fix Text: Set the policy value for User Configuration >> Administrative Te Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\signatures + V-17805 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Signing "Suppress external signature services menu item" is set to "Enabled". @@ -115,6 +121,7 @@ Criteria: If the value 'SuppressExtSigningSvcs' is REG_DWORD = 1, this is not a Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\fixedformat + V-17660 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Microsoft Save As PDF and XPS add-ins "Disable inclusion of document properties in PDF and XPS output" is set to "Enabled". @@ -133,6 +140,7 @@ By default, users can post blog entries to any compatible blogging service provi Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\Common\Blog + V-17581 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Miscellaneous "Control Blogging" is set to "Enabled (Only SharePoint blogs allowed)". @@ -150,6 +158,7 @@ If the value 'DisableBlog' is REG_DWORD = 1, this is not a finding. Present False HKEY_LOCAL_MACHINE\software\policies\Microsoft\office\15.0\common\officeupdate + V-40859 False Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2013 (Machine)->Updates->"Hide option to enable or disable updates" is set to "Enabled". @@ -169,6 +178,7 @@ Criteria: If the value HideEnableDisableUpdates is REG_DWORD = 1, this is not a Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\feedback + V-40880 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Privacy >> Trust Center >>"Allow including screenshot with Office Feedback" is set to "Disabled". @@ -186,6 +196,7 @@ If the value 'includescreenshot' is REG_DWORD = 0, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\wef\trustedcatalogs + V-40882 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings >> Trust Center >> Trusted Catalogs "Allow Unsecure Apps and Catalogs" is set to "Disabled". @@ -206,6 +217,7 @@ If the value 'requireserververification' is REG_DWORD = 1, this is not a finding Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\osm + V-40886 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Telemetry Dashboard >> "Turn on privacy setting in Office Telemetry Agent" is set to "Enabled". @@ -223,6 +235,7 @@ If the value 'enablefileobfuscation' is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\general + V-17664 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Privacy >> Trust Center "Disable Opt-in Wizard on first run" is set to "Enabled". @@ -241,6 +254,7 @@ By default, users have the opportunity to opt into participation in the CEIP the Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common + V-17612 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Privacy >> Trust Center "Enable Customer Experience Improvement Program" is set to "Disabled". @@ -259,6 +273,7 @@ By default, users are allowed to download updates, add-ins, and patches from the Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common + V-17740 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Privacy >> Trust Center "Automatically receive small updates to improve reliability" is set to "Disabled". @@ -277,6 +292,7 @@ By default, Office users can use the Internet Fax feature. </VulnDiscussion&g Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\services\fax + V-17661 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Services >> Fax "Disable Internet Fax feature" to "Enabled". @@ -294,6 +310,7 @@ If the value 'NoFax' is REG_DWORD = 1, this is not a finding. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\internet + V-26630 False Note: This check is Not Applicable when the use of Office 365 is against the specific DoD instance of O365. @@ -318,6 +335,7 @@ If the value 'UseOnlineContent' is REG_DWORD = 0, this is not a finding. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\firstrun + V-40860 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> First Run >> "Disable First Run Movie" is set to "Enabled". @@ -335,6 +353,7 @@ Criteria: If the value 'disablemovie' is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\firstrun + V-40861 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> First Run >> "Disable Office First Run on application boot" is set to "Enabled". @@ -352,6 +371,7 @@ Criteria: If the value 'bootedrtm' is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\signin + V-40862 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Miscellaneous >> "Block signing into Office" is set to "Enabled: org ID only". @@ -369,6 +389,7 @@ If the value 'signinoptions' is REG_DWORD = 2, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\gfx + V-40863 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Miscellaneous >> "Do not automatically hyperlink screenshots" is set to "Enabled". @@ -386,6 +407,7 @@ If the value 'disablescreenshotautohyperlink' is REG_DWORD = 1, this is not a fi Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\general + V-40864 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Miscellaneous .> "Show OneDrive Sign In" is set to "Disabled". @@ -403,6 +425,7 @@ If the value 'SkyDriveSignInOption' is REG_DWORD = 0, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\broadcast + V-40875 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Present Online >> "Remove Office Presentation Service from the list of online presentation services in PowerPoint and Word" is set to "Enabled". @@ -420,6 +443,7 @@ If the value 'disabledefaultservice' is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\feedback + V-40881 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Privacy >> Trust Center >> "Send Office Feedback" is set to "Disabled". @@ -437,6 +461,7 @@ If the value 'enabled' is REG_DWORD = 0, this is not a finding. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\roaming + V-40884 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Services >> "Disable Roaming Office User Settings" is set to "Enabled". @@ -454,6 +479,7 @@ If the value 'roamingsettingsdisabled' is REG_DWORD = 1, this is not a finding.< Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\osm + V-40885 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Telemetry Dashboard >> "Turn on data uploading for Office Telemetry Agent" is set to "Disabled". @@ -471,6 +497,7 @@ If the value 'enableupload' is REG_DWORD = 0, this is not a finding. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\osm + V-40887 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Telemetry Dashboard >> "Turn on telemetry data collection" is set to "Enabled". @@ -488,6 +515,7 @@ If the value 'enablelogging' is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\internet + V-17759 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Tools | Options | General | Web Options... >> Files "Open Office documents as read/write while browsing" is set to "Disabled". @@ -505,6 +533,7 @@ If the value 'OpenDocumentsReadWriteWhileBrowsing' for REG_DWORD = 0, this is no Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\internet + V-17773 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Tools >> Options >> General >> Web Options >> Browsers "Rely on VML for displaying graphics in browsers" is set to "Disabled". @@ -522,6 +551,7 @@ If the value 'RelyOnVML' is REG_DWORD = 0, this is not a finding. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\Common\Security + V-17741 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Automation Security" is set to "Enabled (Use application macro security level)". @@ -539,6 +569,7 @@ If the value "AutomationSecurity" is REG_DWORD =2, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\broadcast + V-40879 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Present Online >> "Restrict programmatic access for creating online presentations in PowerPoint and Word" is set to "Enabled". @@ -556,6 +587,7 @@ If the value 'disableprogrammaticaccess' is REG_DWORD = 1, this is not a finding Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\security + V-17768 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Protect document metadata for password protected files" is set to "Enabled". @@ -573,6 +605,7 @@ If the value 'OpenXMLEncryptProperty' is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\security + V-17619 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Encryption type for password protected Office Open XML files" is set to "Enabled (Microsoft Enhanced RSA and AES Cryptographic Provider, AES 256,256)". @@ -590,6 +623,7 @@ If the value 'OpenXMLEncryption' is REG_SZ = "Microsoft Enhanced RSA and AES Cry Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\security + V-17617 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Encryption type for password protected Office 97-2003 files" is set to "Enabled (Microsoft Enhanced RSA and AES Cryptographic Provider, AES 256,256)". @@ -608,6 +642,7 @@ By default, users can add passwords to Excel 2013 workbooks, PowerPoint 2013 pre Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\security + V-17665 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Disable password to open UI" is set to "Disabled". @@ -629,6 +664,7 @@ By default, if an Office application detects a security issue, the Message Bar i Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\trustcenter + V-17590 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Disable all Trust Bar notifications for security issues" is set to "Disabled". @@ -649,6 +685,7 @@ If a control is not marked as SFI, it is marked Unsafe For Initialization (UFI), Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\VBA\Security + V-17750.a False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Load Controls in Forms3" is set to "Disabled". @@ -669,6 +706,7 @@ If a control is not marked as SFI, it is marked Unsafe For Initialization (UFI), Absent False HKEY_CURRENT_USER\Software\Policies\Microsoft\VBA\Security + V-17750.b False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Load Controls in Forms3" is set to "Disabled". @@ -686,6 +724,7 @@ If the value 'LoadControlsInForms' exists, this is a finding. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\wef\trustedcatalogs + V-40883 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings >> Trust Center >> Trusted Catalogs "Block the Office Store" is set to "Enabled". @@ -703,6 +742,7 @@ If the value 'disableomexcatalogs' is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\drm + V-17765 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Manage Restricted Permissions "Prevent users from changing permissions on rights managed content" is set to "Disabled". @@ -720,6 +760,7 @@ Criteria: If the value 'DisableCreation' is REG_DWORD = 0, this is not a finding Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\drm + V-17583 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Manage Restricted Permissions "Allow users with earlier versions of Office to read with browsers" is set to "Disabled". @@ -737,6 +778,7 @@ If the value 'IncludeHTML' is REG_DWORD = 0, this is not a finding. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\drm + V-17731 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Manage Restricted Permissions "Always require users to connect to verify permission" is set to "Enabled". @@ -756,6 +798,7 @@ By default, if a control is marked SFI, the application loads the control in saf Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\Common\Security + V-17547.a False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "ActiveX Control Initialization" is set to "Disabled". @@ -774,6 +817,7 @@ By default, if a control is marked SFI, the application loads the control in saf Absent False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\Common\Security + V-17547.b False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "ActiveX Control Initialization" is set to "Disabled". @@ -791,6 +835,7 @@ Links that Office considers unsafe include links to executable files, TIFF files Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\security + V-17659 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Suppress hyperlink warnings" is set to "Disabled". @@ -807,6 +852,7 @@ Criteria: If the value 'DisableHyperLinkWarning' is REG_DWORD = 0, this is not a Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\documentinformationpanel + V-17605 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Document Information Panel "Document Information Panel Beaconing UI" is set to "Enabled (Always show UI)". @@ -824,6 +870,7 @@ If the value 'Beaconing' is REG_DWORD = 1, this is not a finding. Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\security + V-17769 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Protect document metadata for rights managed Office Open XML Files" is set to "Enabled". @@ -841,6 +888,7 @@ If the value 'DRMEncryptProperty' is REG_DWORD = 1, this is not a finding.Present False HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\15.0\common\security + V-26704 False Verify the policy value for User Configuration >> Administrative Templates >> Microsoft Office 2013 >> Security Settings "Encrypt document properties" is set to "Enabled". @@ -858,6 +906,7 @@ Criteria: If the value 'EncryptDocProps' is REG_DWORD = 1, this is not a finding Present False HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Office\15.0\Common\OfficeUpdate + V-40858.a True this value is set to 1 to enable AutomaticUpdates for Office Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2013 (Machine)->Updates->"Enable Automatic Updates" is set to "Enabled". @@ -880,6 +929,7 @@ Criteria: If the value of WUServer and WUStatusServer are populated with an Intr Present False HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate + V-40858.b True WindowsUpdate server is specified for this rule Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2013 (Machine)->Updates->"Enable Automatic Updates" is set to "Enabled". @@ -902,6 +952,7 @@ Criteria: If the value of WUServer and WUStatusServer are populated with an Intr Present False HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate + V-40858.c True WindowsUpdate statistics server is specified for this rule Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2013 (Machine)->Updates->"Enable Automatic Updates" is set to "Enabled". @@ -924,6 +975,7 @@ Criteria: If the value of WUServer and WUStatusServer are populated with an Intr Present False HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU + V-40858.d True this value is set to 1 to enable the use of a WindowsUpdate Server Verify the policy value for Computer Configuration -> Administrative Templates -> Microsoft Office 2013 (Machine)->Updates->"Enable Automatic Updates" is set to "Enabled". diff --git a/source/StigData/Processed/SqlServer-2016-Instance-2.1.xml b/source/StigData/Processed/SqlServer-2016-Instance-2.1.xml index 3140e751c..6e21153aa 100644 --- a/source/StigData/Processed/SqlServer-2016-Instance-2.1.xml +++ b/source/StigData/Processed/SqlServer-2016-Instance-2.1.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>Database management includes the ability to control the number of users and user sessions utilizing SQL Server. Unlimited concurrent connections to SQL Server could allow a successful Denial of Service (DoS) attack by exhausting connection resources; and a system can also fail or be degraded by an overload of legitimate users. Limiting the number of concurrent sessions per user is helpful in reducing these risks. @@ -12,6 +12,7 @@ The organization will need to define the maximum number of concurrent sessions b (Sessions may also be referred to as connections or logons, which for the purposes of this requirement are synonyms.)</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79119 False Review the system documentation to determine whether any limits have been defined. If it does not, assume a limit of 10 for database administrators and 2 for all other users. @@ -48,6 +49,7 @@ SQL Server must be configured to automatically utilize organization-level accoun Automation may be comprised of differing technologies that when placed together contain an overall mechanism supporting an organization's automated account management requirements.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79121 False Determine whether SQL Server is configured to use only Windows authentication. @@ -94,6 +96,7 @@ Automation may be comprised of differing technologies that when placed together SQL Server supports several authentication methods to allow operation in various environments, Kerberos, NTLM, and SQL Server. An instance of SQL Server must be configured to utilize the most-secure method available. Service accounts utilized by SQL Server should be unique to a given instance.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79123 False If the SQL Server is not part of an Active Directory domain, this finding is Not Applicable. @@ -169,6 +172,7 @@ Access control policies include identity-based policies, role-based policies, an This requirement is applicable to access control enforcement applications, a category that includes database management systems. If SQL Server does not follow applicable policy when approving access, it may be in conflict with networks or other applications in the information system. This may result in users either gaining or being denied access inappropriately and in conflict with applicable policy.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79125 False Review the system documentation to determine the required levels of protection for DBMS server securables, by type of login. @@ -187,6 +191,7 @@ Non-repudiation protects against later claims by a user of not having created, m In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring SQL Server's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to SQL Server, even where the application connects to SQL Server with a standard, shared account.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79127 False Obtain the list of authorized SQL Server accounts in the system documentation. @@ -223,6 +228,7 @@ DoD has defined the list of events for which SQL Server will provide an audit re Organizations may define additional events requiring continuous or ad hoc auditing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79133 False Review the server documentation to determine if any additional events are required to be audited. If no additional events are required, this is not a finding. @@ -257,6 +263,7 @@ Suppression of auditing could permit an adversary to evade detection. Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79135 False Obtain the list of approved audit maintainers from the system documentation. @@ -337,6 +344,7 @@ If any of the logins, roles, or role memberships returned have permissions that This requirement addresses explicit requests for privilege/permission/role membership information. It does not refer to the implicit retrieval of privileges/permissions/role memberships that SQL Server continually performs to determine if any and every action on the database is permitted.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79137 False Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. @@ -373,6 +381,7 @@ This requirement addresses explicit requests for privilege/permission/role membe To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79139 False Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. @@ -409,6 +418,7 @@ The organization must determine what additional information is required for comp Examples of detailed information the organization may require in audit records are full-text recording of privileged commands or the individual identities of shared account users.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79145 False If a SQL Server Audit is not in use for audit purposes, this is a finding unless a third-party product is being used that can perform detailed auditing for SQL Server. @@ -429,6 +439,7 @@ When the need for system availability does not outweigh the need for a complete Systems where audit trail completeness is paramount will most likely be at a lower MAC level than MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid a shutdown in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79147 False If the system documentation indicates that availability takes precedence over audit trail completeness, this is not applicable (NA). @@ -453,6 +464,7 @@ When availability is an overriding concern, approved actions in response to an a Systems where availability is paramount will most likely be MAC I; the final determination is the prerogative of the application owner, subject to Authorizing Official concurrence. In any case, sufficient auditing resources must be allocated to avoid audit data loss in all but the most extreme situations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79149 False If the system documentation indicates that availability does not take precedence over audit trail completeness, this is not applicable (NA). @@ -485,6 +497,7 @@ Audit tools include, but are not limited to, OS-provided audit tools, vendor-pro If an attacker were to gain access to audit tools, he could analyze audit logs for system weaknesses or weaknesses in the auditing itself. An attacker could also manipulate logs to hide evidence of malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79157 False Check the server documentation for a list of approved users with access to SQL Server Audits. @@ -510,6 +523,7 @@ Applications providing tools to interface with audit data will leverage user per Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79159 False Check the server documentation for a list of approved users with access to SQL Server Audits. @@ -535,6 +549,7 @@ Applications providing tools to interface with audit data will leverage user per Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79161 False Check the server documentation for a list of approved users with access to SQL Server Audits. @@ -560,6 +575,7 @@ Accordingly, only qualified and authorized individuals must be allowed to obtain Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79163 False Review Server documentation to determine the authorized owner and users or groups with modify rights for this SQL instance's binary files. Additionally check the owner and users or groups with modify rights for shared software library paths on disk. @@ -578,6 +594,7 @@ Accordingly, only qualified and authorized individuals must be allowed to obtain Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79165 False Review server documentation to determine the process by which shared software libraries are monitored for change. Ensure the process alerts for changes in a file's ownership, modification dates, and hash value at a minimum. @@ -598,6 +615,7 @@ If the system were to allow any user to make changes to software libraries, then DBA and other privileged administrative or application owner accounts are granted privileges that allow actions that can have a great impact on SQL Server security and operation. It is especially important to grant privileged access to only those persons who are qualified and authorized to use them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79167 False From the system documentation, obtain the list of accounts authorized to install/update SQL Server. Run the following PowerShell command to list all users who have installed/modified SQL Server 2016 software and compare the list against those persons who are qualified and authorized to use the software. @@ -617,6 +635,7 @@ DBMSs must adhere to the principles of least functionality by providing only ess Demonstration and sample database objects and applications present publicly known attack points for malicious users. These demonstration and sample objects are meant to provide simple examples of coding specific functions and are not developed to prevent vulnerabilities from being introduced to SQL Server and host system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79171 False Review the server documentation, if this system is identified as a development or test system, this check is Not Applicable. @@ -638,6 +657,7 @@ It is detrimental for software products to provide, or install by default, funct DBMSs must adhere to the principles of least functionality by providing only essential capabilities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79173 False From the server documentation, obtain a listing of required components. @@ -660,6 +680,7 @@ DBMSs must adhere to the principles of least functionality by providing only ess Unused, unnecessary DBMS components increase the attack vector for SQL Server by introducing additional targets for attack. By minimizing the services and applications installed on the system, the number of potential vulnerabilities is reduced. Components of the system that are unused and cannot be uninstalled must be disabled. The techniques available for disabling components will vary by DBMS product, OS, and the nature of the component and may include DBMS configuration settings, OS service settings, OS file access security, and DBMS user/role permissions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79175 False From the server documentation, obtain a listing of required components. @@ -688,6 +709,7 @@ SQL Server may spawn additional external processes to execute procedures that ar The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79177 False The xp_cmdshell extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity. @@ -714,6 +736,7 @@ SQL Server may spawn additional external processes to execute procedures that ar The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79179 False The common language runtime (CLR) component of the .NET Framework for Microsoft Windows in SQL Server allows you to write stored procedures, triggers, user-defined types, user-defined functions, user-defined aggregates, and streaming table-valued functions, using any .NET Framework language, including Microsoft Visual Basic .NET and Microsoft Visual C#. CLR packing assemblies can access resources protected by .NET Code Access Security when it runs managed code. Specifying UNSAFE enables the code in the assembly complete freedom to perform operations in the SQL Server process space that can potentially compromise the robustness of SQL Server. UNSAFE assemblies can also potentially subvert the security system of either SQL Server or the common language runtime. @@ -750,6 +773,7 @@ SQL Server may spawn additional external processes to execute procedures that ar Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. Non-Standard extended stored procedures can compromise the integrity of the SQL Server process. This feature will be removed in a future version of Microsoft SQL Server. Do not use this feature in new development work, and modify applications that currently use this feature as soon as possible.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79181 False Extended stored procedures are DLLs that an instance of SQL Server can dynamically load and run. Extended stored procedures run directly in the address space of an instance of SQL Server and are programmed by using the SQL Server Extended Stored Procedure API. @@ -780,6 +804,7 @@ If it is not approved, this is a finding. <VulnDiscussion>Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizational operations (e.g., key missions, functions). It is detrimental for applications to provide, or install by default, functionality exceeding requirements or mission objectives. Applications must adhere to the principles of least functionality by providing only essential capabilities. SQL Server may spawn additional external processes to execute procedures that are defined in the SQL Server but stored in external host files (external procedures). The spawned process used to execute the external procedure may operate within a different OS security context than SQL Server and provide unauthorized access to the host system. A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. This access may be exploited by malicious users who have compromised the integrity of the SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79183 False A linked server allows for access to distributed, heterogeneous queries against OLE DB data sources. After a linked server is created, distributed queries can be run against this server, and queries can join tables from more than one data source. If the linked server is defined as an instance of SQL Server, remote stored procedures can be executed. @@ -810,6 +835,7 @@ To support the requirements and principles of least functionality, the applicati SQL Server using ports deemed unsafe is open to attack through those ports. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79187 False Review SQL Server Configuration for the ports used by SQL Server. @@ -826,6 +852,7 @@ The DoD standard for authentication is DoD-approved PKI certificates. Authentic In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79193 False Execute the following query to determine if Contained Databases are used: @@ -848,6 +875,7 @@ Accordingly, a risk assessment is used in determining the authentication needs o Scalability, practicality, and security are simultaneously considered in balancing the need to ensure ease of use for access to federal information and information systems with the need to protect and adequately mitigate risk to organizational operations, organizational assets, individuals, other organizations, and the Nation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79201 False Review documentation, SQL Server settings, and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system. @@ -870,6 +898,7 @@ User data generated, as well as application-specific configuration data, needs t If the confidentiality and integrity of SQL Server data is not protected, the data will be open to compromise and unauthorized modification.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79205 False Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check should be downgraded to Category II. @@ -904,6 +933,7 @@ Verify that there are physical security measures, operating system access contro <VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79211 False Review system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. @@ -927,6 +957,7 @@ NOTE: Enabling this feature may impact performance on highly active SQL Server i <VulnDiscussion>The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79213 False Review the system documentation to determine if Instant File Initialization (IFI) is required. @@ -943,6 +974,7 @@ If the SQL Service SID (Default instance: NT SERVICE\MSSQLSERVER. Named instance <VulnDiscussion>SQL Server must prevent unauthorized and unintended information transfer via shared system resources. Permitting only SQL Server processes and authorized, administrative users to have access to the files where the database resides helps ensure that those files are not shared inappropriately and are not open to backdoor access and manipulation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79215 False Review the permissions granted to users by the operating system/file system on the database files, database log files, and database backup files. @@ -1004,6 +1036,7 @@ Any SELECT, INSERT, UPDATE, or DELETE to an application-defined security table e Depending on the capabilities of SQL Server and the design of the database and associated applications, the prevention of unauthorized use of privileged functions may be achieved by means of DBMS security features, database triggers, other mechanisms, or a combination of these.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79219 False Review server-level securables and built-in role membership to ensure only authorized users have privileged access and the ability to create server-level objects and grant permissions to themselves or others. @@ -1081,6 +1114,7 @@ If the current configuration does not match the documented baseline, this is a f Privilege elevation must be utilized only where necessary and protected from misuse.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79221 False Review the server documentation to obtain a listing of accounts used for executing external processes. Execute the following query to obtain a listing of accounts currently configured for use by external processes. @@ -1105,6 +1139,7 @@ The content captured in audit records must be managed from a central location (n SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79223 False Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. @@ -1117,6 +1152,7 @@ If the SQL Server audit records are not written directly to or systematically tr SQL Server must provide a unified tool for audit configuration.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79225 False Review the system documentation for a description of how audit records are off-loaded and how local audit log space is managed. @@ -1131,6 +1167,7 @@ The task of allocating audit record storage capacity is usually performed during In determining the capacity requirements, consider such factors as: total number of users; expected number of concurrent users during busy periods; number and type of events being monitored; types and amounts of data being captured; the frequency/speed with which audit records are off-loaded to the central log management system; and any limitations that exist on SQL Server's ability to reuse the space formerly occupied by off-loaded records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79227 False Check the server documentation for the SQL Audit file size configurations. Locate the Audit file path and drive. @@ -1148,6 +1185,7 @@ If the calculated product of the "max_file_size" times the "max_rollover_files" Time stamps generated by SQL Server must include date and time. Time is commonly expressed in Coordinated Universal Time (UTC), a modern continuation of Greenwich Mean Time (GMT), or local time with an offset from UTC.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79233 False SQL Server audits store the timestamp in UTC time. @@ -1180,6 +1218,7 @@ When dealing with access restrictions pertaining to change control, it should be Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79235 False Obtain a list of logins who have privileged permissions and role memberships in SQL. @@ -1215,6 +1254,7 @@ When dealing with access restrictions pertaining to change control, it should be Accordingly, only qualified and authorized individuals should be allowed to obtain access to system components for the purposes of initiating changes, including upgrades and modifications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79237 False Obtain a list of users who have privileged access to the server via the local Administrators group. @@ -1235,6 +1275,7 @@ If the users are not documented and authorized, this is a finding. <VulnDiscussion>Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79241 False SQL Server must only use approved network communication libraries, ports, and protocols. @@ -1253,6 +1294,7 @@ Each process has a distinct address space so that communication between processe Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79243 False Review the server documentation to determine whether use of CLR assemblies is required. Run the following query to determine whether CLR is enabled for the instance: @@ -1267,6 +1309,7 @@ If "value_in_use" is a "1" and CLR is not required, this is a finding.<VulnDiscussion>Database management systems can maintain separate execution domains for each executing process by assigning each process a separate address space. Each process has a distinct address space so that communication between processes is controlled through the security functions, and one process cannot modify the executing code of another process. Maintaining separate execution domains for executing processes can be achieved, for example, by implementing separate address spaces.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79245 False Review the server documentation to obtain a listing of required service accounts. Review the accounts configured for all SQL Server services installed on the server. @@ -1283,6 +1326,7 @@ Some DBMSs' installation tools may remove older versions of software automatical A transition period may be necessary when both the old and the new software are required. This should be taken into account in the planning.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79247 False From the server documentation, obtain a listing of required components. @@ -1308,6 +1352,7 @@ EXECUTE To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79253 False Review the system documentation to determine if SQL Server is required to audit the retrieval of privilege/permission/role membership information. @@ -1344,6 +1389,7 @@ If the SCHEMA_OBJECT_ACCESS_GROUP is not returned in an active audit, this is a For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79255 False Review the system documentation to determine if SQL Server is required to audit when data classifications are retrieved. @@ -1382,6 +1428,7 @@ To aid in diagnosis, it is necessary to keep track of failed attempts in additio For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79257 False Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully retrieved. @@ -1418,6 +1465,7 @@ If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79271 False Review the system documentation to determine if SQL Server is required to audit when data classifications are modified. @@ -1456,6 +1504,7 @@ To aid in diagnosis, it is necessary to keep track of failed attempts in additio For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79273 False Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully modified. @@ -1492,6 +1541,7 @@ If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79283 False Review the system documentation to determine if SQL Server is required to audit when data classifications are deleted. @@ -1530,6 +1580,7 @@ To aid in diagnosis, it is necessary to keep track of failed attempts in additio For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79285 False Review the system documentation to determine if SQL Server is required to audit when data classifications are unsuccessfully deleted. @@ -1571,6 +1622,7 @@ DELETE EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79299 False Review the system documentation to determine if SQL Server is required to audit when successful accesses to objects occur. @@ -1614,6 +1666,7 @@ EXECUTE To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79301 False Review the system documentation to determine if SQL Server is required to audit when unsuccessful accesses to objects occur. @@ -1652,6 +1705,7 @@ It is the responsibility of the data owner to assess the cryptography requiremen For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79309 False Review the server documentation, if this system does not contain data that must be encrypted, this finding is NA. @@ -1670,6 +1724,7 @@ Off-loading is a common process in information systems with limited audit storag The system SQL Server may write audit records to database tables, to files in the file system, to other kinds of local repository, or directly to a centralized log management system. Whatever the method used, it must be compatible with off-loading the records to the centralized system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79311 False Review the system documentation for a description of how audit records are off-loaded. @@ -1682,6 +1737,7 @@ If the system does not have a continuous network connection to the centralized l <VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79313 False Launch "Registry Editor" @@ -1702,6 +1758,7 @@ If CEIP participation is not authorized, and any of the above values are one (1) <VulnDiscussion>By default, Microsoft SQL Server enables participation in the customer experience improvement program (CEIP). This program collects information about how its customers are using the product. Specifically, SQL Server collects information about the installation experience, feature usage, and performance. This information helps Microsoft improve the product to better meet customer needs. The Local Audit component of SQL Server Usage Feedback collection writes data collected by the service to a designated folder, representing the data (logs) that will be sent to Microsoft. The purpose of the Local Audit is to allow customers to see all data Microsoft collects with this feature, for compliance, regulatory or privacy validation reasons.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79315 False Review the server documentation to determine if auditing of the telemetry data is required. If auditing of telemetry data is not required, this is not a finding. @@ -1750,6 +1807,7 @@ If no processes and procedures exist for reviewing telemetry data, this is a fin When 'Scan for startup procs' is enabled, SQL Server scans for and runs all automatically run stored procedures defined on the server. The execution of start-up stored procedures will be done under a high privileged context, therefore it is a commonly used post-exploitation vector.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79321 False Review the system documentation to obtain a listing of documented stored procedures used by SQL Server during start up. Execute the following query: @@ -1768,6 +1826,7 @@ Use of this requirement will be limited to situations where the data owner has a SQL Mirroring endpoints support different encryption algorithms, including no-encryption. Using a weak encryption algorithm or plaintext in communication protocols can lead to data loss, data manipulation and/or connection hijacking.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79323 False If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, and the requirement is documented and authorized, this is not a finding. @@ -1788,6 +1847,7 @@ Use of this requirement will be limited to situations where the data owner has a SQL Server Service Broker endpoints support different encryption algorithms, including no-encryption. Using a weak encryption algorithm or plaintext in communication protocols can lead to data loss, data manipulation and/or connection hijacking.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79325 False If the data owner does not have a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process, and the requirement is documented and authorized, this is not a finding. @@ -1812,6 +1872,7 @@ SQL Server may spawn additional external processes to execute procedures that ar The registry contains sensitive information, including password hashes as well as clear text passwords. Registry extended stored procedures allow Microsoft SQL Server to access the machine's registry. The sensitivity of these procedures are exacerbated if Microsoft SQL Server is run under the Windows account LocalSystem. LocalSystem can read and write nearly all values in the registry, even those not accessible by the Administrator. Unlike the xp_cmdshell extended stored procedure, which runs under a separate context if executed by a login not in the sysadmin role, the registry extended stored procedures always execute under the security context of the MSSQLServer service. Because the sensitive information is stored in the registry, it is essential that access to that information be properly guarded.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79327 False To determine if permissions to execute registry extended stored procedures have been revoked from all users (other than dbo), execute the following command: @@ -1851,6 +1912,7 @@ Applications must adhere to the principles of least functionality by providing o The most significant potential for attacking an instance is through the use of features that expose an external interface or ad hoc execution capability. FILESTREAM integrates the SQL Server Database Engine with an NTFS file system by storing varbinary(max) binary large object (BLOB) data as files on the file system. Transact-SQL statements can insert, update, query, search, and back up FILESTREAM data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79329 False Review the system documentation to see if FileStream is in use. If in use authorized, this is not a finding. @@ -1890,6 +1952,7 @@ The Ole Automation Procedures option controls whether OLE Automation objects can The Ole Automation Procedures extended stored procedure allows execution of host executables outside the controls of database access permissions. This access may be exploited by malicious users who have compromised the integrity of the SQL Server database process to control the host operating system to perpetrate additional malicious activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79333 False To determine if "Ole Automation Procedures" option is enabled, execute the following query: @@ -1908,6 +1971,7 @@ If the value of "config_value" is "1", review the system documentation to determ The user options option specifies global defaults for all users. A list of default query processing options is established for the duration of a user's work session. The user options option allows you to change the default values of the SET options (if the server's default settings are not appropriate).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79335 False To determine if "User Options" option is enabled, execute the following query: @@ -1934,6 +1998,7 @@ SQL Server is capable of providing a wide range of features and services. Some o The Remote Access option controls the execution of local stored procedures on remote servers or remote stored procedures on local server.  'Remote access' functionality can be abused to launch a Denial-of-Service (DoS) attack on remote servers by off-loading query processing to a target.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79337 False To determine if "Remote Access" option is enabled, execute the following query: @@ -1960,6 +2025,7 @@ SQL Server is capable of providing a wide range of features and services. Some o The Hadoop Connectivity feature allows multiple types of external data sources to be created and used across all sessions on the server.  An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79341 False To determine if "Hadoop Connectivity" option is enabled, execute the following query: @@ -1986,6 +2052,7 @@ SQL Server is capable of providing a wide range of features and services. Some o The Allow Polybase Export feature allows an export of data to an external data source such as Hadoop File System or Azure Data Lake. An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79343 False To determine if "Allow Polybase Export" option is enabled, execute the following query: @@ -2012,6 +2079,7 @@ SQL Server is capable of providing a wide range of features and services. Some o The Remote Data Archive feature allows an export of local SQL Server data to an Azure SQL Database. An exploit to the SQL Server instance could result in a compromise of the host system and external SQL Server resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79345 False To determine if "Remote Data Archive" option is enabled, execute the following query: @@ -2030,6 +2098,7 @@ If the value of "config_value" is "1", review the system documentation to determ The External Scripts Enabled feature allows scripts external to SQL such as files located in an R library to be executed.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79347 False To determine if "External Scripts Enabled" option is enabled, execute the following query: @@ -2050,6 +2119,7 @@ This convenience also presents the possibility of unauthorized individuals gaini This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79349 False If the need for the SQL Server Browser service is documented and authorized, this is not a finding. @@ -2068,6 +2138,7 @@ If its Startup Type is not shown as "Disabled", this is a finding. Enabling the replication XPs opens a significant attack surface area that can be used by an attacker to gather information about the system and potentially abuse the privileges of SQL Server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79351 False To determine if the "Replication Xps" option is enabled, execute the following query: @@ -2088,6 +2159,7 @@ This convenience also presents the possibility of unauthorized individuals gaini This requirement is not intended to prohibit use of the Browser service in any circumstances.  It calls for administrators and management to consider whether the benefits of its use outweigh the potential negative consequences of it being used by an attacker to browse the current infrastructure and retrieve a list of running SQL Server instances. In order to prevent this, the SQL instance(s) can be hidden.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79353 False If the need for the SQL Server Browser service is documented and authorized, check to make sure the SQL Instances that do not require use of the SQL Browser Service are hidden with the following query: @@ -2121,6 +2193,7 @@ This requirement is applicable when mixed-mode authentication is enabled. When SQLCMD and other command-line tools are part of any SQL Server installation. These tools can accept a plain-text password, but do offer alternative techniques. Since the typical user of these tools is a database administrator, the consequences of password compromise are particularly serious. Therefore, the use of plain-text passwords must be prohibited, as a matter of practice and procedure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79355 False Run this query to determine whether SQL Server authentication is enabled: @@ -2146,6 +2219,7 @@ Any user with enough access to the server can execute a task that will be run as Prior to SQL Server 2012, NT AUTHORITY\SYSTEM was a member of the sysadmin role by default. This allowed jobs/tasks to be executed in SQL Server without the approval or knowledge of the DBA because it looked like operating system activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79129 False Execute the following queries. The first query checks for Clustering and Availability Groups being provisioned in the Database Engine. The second query lists permissions granted to the Local System account. @@ -2180,6 +2254,7 @@ In designing a database, the organization must define the types of data and the If the computer account of a remote computer is granted access to SQL Server, any service or scheduled task running as NT AUTHORITY\SYSTEM or NT AUTHORITY\NETWORK SERVICE can log into the instance and perform actions. These actions cannot be traced back to a specific user or process.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79131 False Execute the following query: @@ -2219,6 +2294,7 @@ Audit information includes all information (e.g., audit records, audit settings, Satisfies: SRG-APP-000118-DB-000059, SRG-APP-000119-DB-000060, SRG-APP-000120-DB-000061</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79151 False If the database is setup to write audit logs using APPLICATION or SECURITY event logs rather than writing to a file, this is N/A. @@ -2249,6 +2325,7 @@ If any less restrictive permissions are present (and not specifically justified Multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to host system directories can most likely lead to a compromise of all applications hosted by the same system. Database software not installed using dedicated directories both threatens and is threatened by other hosted applications. Access controls defined for one application may by default provide access to the other application's database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79169 False Determine the directory in which SQL Server has been installed: @@ -2297,6 +2374,7 @@ To support the requirements and principles of least functionality, the applicati SQL Server using protocols deemed unsafe is open to attack through those protocols. This can allow unauthorized access to the database and through the database to other components of the information system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79185 False To determine the protocol(s) enabled for SQL Server, open SQL Server Configuration Manager. In the left-hand pane, expand SQL Server Network Configuration. Click on the entry for the SQL Server instance under review: "Protocols for ". The right-hand pane displays the protocols enabled for the instance. @@ -2314,6 +2392,7 @@ Organizational users include organizational employees or individuals the organiz (ii) Accesses that occur through authorized use of group authenticators without individual authentication. Organizations may require unique identification of individuals using shared accounts, for detailed accountability of individual activity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79189 False Review SQL Server users to determine whether shared accounts exist. (This does not include the case where SQL Server has a guest or public account that is providing access to publicly available information.) @@ -2332,6 +2411,7 @@ The DoD standard for authentication is DoD-approved PKI certificates. Authentic In such cases, the DoD standards for password complexity and lifetime must be implemented. DBMS products that can inherit the rules for these from the operating system or access control program (e.g., Microsoft Active Directory) must be configured to do so. For other DBMSs, the rules must be enforced using available configuration parameters or custom code.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79191 False Check for use of SQL Server Authentication: @@ -2371,6 +2451,7 @@ In such cases, passwords need to be protected at all times, and encryption is th SQL Server passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79195 False From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". @@ -2408,6 +2489,7 @@ The security functions validated as part of FIPS 140-2 for cryptographic modules NSA Type- (where =1, 2, 3, 4) products are NSA-certified, hardware-based encryption modules.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79199 False In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, find "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing." @@ -2424,6 +2506,7 @@ The preferred technique for thwarting guesses at Session IDs is the generation o However, it is recognized that available DBMS products do not all implement the preferred technique yet may have other protections against session hijacking. Therefore, other techniques are acceptable, provided they are demonstrated to be effective.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79203 False Verify that Windows is configured to require the use of FIPS compliant algorithms. @@ -2436,6 +2519,7 @@ If the Security Setting for this option is "Disabled", this is a finding.<VulnDiscussion>Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Creating this backup should be one of the first administrative actions performed on the server. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79207 False Review procedures for, and evidence of backup of, the Server Service Master Key in the System Security Plan. @@ -2450,6 +2534,7 @@ If procedures do not indicate access restrictions to the Service Master Key back <VulnDiscussion>Backup and recovery of the Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79209 False If the application owner and Authorizing Official have determined that encryption of data at rest is not required, this is not a finding. @@ -2470,6 +2555,7 @@ Some default DBMS error messages can contain information that could aid an attac It is important that detailed error messages be visible only to those who are authorized to view them; that general users receive only generalized acknowledgment that errors have occurred; and that these generalized messages appear only when relevant to the user's task. For example, a message along the lines of, "An error has occurred. Unable to save your changes. If this problem persists, please contact your help desk." would be relevant. A message such as "Warning: your transaction generated a large number of page splits" would likely not be relevant. "ABGQ is not a valid widget code." would be appropriate; but "The INSERT statement conflicted with the FOREIGN KEY constraint "WidgetTransactionFK". The conflict occurred in database "DB7", table "dbo.WidgetMaster", column 'WidgetCode'" would not, as it reveals too much about the database structure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79217 False Error messages within applications, custom database code (stored procedures, triggers) must be enforced by guidelines and code reviews practices. @@ -2499,6 +2585,7 @@ The appropriate support staff include, at a minimum, the ISSO and the DBA/SA. Monitoring of free space can be accomplished using Microsoft System Center or a third-party monitoring tool.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79229 False The operating system and SQL Server offer a number of methods for checking the drive or volume free space. Locate the destination drive where SQL Audits are stored and review system configuration. @@ -2515,6 +2602,7 @@ A failure of database auditing will result in either the database continuing to Alerts provide organizations with urgent messages. Real-time alerts provide these messages immediately (i.e., the time from event detection to alert occurs in seconds or less). Alerts can be generated using tools like the SQL Server Agent Alerts and Database Mail.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79231 False Review SQL Server settings, OS, or third-party logging software settings to determine whether a real-time alert will be sent to the appropriate personnel when auditing fails for any reason. @@ -2531,6 +2619,7 @@ This requirement will apply to software patch management solutions that are used SQL Server will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79249 False Obtain evidence that software patches are consistently applied to SQL Server within the time frame defined for each patch. To be considered supported, Microsoft must report that the version is supported by security patches to known vulnerability. Review the Support dates at: https://support.microsoft.com/en-us/lifecycle?C2=1044 @@ -2554,6 +2643,7 @@ DELETE EXECUTE</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79251 False Determine if an audit is configured and started by executing the following query. @@ -2582,6 +2672,7 @@ If the "SCHEMA_OBJECT_ACCESS_GROUP" is not returned in an active audit, this is <VulnDiscussion>In this context, direct access is any query, command, or call to SQL Server that comes from any source other than the application(s) that it supports. Examples would be the command line or a database management utility program. The intent is to capture all activity from administrative and non-standard sources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79303 False Determine whether any Server Audits are configured to filter records. From SQL Server Management Studio execute the following query: @@ -2600,6 +2691,7 @@ If any audits are configured to exclude administrative activities, this is a fin For detailed information, refer to NIST FIPS Publication 140-2, Security Requirements For Cryptographic Modules. Note that the product's cryptographic modules must be validated and certified by NIST as FIPS-compliant.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79305 False Verify that Windows is configured to require the use of FIPS compliant algorithms. @@ -2614,6 +2706,7 @@ If the Security Setting for this option is "Disabled" this is a finding. False + V-79307 False Verify that Windows is configured to require the use of FIPS 140-2 algorithms. @@ -2632,6 +2725,7 @@ For example, displaying asterisks when a user types in a password or PIN, is an Database applications may allow for entry of the account name and password as a visible parameter of the application execution command. This practice must be prohibited and disabled to prevent shoulder surfing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79357 False Determine whether any applications that access the database allow for entry of the account name and password, or PIN. @@ -2650,6 +2744,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client + V-97521.a False @@ -2688,6 +2783,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client + V-97521.b False @@ -2726,6 +2822,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client + V-97521.c False @@ -2764,6 +2861,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client + V-97521.d False @@ -2802,6 +2900,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server + V-97521.e False @@ -2840,6 +2939,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server + V-97521.f False @@ -2878,6 +2978,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server + V-97521.g False @@ -2916,6 +3017,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server + V-97521.h False @@ -2954,6 +3056,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Client + V-97521.i False @@ -2992,6 +3095,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Client + V-97521.j False @@ -3030,6 +3134,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Client + V-97521.k False @@ -3068,6 +3173,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Client + V-97521.l False @@ -3106,6 +3212,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\Server + V-97521.m False @@ -3144,6 +3251,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server + V-97521.n False @@ -3182,6 +3290,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server + V-97521.o False @@ -3220,6 +3329,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server + V-97521.p False @@ -3258,6 +3368,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client + V-97521.q False @@ -3296,6 +3407,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server + V-97521.r False @@ -3334,6 +3446,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Client + V-97521.s False @@ -3372,6 +3485,7 @@ TLS Registry Settings: https://docs.microsoft.com/en-us/windows-server/security Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server + V-97521.t False @@ -3412,6 +3526,7 @@ Both the holder of a digital certificate and the issuing authority must take car All access to the private key(s) of SQL Server must be restricted to authorized and authenticated users. If unauthorized users have access to one or more of SQL Server's private keys, an attacker could gain access to the key(s) and use them to impersonate the database on the network or otherwise perform unauthorized actions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-79197 System_cryptography_Use_FIPS_compliant_algorithms_for_encryption_hashing_and_signing enabled False @@ -3433,6 +3548,7 @@ For more information, see https://support.microsoft.com/en-us/kb/3141890. IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist' False + V-79141 False When Audits are enabled, they start up when the instance starts. @@ -3461,6 +3577,7 @@ Enforcement actions are the methods or mechanisms used to prevent unauthorized c USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_ACCESS_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79239 False Determine if an audit is configured to capture denied actions and started by executing the following query: @@ -3558,6 +3675,7 @@ In an SQL environment, adding permissions is typically done via the GRANT comman USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79259 False Check that SQL Server Audit is being used for the STIG compliant audit. @@ -3621,6 +3739,7 @@ To aid in diagnosis, it is necessary to keep track of failed attempts in additio V-213999 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79261 False Check that SQL Server Audit is being used for the STIG compliant audit. @@ -3682,6 +3801,7 @@ In an SQL environment, modifying permissions is typically done via the GRANT, RE V-213999 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79263 False Check that SQL Server Audit is being used for the STIG compliant audit. @@ -3746,6 +3866,7 @@ To aid in diagnosis, it is necessary to keep track of failed attempts in additio V-213999 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79265 False Check that SQL Server Audit is being used for the STIG compliant audit. @@ -3805,6 +3926,7 @@ https://msdn.microsoft.com/en-us/library/cc280663.aspx V-213940 IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist' False + V-79267 False Determine if an audit is configured and started by executing the following query: @@ -3840,6 +3962,7 @@ To aid in diagnosis, it is necessary to keep track of failed attempts in additio V-213940 IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist' False + V-79269 False Determine if an audit is configured and started by executing the following query: @@ -3875,6 +3998,7 @@ In an SQL environment, deleting permissions is typically done via the REVOKE or V-213999 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79275 False Check the SQL Server Audit being used for the STIG compliant audit. @@ -3909,6 +4033,7 @@ To aid in diagnosis, it is necessary to keep track of failed attempts in additio V-213999 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79277 False Check the SQL Server Audit being used for the STIG compliant audit. @@ -3939,6 +4064,7 @@ https://msdn.microsoft.com/en-us/library/cc280663.aspx V-213940 IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist' False + V-79279 False Determine if an audit is configured and started by executing the following query. @@ -3974,6 +4100,7 @@ To aid in diagnosis, it is necessary to keep track of failed attempts in additio V-213940 IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist' False + V-79281 False Determine if an audit is configured and started by executing the following query. @@ -4007,6 +4134,7 @@ If the "SCHEMA_OBJECT_CHANGE_GROUP" is not returned in an active audit, this is USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('SUCCESSFUL_LOGIN_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79287 False Determine if an audit is configured and started by executing the following query. @@ -4048,6 +4176,7 @@ If "Both failed and successful logins" is not selected, this is a finding.V-213940 IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist' False + V-79289 False Determine if an audit is configured and started by executing the following query. @@ -4108,6 +4237,7 @@ Note that it is particularly important to audit, and tightly control, any action USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79291 False Determine if an audit is configured and started by executing the following query: @@ -4186,6 +4316,7 @@ To aid in diagnosis, it is necessary to keep track of failed attempts in additio USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79293 False Determine if an audit is configured and started by executing the following query. @@ -4287,6 +4418,7 @@ Disconnection may be initiated by the user or forced by the system (as in a time V-214016 USE [master] DECLARE @MissingAuditCount INTEGER DECLARE @server_specification_id INTEGER DECLARE @FoundCompliant INTEGER SET @FoundCompliant = 0 /* Create a table for the events that we are looking for */ CREATE TABLE #AuditEvents (AuditEvent varchar(100)) INSERT INTO #AuditEvents (AuditEvent) VALUES ('APPLICATION_ROLE_CHANGE_PASSWORD_GROUP'),('AUDIT_CHANGE_GROUP'),('BACKUP_RESTORE_GROUP'),('DATABASE_CHANGE_GROUP'),('DATABASE_OBJECT_CHANGE_GROUP'),('DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP'),('DATABASE_OBJECT_PERMISSION_CHANGE_GROUP'),('DATABASE_OPERATION_GROUP'),('DATABASE_OWNERSHIP_CHANGE_GROUP'),('DATABASE_PERMISSION_CHANGE_GROUP'),('DATABASE_PRINCIPAL_CHANGE_GROUP'),('DATABASE_PRINCIPAL_IMPERSONATION_GROUP'),('DATABASE_ROLE_MEMBER_CHANGE_GROUP'),('DBCC_GROUP'),('LOGIN_CHANGE_PASSWORD_GROUP'),('LOGOUT_GROUP'),('SCHEMA_OBJECT_CHANGE_GROUP'),('SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OBJECT_CHANGE_GROUP'),('SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP'),('SERVER_OBJECT_PERMISSION_CHANGE_GROUP'),('SERVER_OPERATION_GROUP'),('SERVER_PERMISSION_CHANGE_GROUP'),('SERVER_PRINCIPAL_CHANGE_GROUP'),('SERVER_PRINCIPAL_IMPERSONATION_GROUP'),('SERVER_ROLE_MEMBER_CHANGE_GROUP'),('SERVER_STATE_CHANGE_GROUP'),('TRACE_CHANGE_GROUP'),('USER_CHANGE_PASSWORD_GROUP') /* Create a cursor to walk through all audits that are enabled at startup */ DECLARE auditspec_cursor CURSOR FOR SELECT s.server_specification_id FROM sys.server_audits a INNER JOIN sys.server_audit_specifications s ON a.audit_guid = s.audit_guid WHERE a.is_state_enabled = 1; OPEN auditspec_cursor FETCH NEXT FROM auditspec_cursor INTO @server_specification_id WHILE @@FETCH_STATUS = 0 AND @FoundCompliant = 0 /* Does this specification have the needed events in it? */ BEGIN SET @MissingAuditCount = (SELECT Count(a.AuditEvent) AS MissingAuditCount FROM #AuditEvents a JOIN sys.server_audit_specification_details d ON a.AuditEvent = d.audit_action_name WHERE d.audit_action_name NOT IN (SELECT d2.audit_action_name FROM sys.server_audit_specification_details d2 WHERE d2.server_specification_id = @server_specification_id)) IF @MissingAuditCount = 0 SET @FoundCompliant = 1; FETCH NEXT FROM auditspec_cursor INTO @server_specification_id END CLOSE auditspec_cursor; DEALLOCATE auditspec_cursor; DROP TABLE #AuditEvents /* Produce output that works with DSC - records if we do not find the audit events we are looking for */ IF @FoundCompliant > 0 SELECT name FROM sys.sql_logins WHERE principal_id = -1; ELSE SELECT name FROM sys.sql_logins WHERE principal_id = 1 False + V-79295 False Determine if an audit is configured and started by executing the following query: @@ -4390,6 +4522,7 @@ Concurrent connections by the same user from multiple workstations may be valid V-213940 IF Not Exists (SELECT name AS 'Audit Name', status_desc AS 'Audit Status', audit_file_path AS 'Current Audit File' FROM sys.dm_server_audit_status WHERE status_desc = 'STARTED') Select 'Doest exist' False + V-79297 False Determine if an audit is configured and started by executing the following query. @@ -4434,6 +4567,7 @@ Some applications that run on SQL Server require the [sa] account to be enabled USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; False + V-79317 False Check SQL Server settings to determine if the [sa] (system administrator) account has been disabled by executing the following query: @@ -4460,6 +4594,7 @@ Since the SQL Server [sa] is administrative in nature, the compromise of a defau V-214028 USE [master] SELECT name, is_disabled FROM sys.sql_logins WHERE principal_id = 1 AND is_disabled <> 1; False + V-79319 False Verify the SQL Server default [sa] (system administrator) account name has been changed by executing the following query: diff --git a/source/StigData/Processed/WindowsDnsServer-2012R2-2.1.xml b/source/StigData/Processed/WindowsDnsServer-2012R2-2.1.xml index aa0ce8375..b8e8709bf 100644 --- a/source/StigData/Processed/WindowsDnsServer-2012R2-2.1.xml +++ b/source/StigData/Processed/WindowsDnsServer-2012R2-2.1.xml @@ -1,4 +1,4 @@ - + <VulnDiscussion>All caching name servers must be authoritative for the root zone because, without this starting point, they would have no knowledge of the DNS infrastructure and thus would be unable to respond to any queries. The security risk is that an adversary could change the root hints and direct the caching name server to a bogus root server. At that point, every query response from that name server is suspect, which would give the adversary substantial control over the network communication of the name servers' clients. When authoritative servers are sent queries for zones that they are not authoritative for, and they are configured as a non-caching server (as recommended), they can either be configured to return a referral to the root servers or they can be configured to refuse to answer the query. The recommendation is to configure authoritative servers to refuse to answer queries for any zones for which they are not authoritative. This is more efficient for the server and allows it to spend more of its resources doing what its intended purpose is, answering authoritatively for its zone.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> @@ -6,6 +6,7 @@ $null $null False + V-58615 False Note: If the Windows DNS server is in the classified network, this check is Not Applicable. @@ -20,11 +21,12 @@ If "Root Hints" is not empty or entries on the "Root Hints" tab under "Name serv - <VulnDiscussion>A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords. + <VulnDiscussion>A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords. To guard against poisoning, name servers authoritative for .mil domains should be separated functionally from name servers that resolve queries on behalf of internal clients. Organizations may achieve this separation by dedicating machines to each function or, if possible, by running two instances of the name server software on the same machine: one for the authoritative function and the other for the resolving function. In this design, each name server process may be bound to a different IP address or network interface to implement the required segregation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58579 False NoRecursion @@ -53,11 +55,12 @@ If forwarders are not enabled and configured, and the "Disable recursion (also d - <VulnDiscussion>A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords. + <VulnDiscussion>A potential vulnerability of DNS is that an attacker can poison a name server's cache by sending queries that will cause the server to obtain host-to-IP address mappings from bogus name servers that respond with incorrect information. Once a name server has been poisoned, legitimate clients may be directed to non-existent hosts (which constitutes a denial of service), or, worse, hosts that masquerade as legitimate ones to obtain sensitive data or passwords. To guard against poisoning, name servers authoritative for .mil domains should be separated functionally from name servers that resolve queries on behalf of internal clients. Organizations may achieve this separation by dedicating machines to each function or, if possible, by running two instances of the name server software on the same machine: one for the authoritative function and the other for the resolving function. In this design, each name server process may be bound to a different IP address or network interface to implement the required segregation.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-215573 False + V-58581 False NoRecursion @@ -91,6 +94,7 @@ If the "Use root hints if no forwarders are available" is selected, this is a fi This requirement ensures organizational personnel have a means to identify who produced or changed specific information in transfers, zone information, or DNS configuration changes.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58543 False EventLogLevel @@ -111,6 +115,7 @@ If any option other than "Errors and warnings" or "All events" is selected, this <VulnDiscussion>Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident, or identify those responsible for one. The actual auditing is performed by the OS/NDM, but the configuration to trigger the auditing is controlled by the DNS server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> V-215648 False + V-58549 False EventLogLevel @@ -135,6 +140,7 @@ If any option other than "Errors and warnings" or "All events" is selected, this The exceptions are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms. In the case of third-party CDNs or cloud offerings, an approved mission need must be demonstrated.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58619 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -144,7 +150,7 @@ Press Windows Key + R, execute dnsmgmt.msc. On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones. From the expanded list, click to select the zone. - + Confirm with the DNS administrator that the hosts defined in the zone files do not resolve to hosts in another zone with its fully qualified domain name. The exceptions are glue records supporting zone delegations, CNAME records supporting a system migration, or CNAME records that point to third-party Content Delivery Networks (CDN) or cloud computing platforms. In the case of third-party CDNs or cloud offerings, an approved mission need must be demonstrated. Additional exceptions are CNAME records in a multi-domain Active Directory environment pointing to hosts in other internal domains in the same multi-domain environment. @@ -155,6 +161,7 @@ If resource records are maintained that resolve to a fully qualified domain name <VulnDiscussion>The use of CNAME records for exercises, tests, or zone-spanning (pointing to zones with lesser security) aliases should be temporary (e.g., to facilitate a migration) and not be in place for more than six months. When a host name is an alias for a record in another zone, an adversary has two points of attack: the zone in which the alias is defined and the zone authoritative for the alias's canonical name. This configuration also reduces the speed of client resolution because it requires a second lookup after obtaining the canonical name. Furthermore, in the case of an authoritative name server, this information is promulgated throughout the enterprise to caching servers and thus compounds the vulnerability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58621 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -177,6 +184,7 @@ If there are zone-spanning (i.e., zones of lesser security)CNAME records older t SIG(0) is used for server-to-server authentication for DNS transactions, and it uses PKI-based authentication. So, in cases where SIG(0) is being used instead of TSIG (which uses a shared key, not PKI-based authentication), this requirement is applicable.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58649 False Consult with the SA to determine if there is a third-party CRL server being used for certificate revocation lookup. @@ -189,6 +197,7 @@ If there is no local cache of revocation data, this is a finding. <VulnDiscussion>If zone information has not been validated in over a year, then there is no assurance that it is still valid. If invalid records are in a zone, then an adversary could potentially use their existence for improper purposes. An SOP detailing this process can resolve this requirement.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58695 False This requirement is not applicable for a Windows DNS Server which is only hosting AD-integrated zones. @@ -218,6 +227,7 @@ If zone records exist which have not been validated in over a year, this is a fi If a component such as the DNSSEC or TSIG/SIG(0) signing capabilities were to fail, the DNS server should shut itself down to prevent continued execution without the necessary security components in place. Transactions such as zone transfers would not be able to work correctly anyway in this state.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58709 False Active Directory integrated DNS servers will handle the promotion of a secondary DNS server whenever a primary DNS server loses functionality. @@ -236,6 +246,7 @@ This can include conducting a graceful application shutdown to avoid losing info If a component such as the DNSSEC or TSIG/SIG(0) signing capabilities were to fail, the DNS server should shut itself down to prevent continued execution without the necessary security components in place. Transactions such as zone transfers would not be able to work correctly anyway in this state.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58711 False Notification to system administrator is not configurable in Windows DNS Server. In order for system administrators to be notified when a component fails, the system administrator would need to implement a third-party monitoring system. At a minimum, the system administrator should have a documented procedure in place to review the diagnostic logs on a routine basis every day. @@ -251,6 +262,7 @@ If anomalies are not acted upon, security functions may fail to secure the syste The DNS server does not have the capability of shutting down or restarting the information system. The DNS server can be configured to generate audit records when anomalies are discovered, and the OS/NDM can then trigger notification messages to the system administrator based on the presence of those audit records.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58715 False Note: If only zones hosted are AD-integrated zones, this check is not applicable. @@ -265,6 +277,7 @@ If a third-party monitoring system is not in place to detect and notify the ISSO The DNS server should be configured to generate audit records whenever a self-test fails. The OS/NDM is responsible for generating notification messages related to this audit record.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58717 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -282,6 +295,7 @@ At a minimum, the application must log the validation error. However, more strin The DNS server should audit all failed attempts at server authentication through DNSSEC and TSIG/SIG(0). The actual auditing is performed by the OS/NDM, but the configuration to trigger the auditing is controlled by the DNS server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58547 False Windows 2012 DNS servers, hosting Active Directory integrated zones, transfer zone information via AD replication. Windows 2012 DNS servers hosting non-AD-integrated zones as a secondary name server and/or are not hosting AD-integrated zones use zone transfer to sync zone data. @@ -303,6 +317,7 @@ If a third-party event monitoring system is not configured, or a document proced To guard against poisoning, name servers specifically fulfilling the role of providing recursive query responses for external zones need to be segregated from name servers authoritative for internal zones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58583 False Note: If Windows DNS server is not serving in a caching role, this check is Not Applicable. @@ -321,6 +336,7 @@ To guard against poisoning, name servers authoritative for .mil domains should b Windows 2012 DNS Servers with a caching name server role must be secured against pollution by ensuring that the authenticity and integrity of queried records are verified before any data is cached.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58585 False Note: Blackhole name servers host records which are manually added and for which the name server is not authoritative. It is configured and intended to block resolvers from getting to a destination by directing the query to a blackhole. If the blackhole name server is not authoritative for any zones and otherwise only serves as a caching/forwarding name server, this check is Not Applicable. @@ -336,6 +352,7 @@ If the non-AD-integrated, standalone, caching Windows 2012 DNS Server is not con Confidentiality is not an objective of DNS, but integrity is. DNSSEC and TSIG/SIG(0) both digitally sign DNS information to authenticate its source and ensure its integrity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58587 False Note: This requirement applies to any Windows DNS Server which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too. If the Windows DNS Server only hosts AD-integrated zones and does not host any file-based zones, this is not applicable. @@ -387,6 +404,7 @@ If the results do not show the RRSIG and signature information, this is a findin To minimize the impact of a compromised ZSK, a zone administrator should set a signature validity period of 1 week for RRSIGs covering the DNSKEY RRSet in the zone (the RRSet that contains the ZSK and KSK for the zone). The DNSKEY RRSet can be re-signed without performing a ZSK rollover, but scheduled ZSK rollovers should still be performed at regular intervals.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58589 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -403,9 +421,9 @@ Right-click the zone and select DNSSEC, Properties. Select the KSK Tab. -Verify the "DNSKEY signature validity period (hours):” is set to at least 48 hours and no more than 168 hours. +Verify the "DNSKEY signature validity period (hours):” is set to at least 48 hours and no more than 168 hours. -Select the ZSK Tab. +Select the ZSK Tab. Verify the "DNSKEY signature validity period (hours):" is set to at least 48 hours and no more than 168 hours. If either the KSK or ZSK Tab "DNSKEY signature validity period (hours):" values are set to less than 48 hours or more than 168 hours, this is a finding. @@ -415,6 +433,7 @@ If either the KSK or ZSK Tab "DNSKEY signature validity period (hours):" values <VulnDiscussion>NSEC records list the resource record types for the name, as well as the name of the next resource record. With this information it is revealed that the resource record type for the name queried, or the resource record name requested, does not exist. NSEC uses the actual resource record names, whereas NSEC3 uses a one-way hash of the name. In this way, walking zone data from one record to the next is prevented, at the expense of some CPU cycles both on the authoritative server as well as the resolver. To prevent giving access to an entire zone file, NSEC3 should be configured and in order to use NSEC3, RSA/SHA-1 should be used as the algorithm, as some resolvers that understand RSA/SHA-1 might not understand NSEC3. Using RSA/SHA-256 is a safe alternative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58591 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -423,7 +442,7 @@ Log on to the DNS server using the Domain Admin or Enterprise Admin account or L Open an elevated Windows PowerShell prompt on a DNS server using the Domain Admin or Enterprise Admin account. -Type the following command: +Type the following command: PS C:\> Get-DnsServerResourceRecord -ZoneName example.com <enter> @@ -440,6 +459,7 @@ If NSEC3 RRs are not returned for the zone, this is a finding. <VulnDiscussion>Poorly constructed NS records pose a security risk because they create conditions under which an adversary might be able to provide the missing authoritative name services that are improperly specified in the zone file. The adversary could issue bogus responses to queries that clients would accept because they learned of the adversary's name server from a valid authoritative name server, one that need not be compromised for this attack to be successful. The list of slave servers must remain current within 72 hours of any changes to the zone architecture that would affect the list of slaves. If a slave server has been retired or is not operational but remains on the list, then an adversary might have a greater opportunity to impersonate that slave without detection, rather than if the slave was actually online. For example, the adversary may be able to spoof the retired slave's IP address without an IP address conflict, which would not be likely to occur if the true slave were active.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58593 False NOTE: This check is Not Applicable if Windows DNS server is only serving as a caching server and does not host any zones authoritatively. @@ -459,10 +479,10 @@ At a command prompt on any system, type: nslookup <enter>; -At the nslookup prompt, type: +At the nslookup prompt, type: server ###.###.###.### <enter>; -(where the ###.###.###.### is replaced by the IP of each NS record) +(where the ###.###.###.### is replaced by the IP of each NS record) Enter a FQDN for a known host record in the zone. @@ -475,6 +495,7 @@ If the NS server does not respond at all or responds with a non-authoritative an A network administrator may choose to use a "hidden" master authoritative server and only have secondary servers visible on the network. A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone. If the master authoritative name server is "hidden", a secondary authoritative name server may reside on the same network as the hidden master.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58595 False Windows DNS Servers that are Active Directory-integrated must be located where required to meet the Active Directory services. @@ -493,6 +514,7 @@ If all of the authoritative name servers are located on the same network segment The serial number in the SOA RDATA is used to indicate to secondary name servers that a change to the zone has occurred and a zone transfer should be performed. It should always be increased whenever a change is made to the zone data. DNS NOTIFY must be enabled on the master authoritative name server.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58597 False Note: Due to the manner in which Active Directory replication increments SOA records for zones when transferring zone information via AD replication, this check is not applicable for AD-integrated zones. @@ -508,7 +530,7 @@ From the expanded list, click to select the zone. Review the SOA information for the zone and obtain the Serial Number. Access each secondary name server for the same zone and review the SOA information. - + Verify the Serial Number is the same on all authoritative name servers. If the Serial Number is not the same on one or more authoritative name servers, this is a finding. @@ -519,6 +541,7 @@ If the Serial Number is not the same on one or more authoritative name servers, Before a DNSSEC-signed zone can be deployed, a name server must be configured to enable DNSSEC processing.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58599 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -530,8 +553,8 @@ Press Windows Key + R, execute dnsmgmt.msc. On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones. From the expanded list, click to select each zone. - -Review the RRs for each zone and verify all of the DNSEC record types are included for the zone. + +Review the RRs for each zone and verify all of the DNSEC record types are included for the zone. NOTE: The DS (Delegation Signer)record should also exist but the requirement for it is validated under WDNS-SC-000011. @@ -546,13 +569,14 @@ If the zone does not show all of the DNSSEC record types, this is a finding. False + V-58601 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -563,7 +587,7 @@ Press Windows Key + R, execute dnsmgmt.msc. On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones. -From the expanded list, click to select the zone. +From the expanded list, click to select the zone. Review the zone's RRs in the right window pane. @@ -574,15 +598,16 @@ Confirm the encryption algorithm specified in the DNSKEY's Data is at RsaSha1, a If the specified encryption algorithm is not RsaSha1 or stronger, this is a finding. - <VulnDiscussion>Authoritative name servers for an enterprise may be configured to receive requests from both external and internal clients. + <VulnDiscussion>Authoritative name servers for an enterprise may be configured to receive requests from both external and internal clients. -External clients need to receive RRs that pertain only to public services (public Web server, mail server, etc.) +External clients need to receive RRs that pertain only to public services (public Web server, mail server, etc.) -Internal clients need to receive RRs pertaining to public services as well as internal hosts. +Internal clients need to receive RRs pertaining to public services as well as internal hosts. The zone information that serves the RRs on both the inside and the outside of a firewall should be split into different physical files for these two types of clients (one file for external clients and one file for internal clients).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58603 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -600,13 +625,14 @@ If any RRs (Resource Records) on an internal DNS server resolve to IP addresses If any RRs (Resource Records) on an external DNS server resolve to IP addresses located inside the network, this is a finding. - <VulnDiscussion>Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers. + <VulnDiscussion>Instead of having the same set of authoritative name servers serve different types of clients, an enterprise could have two different sets of authoritative name servers. -One set, called external name servers, can be located within a DMZ; these would be the only name servers that are accessible to external clients and would serve RRs pertaining to hosts with public services (Web servers that serve external Web pages or provide B2C services, mail servers, etc.) +One set, called external name servers, can be located within a DMZ; these would be the only name servers that are accessible to external clients and would serve RRs pertaining to hosts with public services (Web servers that serve external Web pages or provide B2C services, mail servers, etc.) The other set, called internal name servers, is to be located within the firewall and should be configured so they are not reachable from outside and hence provide naming services exclusively to internal clients.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58605 False Consult with the System Administrator to review the external Windows DNS Server's HBSS firewall policy. @@ -627,6 +653,7 @@ One set, called external name servers, can be located within a DMZ; these would The other set, called internal name servers, is to be located within the firewall and should be configured so they are not reachable from outside and hence provide naming services exclusively to internal clients.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58607 False Consult with the System Administrator to review the internal Windows DNS Server's HBSS firewall policy. @@ -642,6 +669,7 @@ If neither the DNS server's HBSS firewall policy nor the network firewall is con <VulnDiscussion>Authoritative name servers (especially primary name servers) should be configured with an allow-transfer access control sub statement designating the list of hosts from which zone transfer requests can be accepted. These restrictions address the denial-of-service threat and potential exploits from unrestricted dissemination of information about internal resources. Based on the need-to-know, the only name servers that need to refresh their zone files periodically are the secondary name servers. Zone transfer from primary name servers should be restricted to secondary name servers. The zone transfer should be completely disabled in the secondary name servers. The address match list argument for the allow-transfer sub statement should consist of IP addresses of secondary name servers and stealth secondary name servers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58609 False Verify whether the authoritative primary name server is AD-integrated. @@ -680,6 +708,7 @@ DAC allows the owner to determine who will have access to objects they control. When applications provide a DAC mechanism, the DNS implementation must be able to limit the propagation of those access rights.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58611 False For an Active Directory-integrated DNS implementation, this is Not Applicable by virtue of being compliant with the Windows 2008/2012 AD STIG, since DNS data within an AD-integrated zone is kept within the Active Directory. @@ -705,6 +734,7 @@ If any other account/group has greater than READ privileges, this is a finding. <VulnDiscussion>DNS servers with an internal role only process name/address resolution requests from within the organization (i.e., internal clients). DNS servers with an external role only process name/address resolution information requests from clients external to the organization (i.e., on the external networks, including the Internet). The set of clients that can access an authoritative DNS server in a particular role is specified by the organization using address ranges, explicit access control lists, etc. In order to protect internal DNS resource information, it is important to isolate the requests to internal DNS servers. Separating internal and external roles in DNS prevents address space that is private (e.g., 10.0.0.0/24) or is otherwise concealed by some form of Network Address Translation from leaking into the public DNS system.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58613 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -725,6 +755,7 @@ If internal and external DNS servers have not been implemented for zones which r <VulnDiscussion>Each newer version of the name server software, especially the BIND software, generally is devoid of vulnerabilities found in earlier versions because it has design changes incorporated to take care of those vulnerabilities. These vulnerabilities have been exploited (i.e., some form of attack was launched), and sufficient information has been generated with respect to the nature of those exploits. It makes good business sense to run the latest version of name server software because theoretically it is the safest version. Even if the software is the latest version, it is not safe to run it in default mode. The security administrator should always configure the software to run in the recommended secure mode of operation after becoming familiar with the new security settings for the latest version.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58617 False Consult with the network IAVM scanner to confirm all Microsoft Operating System IAVMs have been applied to the Windows DNS server. @@ -736,6 +767,7 @@ If all Microsoft Operating System IAVMs have not been applied to the DNS server, <VulnDiscussion>IPv6 link-local scope addresses are not globally routable and must not be configured in any DNS zone. Similar to RFC1918 addresses, if a link-local scope address is inserted into a zone provided to clients, most routers will not forward this traffic beyond the local subnet.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58623 False Log on to the DNS server using the Domain Admin or Enterprise Admin account. @@ -758,6 +790,7 @@ If any non-routable IPv6 link-local scope addresses are in any zone, this is a f <VulnDiscussion>DNS is only responsible for resolving a domain name to an IP address. Applications and operating systems are responsible for processing the IPv6 or IPv4 record that may be returned. With this in mind, a denial of service could easily be implemented for an application that is not IPv6-aware. When the application receives an IP address in hexadecimal, it is up to the application/operating system to decide how to handle the response. Combining both IPv6 and IPv4 records into the same domain can lead to application problems that are beyond the scope of the DNS administrator.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58625 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -786,6 +819,7 @@ On Windows 2012 DNS Server, during DNS resolution, DNS messages are sent from DN In general, all DNS queries are sent from a high-numbered source port (49152 or above) to destination port 53, and responses are sent from source port 53 to a high-numbered destination port.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58629 False By default, the Windows 2012 DNS Server listens on TCP 53 and opens UDP ports 53. Also by default, Windows 2012 DNS Server sends from random, high-numbered source ports 49152 and above. @@ -816,6 +850,7 @@ In addition to the re-authentication requirements associated with session locks, DNS does perform server authentication when DNSSEC or TSIG/SIG(0) are used, but this authentication is transactional in nature (each transaction has its own authentication performed). So this requirement is applicable for every server-to-server transaction request.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58631 False Authentication of dynamic updates is accomplished in Windows Server 2012 DNS by configuring the zones to only accept secure dynamic updates. @@ -846,6 +881,7 @@ TSIG and SIG(0) are not configurable in Windows 2012 DNS Server. To meet the requirement for authentication between Windows DNS servers, IPsec will be implemented between the Windows DNS servers which host any non-AD-integrated zones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58633 False Note: This requirement applies to any Windows DNS Server which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too. @@ -866,7 +902,7 @@ Click “Connection Security Rules”. Confirm at least one rule is configured for TCP 53. -Double-click on each Rule to verify the following: +Double-click on each Rule to verify the following: On the “Authentication” tab, "Authentication mode:" is set to "Request authentication for inbound and outbound connections". @@ -885,6 +921,7 @@ If there are not rules(s) configured with the specified requirements, this is a This requirement applies to server-to-server (zone transfer) transactions only and is provided by TSIG/SIG(0), which enforces mutual server authentication using a key that is unique to each server pair (TSIG) or using PKI-based authentication (SIG(0)).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58635 False Authenticity of zone transfers within Windows AD integrated zones is accomplished by AD replication. @@ -937,6 +974,7 @@ If the results do not show the RRSIG and signature information, indicating the z AD-integrated DNS servers replicate zone information via AD replication. Non-AD-integrated DNS servers replicate zone information via zone transfers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58637 False If the DNS server only hosts AD-integrated zones and there are not any non-AD-integrated DNS servers acting as secondary DNS servers for the zones, this check is not applicable. @@ -971,6 +1009,7 @@ This requirement supports audit requirements that provide organizational personn DNSSEC and TSIG/SIG(0) both use digital signatures to establish the identity of the producer of particular pieces of information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58639 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1019,6 +1058,7 @@ If the results do not show the RRSIG and signature information, this is a findin This strategy is not feasible in situations in which the DNSSEC-aware name server has to support dynamic updates. To support dynamic update transactions, the DNSSEC-aware name server (which usually is a primary authoritative name server) has to have both the zone file master copy and the private key corresponding to the zone-signing key (ZSK-private) online to immediately update the signatures for the updated RRsets. The private key corresponding to the key-signing key (KSK-private) can still be kept off-line.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58647 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1035,6 +1075,7 @@ If a DNS server is not AD integrated and has file-backed zones, does not accept <VulnDiscussion>NSEC records list the resource record types for the name, as well as the name of the next resource record. With this information it is revealed that the resource record type for the name queried, or the resource record name requested, does not exist. NSEC uses the actual resource record names, whereas NSEC3 uses a one-way hash of the name. In this way, walking zone data from one record to the next is prevented, at the expense of some CPU cycles both on the authoritative server as well as on the resolver. To prevent giving access to an entire zone file, NSEC3 should be configured, and, in order to use NSEC3, RSA/SHA-1 should be used as the algorithm, as some resolvers that understand RSA/SHA-1 might not understand NSEC3. Using RSA/SHA-256 is a safe alternative.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58651 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1048,7 +1089,7 @@ Press Windows Key + R, execute dnsmgmt.msc. On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS Server, and then expand Forward Lookup Zones. -From the expanded list, click to select the zone. +From the expanded list, click to select the zone. Review the zone's RRs in the right window pane. @@ -1064,6 +1105,7 @@ The security objectives--and consequently the security services--that are requir The specification for a digital signature mechanism in the context of the DNS infrastructure is in IETF's DNSSEC standard. In DNSSEC, trust in the public key (for signature verification) of the source is established not by going to a third party or a chain of third parties (as in public key infrastructure [PKI] chaining), but by starting from a trusted zone (such as the root zone) and establishing the chain of trust down to the current source of response through successive verifications of signature of the public key of a child by its parent. The public key of the trusted zone is called the trust anchor.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58653 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1109,11 +1151,12 @@ If the results do not show the RRSIG and signature information, this is a findin - <VulnDiscussion>The major threat associated with DNS forged responses or failures are the integrity of the DNS data returned in the response. The principle of DNSSEC is to mitigate this threat by providing data origin authentication, establishing trust in the source. By requiring remote clients to obtain origin authentication and integrity verification assurances for the host/service name to network address resolution information obtained through the service, data origin is validated. + <VulnDiscussion>The major threat associated with DNS forged responses or failures are the integrity of the DNS data returned in the response. The principle of DNSSEC is to mitigate this threat by providing data origin authentication, establishing trust in the source. By requiring remote clients to obtain origin authentication and integrity verification assurances for the host/service name to network address resolution information obtained through the service, data origin is validated. Ensuring all name servers have static IP addresses makes it possible to configure restricted DNS communication, such as with DNSSEC, between the name servers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58655 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -1134,6 +1177,7 @@ If the “Use the following IP address” is not selected with a configured IP a <VulnDiscussion>The major threat associated with DNS forged responses or failures is the integrity of the DNS data returned in the response. The principle of DNSSEC is to mitigate this threat by providing data origin authentication, establishing trust in the source. By requiring remote clients to obtain origin authentication and integrity verification assurances for the host/service name to network address resolution information obtained through the service, data origin is validated.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58657 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1186,6 +1230,7 @@ A DNS server is an example of an information system providing name/address resol In the case of DNS, employ DNSSEC to provide an additional data origin and integrity artifacts along with the authoritative data the system returns in response to DNS name/address resolution queries.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58659 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1231,13 +1276,14 @@ If the results do not show the RRSIG and signature information, this is a findin <VulnDiscussion>The major threat associated with DNS forged responses or failures is the integrity of the DNS data returned in the response. The principle of DNSSEC is to mitigate this threat by providing data origin authentication, establishing trust in the source. By requiring remote clients to obtain origin authentication and integrity verification assurances for the host/service name to network address resolution information obtained through the service, data origin is validated. -A DNS server is an example of an information system providing name/address resolution service. Digital signatures and cryptographic keys are examples of additional artifacts. DNS resource records are examples of authoritative data. Applications other than the DNS, to map between host/service names and network addresses, must provide other means to assure the authenticity and integrity of response data. +A DNS server is an example of an information system providing name/address resolution service. Digital signatures and cryptographic keys are examples of additional artifacts. DNS resource records are examples of authoritative data. Applications other than the DNS, to map between host/service names and network addresses, must provide other means to assure the authenticity and integrity of response data. In the case of DNS, employ DNSSEC to provide an additional data origin and integrity artifacts along with the authoritative data the system returns in response to DNS name/address resolution queries. If/when WINS lookups are enabled, the validity of the data becomes questionable since the WINS data is provided to the requestor, unsigned and invalidated. In order to be assured only the DNSSEC-signed data is being returned, WINS lookups must be disabled.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58661 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -1257,11 +1303,12 @@ If the "Use WINS forward lookup" check box is selected, this is a finding. <VulnDiscussion>The major threat associated with DNS forged responses or failures is the integrity of the DNS data returned in the response. The principle of DNSSEC is to mitigate this threat by providing data origin authentication, establishing trust in the source. By requiring remote clients to obtain origin authentication and integrity verification assurances for the host/service name to network address resolution information obtained through the service, data origin is validated. -A DNS server is an example of an information system providing name/address resolution service. Digital signatures and cryptographic keys are examples of additional artifacts. DNS resource records are examples of authoritative data. Applications other than the DNS, to map between host/service names and network addresses, must provide other means to assure the authenticity and integrity of response data. +A DNS server is an example of an information system providing name/address resolution service. Digital signatures and cryptographic keys are examples of additional artifacts. DNS resource records are examples of authoritative data. Applications other than the DNS, to map between host/service names and network addresses, must provide other means to assure the authenticity and integrity of response data. In the case of DNS, employ DNSSEC to provide an additional data origin and integrity artifacts along with the authoritative data the system returns in response to DNS name/address resolution queries.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58663 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1307,7 +1354,7 @@ If the results do not show the RRSIG and signature information, this is a findin <VulnDiscussion>If name server replies are invalid or cannot be validated, many networking functions and communication would be adversely affected. With DNS, the presence of Delegation Signer (DS) records associated with child zones informs clients of the security status of child zones. These records are crucial to the DNSSEC chain of trust model. Each parent domain's DS record is used to verify the DNSKEY record in its sub domain, from the top of the DNS hierarchy down. -A DNS server is an example of an information system providing name/address resolution service. Digital signatures and cryptographic keys are examples of additional artifacts. DNS resource records are examples of authoritative data. Applications other than the DNS, to map between host/service names and network addresses, must provide other means to assure the authenticity and integrity of response data. +A DNS server is an example of an information system providing name/address resolution service. Digital signatures and cryptographic keys are examples of additional artifacts. DNS resource records are examples of authoritative data. Applications other than the DNS, to map between host/service names and network addresses, must provide other means to assure the authenticity and integrity of response data. In DNS, trust in the public key of the source is established by starting from a trusted name server and establishing the chain of trust down to the current source of response through successive verifications of signature of the public key of a child by its parent. @@ -1320,6 +1367,7 @@ An example means to indicate the security status of child subspaces is through t Path validation is necessary for a relying party to make an informed trust decision when presented with any certificate not already explicitly trusted. Without path validation and a chain of trust, there can be no trust that the data integrity authenticity has been maintained during a transaction.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58665 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1372,6 +1420,7 @@ Applications providing information flow control must be able to enforce approved Within the context of DNS, this is applicable in terms of controlling the flow of DNS information between systems, such as DNS zone transfers.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58667 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1382,7 +1431,7 @@ Press Windows Key + R, execute dnsmgmt.msc. On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones. -From the expanded list, click to select the zone. +From the expanded list, click to select the zone. Review the records for the zone and ensure the complete RRSet of records are present: RRSIG, NSEC3, DNSKEY, indicating DNSSEC compliance. @@ -1392,6 +1441,7 @@ If the RRSet of records are not in the zone, this is a finding. <VulnDiscussion>The Name Resolution Policy Table (NRPT) is used to require DNSSEC validation. The NRPT can be configured in local Group Policy for a single computer or domain Group Policy for some or all computers in the domain.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58669 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1409,7 +1459,7 @@ In the results, verify the "DnsSecValidationRequired" is True. If there are no results to the get-dnsclientnrptpolicy cmdlet or the "DnsSecValidationRequired" is not True, this is a finding. - <VulnDiscussion>If name server replies are invalid or cannot be validated, many networking functions and communication would be adversely affected. With DNS, the presence of Delegation Signer (DS) records associated with child zones informs clients of the security status of child zones. These records are crucial to the DNSSEC chain of trust model. Each parent domain's DS record is used to verify the DNSKEY record in its sub domain, from the top of the DNS hierarchy down. + <VulnDiscussion>If name server replies are invalid or cannot be validated, many networking functions and communication would be adversely affected. With DNS, the presence of Delegation Signer (DS) records associated with child zones informs clients of the security status of child zones. These records are crucial to the DNSSEC chain of trust model. Each parent domain's DS record is used to verify the DNSKEY record in its sub domain, from the top of the DNS hierarchy down. Like the DNSKEY resource record, the delegation signer (DS) resource record can be used to create a trust anchor for a signed zone. The DS record is smaller in size than a DNSKEY record because it contains only a hash of the public key. The DS record is not added to a zone during the signing process like some DNSSEC-related resource records, even if a delegation already exists in the zone. To add a DS record, you must manually add or import it. Fortunately, the DS resource record set (DSSET) is automatically added as a file to the Key Master when a zone is signed. The DSSET file can be used with the Import-DnsServerResourceRecordDS cmdlet to import DS records to the parent zone. @@ -1422,6 +1472,7 @@ Starting from a trusted name server (such as the root name server) and down to t This control enables the DNS to obtain origin authentication and integrity verification assurances for the host/service name to network address resolution information obtained through the service. Without indication of the security status of a child domain and enabling verification of a chain of trust, integrity and availability of the DNS infrastructure cannot be assured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58671 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1465,6 +1516,7 @@ This control enables the DNS to obtain origin authentication and integrity verif A trust anchor is a preconfigured public key associated with a specific zone. A validating DNS server must be configured with one or more trust anchors in order to perform validation. If the DNS server is running on a domain controller, trust anchors are stored in the forest directory partition in Active Directory Domain Services (AD DS) and can be replicated to all domain controllers in the forest. On standalone DNS servers, trust anchors are stored in a file named TrustAnchors.dns. A DNS server running Windows Server 2012 or Windows Server 2012 R2 also displays configured trust anchors in the DNS Manager console tree in the Trust Points container. Trust anchors can also be viewed by executing Windows PowerShell commands or Dnscmd.exe at a Windows command prompt.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58673 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1482,6 +1534,7 @@ If each validating Windows 2012 DNS Servers does not reflect the DNSKEY trust po <VulnDiscussion>A trust anchor is a preconfigured public key associated with a specific zone. A validating DNS server must be configured with one or more trust anchors in order to perform validation. If the DNS server is running on a domain controller, trust anchors are stored in the forest directory partition in Active Directory Domain Services (AD DS) and can be replicated to all domain controllers in the forest. On standalone DNS servers, trust anchors are stored in a file named TrustAnchors.dns. A DNS server running Windows Server 2012 or Windows Server 2012 R2 also displays configured trust anchors in the DNS Manager console tree in the Trust Points container. Trust anchors can also be viewed by executing Windows PowerShell commands or Dnscmd.exe at a Windows command prompt.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58675 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1514,6 +1567,7 @@ If the "Enable automatic rollover" check box is not selected for every KSK liste Each client of name resolution services either performs this validation on its own or has authenticated channels to trusted validation providers. Information systems that provide name and address resolution services for local clients include, for example, recursive resolving or caching DNS servers. DNS client resolvers either perform validation of DNSSEC signatures, or clients use authenticated channels to recursive resolvers that perform such validations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58677 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1562,6 +1616,7 @@ If the results do not show the RRSIG and signature information, this is a findin Each client of name resolution services either performs this validation on its own or has authenticated channels to trusted validation providers. Information systems that provide name and address resolution services for local clients include, for example, recursive resolving or caching DNS servers. DNS client resolvers either perform validation of DNSSEC signatures, or clients use authenticated channels to recursive resolvers that perform such validations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58679 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1610,6 +1665,7 @@ If the results do not show the RRSIG and signature information, this is a findin Each client of name resolution services either performs this validation on its own or has authenticated channels to trusted validation providers. Information systems that provide name and address resolution services for local clients include, for example, recursive resolving or caching DNS servers. DNS client resolvers either perform validation of DNSSEC signatures, or clients use authenticated channels to recursive resolvers that perform such validations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58681 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1658,6 +1714,7 @@ If the results do not show the RRSIG and signature information, this is a findin Each client of name resolution services either performs this validation on its own or has authenticated channels to trusted validation providers. Information systems that provide name and address resolution services for local clients include, for example, recursive resolving or caching DNS servers. DNS client resolvers either perform validation of DNSSEC signatures, or clients use authenticated channels to recursive resolvers that perform such validations.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58683 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1708,10 +1765,11 @@ TSIG and SIG(0) are not configurable in Windows 2012 DNS Server. To meet the requirement for authentication between Windows DNS servers, IPsec will be implemented between the Windows DNS servers which hosts any non-AD-integrated zones.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58685 False NOTE: This requirement applies to any Windows 2012 DNS Servers which host non-AD-integrated zones (file based) even if the DNS servers host AD-integrated zones, too. - + If the Windows 2012 DNS Servers only host AD-integrated zones, this requirement is not applicable. To protect authenticity of zone transfers between Windows 2012 DNS Servers with file based zones, IPsec must be configured on each pair of name servers in a zone transfer transaction for those zones. @@ -1735,7 +1793,7 @@ If Rules exist, double-click on each Rule to verify the following: For the "Authentication:" tab, click on the "Customize..." button. On the Authentication tab, verify "Authentication mode:" is set to "Request authentication for inbound and outbound connections". - + Confirm the "Signing Algorithm" is set to "RSA (default)". Under "Method", ensure the "Advanced:" radio button is selected. @@ -1758,6 +1816,7 @@ If rules exist for this server to authenticate to other name servers hosting the The combination of signing DNS zones by DNSSEC and requiring clients to send their dynamic updates securely assures the authenticity of those DNS records when providing query responses for them.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58687 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1806,6 +1865,7 @@ If the results do not show the RRSIG and signature information, this is a findin <VulnDiscussion>The underlying feature in the major threat associated with DNS query/response (i.e., forged response or response failure) is the integrity of DNS data returned in the response. An integral part of integrity verification is to ensure that valid data has originated from the right source. DNSSEC is required for securing the DNS query/response transaction by providing data origin authentication and data integrity verification through signature verification and the chain of trust.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58689 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -1853,7 +1913,7 @@ Fix Text: Sign, or re-sign, the hosted zone(s) on the DNS server being validated In the DNS Manager console tree on the DNS server being validated, navigate to Forward Lookup Zones. -Right-click the zone (repeat for each hosted zone), point to DNSSEC, and then click Sign the Zone, either using saved parameters or custom parameters. +Right-click the zone (repeat for each hosted zone), point to DNSSEC, and then click Sign the Zone, either using saved parameters or custom parameters. @@ -1868,6 +1928,7 @@ NOTE: If multiple certificates from the same CA are present on the DNS server, I Refer to the U_Windows_Domain_Name_Service_2012_Overview.pdf for references on deploying certificates for this procedure.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58691 False NOTE: This requirement applies to any Windows 2012 DNS Servers which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too. @@ -1894,7 +1955,7 @@ Double-click on each Rule to verify the following: For the "Authentication:" tab, click on the "Customize..." button. On the Authentication tab, verify "Authentication mode:" is set to "Request authentication for inbound and outbound connections". - + Confirm the "Signing Algorithm" is set to "RSA (default)". Under "Method", ensure the "Advanced:" radio button is selected. Click on the "Customize" button. @@ -1913,11 +1974,12 @@ If the certificate used does not meet the requirements, this is a finding. False + V-58693 False To ensure the cryptographic keys are protected after being backed up to another medium (tape, disk, SAN, etc.), consult with the System Administrator to determine the backup policy in place for the DNS Server. -Determine how and where backed up data is being stored. +Determine how and where backed up data is being stored. Verify the protection of the backup medium is secured to the same level, or higher, as the server itself. @@ -1928,6 +1990,7 @@ If a backup policy does not exist or the backup policy does not specify the prot <VulnDiscussion>In the case of application DoS attacks, care must be taken when designing the application to ensure the application makes the best use of system resources. SQL queries have the potential to consume large amounts of CPU cycles if they are not tuned for optimal performance. Web services containing complex calculations requiring large amounts of time to complete can bog down if too many requests for the service are encountered within a short period of time.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58699 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -1959,6 +2022,7 @@ Communication paths outside the physical protection of a controlled boundary are Confidentiality is not an objective of DNS, but integrity is. DNSSEC and TSIG/SIG(0) both digitally sign DNS information to authenticate its source and ensure its integrity.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58701 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -2005,6 +2069,7 @@ If the results do not show the RRSIG and signature information, this is a findin <VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58703 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -2051,6 +2116,7 @@ If the results do not show the RRSIG and signature information, this is a findin <VulnDiscussion>Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58705 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -2101,7 +2167,7 @@ The choice of digital signature algorithm will be based on recommended algorithm * RSA * Elliptic Curve DSA (ECDSA). -Of these three algorithms, RSA and DSA are more widely available and considered candidates of choice for DNSSEC. In terms of performance, both RSA and DSA have comparable signature generation speeds, but DSA is much slower for signature verification. RSA is the recommended algorithm as far as this guideline is concerned. +Of these three algorithms, RSA and DSA are more widely available and considered candidates of choice for DNSSEC. In terms of performance, both RSA and DSA have comparable signature generation speeds, but DSA is much slower for signature verification. RSA is the recommended algorithm as far as this guideline is concerned. RSA with SHA-1 is currently the only cryptographic algorithm mandated to be implemented with DNSSEC, although other algorithm suites (i.e. RSA/SHA-256, ECDSA) are also specified. @@ -2110,6 +2176,7 @@ It can be expected that name servers and clients will be able to use the RSA alg NIST's Secure Hash Standard (SHS) (FIPS 180-3) specifies SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 as approved hash algorithms to be used as part of the algorithm suite for generating digital signatures using the digital signature algorithms in the NIST's DSS[FIPS186]. It is expected that there will be support for Elliptic Curve Cryptography in the DNSSEC. The migration path for USG DNSSEC operation will be to ECDSA (or similar) from RSA/SHA-1 and RSA/SHA-256 before September 30th, 2015.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58557 False Note: This requirement applies to any Windows DNS Server which host non-AD-integrated zones even if the DNS servers host AD-integrated zones, too. If the Windows DNS Server only hosts AD-integrated zones and does not host any file-based zones, this is not applicable. @@ -2157,6 +2224,7 @@ If the results do not show the RRSIG and signature information, this is a findin <VulnDiscussion>DNS zone data for which a Windows 2012 DNS server is authoritative should represent the network for which it is responsible. If a Windows 2012 DNS server hosts zone records for other networks or environments, there is the possibility for the records to become invalid or stale or be redundant/conflicting with a DNS server truly authoritative for the other network environment.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58707 False Consult with the System Administrator to determine the IP ranges for the environment. @@ -2185,6 +2253,7 @@ If any zone information is for a different IP range or domain, this is a finding In some installations, it may not be possible to switch over to the latest version of name server software immediately. If the version of the name server software is revealed in queries, this information may be used by attackers who are looking for a specific version of the software which has a discovered weakness. To prevent information about which version of name server software is running on a system, name servers should be configured to refuse queries for its version information.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58737 False The "EnableVersionQuery" property controls what version information the DNS server will respond with when a DNS query with class set to “CHAOS” and type set to “TXT” is received. @@ -2216,6 +2285,7 @@ A DNS administrator should take care when including HINFO, RP, TXT, LOC, or othe RRs such as HINFO and TXT provide information about software name and versions (e.g., for resources such as Web servers and mail servers) that will enable the well-equipped attacker to exploit the known vulnerabilities in those software versions and launch attacks against those resources.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58739 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -2231,13 +2301,14 @@ Review the zone's Resource Records (RR) and verify HINFO, RP, and LOC RRs are no If there are any HINFO, RP, LOC, or revealing TXT RRs in any zone hosted by the DNS Server, this is a finding. - <VulnDiscussion>Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Without verification, security functions may not operate correctly and this failure may go unnoticed. + <VulnDiscussion>Security function is defined as the hardware, software, and/or firmware of the information system responsible for enforcing the system security policy and supporting the isolation of code and data on which the protection is based. Security functionality includes, but is not limited to, establishing system accounts, configuring access authorizations (i.e., permissions, privileges), setting events to be audited, and setting intrusion detection parameters. Without verification, security functions may not operate correctly and this failure may go unnoticed. Notifications provided by information systems include, for example, electronic alerts to system administrators, messages to local computer consoles, and/or hardware indications, such as lights. The DNS server should perform self-tests, such as at server start-up, to confirm that its security functions are working properly.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58713 False This functionality should be performed by the Host Based Security System (HBSS), mandatory on all DoD systems. @@ -2254,6 +2325,7 @@ A DNS server's function requires it to be able to handle multiple sessions at a Primary name servers need to be configured to limit the actual hosts from which they will accept dynamic updates and from which they will accept zone transfer requests, and all name servers should be configured to limit the hosts from/to which they receive/send zone transfers. Restricting sessions to known hosts will mitigate the DoS vulnerability.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58237 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -2286,6 +2358,7 @@ In order to compile an accurate risk assessment, it is essential for security pe Data required to be captured include: whether an event was successful or failed, the event type or category, timestamps for when the event occurred, where the event originated, who/what initiated the event, affect the event had on the DNS implementation and any processes associated with the event.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58551 False Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. @@ -2295,10 +2368,10 @@ Open an elevated Windows PowerShell prompt on a DNS server using the Domain Admi Use the “Get-DnsServerDiagnostics” cmdlet to view the status of individual diagnostic events. Verify following diagnostic events are set to "True": -Queries, Answers, Notifications, Update, QuestionTransactions, UnmatcheResponse, SendPackets, ReceivePackets, TcpPackets, UdpPackets, FullPackets, UseSystemEventLog -Also set to “True” should be: +Queries, Answers, Notifications, Update, QuestionTransactions, UnmatcheResponse, SendPackets, ReceivePackets, TcpPackets, UdpPackets, FullPackets, UseSystemEventLog +Also set to “True” should be: EnableLoggingForLocalLookupEvent -EnableLoggingForPluginDLLEvent +EnableLoggingForPluginDLLEvent EnableLoggingForRecursiveLookupEvent EnableLoggingForRemoteServerEvent EnableLoggingForRemoteServerEvent @@ -2313,13 +2386,14 @@ If all required diagnostic events are not set to "True", this is a finding. - <VulnDiscussion>Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on a defined frequency helps to assure, in the event of a catastrophic system failure, the audit records will be retained. + <VulnDiscussion>Protection of log data includes assuring log data is not accidentally lost or deleted. Backing up audit records to a different system or onto separate media than the system being audited on a defined frequency helps to assure, in the event of a catastrophic system failure, the audit records will be retained. This helps to ensure a compromise of the information system being audited does not also result in a compromise of the audit records. This requirement only applies to applications that have a native backup capability for audit records. Operating system backup requirements cover applications that do not provide native backup functions.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58573 False Consult with the System Administrator to determine the backup policy in place for Windows DNS Server. @@ -2335,6 +2409,7 @@ If the organization does not have a backup policy in place for backing up the Wi To prevent the impact of a compromised KSK, a delegating parent should set the signature validity period for RRSIGs covering DS RRs in the range of a few days to 1 week. This re-signing does not require frequent rollover of the parent's ZSK, but scheduled ZSK rollover should still be performed at regular intervals.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58575 False Note: This check is Not applicable for Windows 2012 DNS Servers that only host Active Directory integrated zones or for Windows 2012 DNS servers on a Classified network. @@ -2345,9 +2420,9 @@ Press Windows Key + R, execute dnsmgmt.msc. On the opened DNS Manager snap-in from the left pane, expand the server name for the DNS server, and then expand Forward Lookup Zones. -From the expanded list, click to select the zone. +From the expanded list, click to select the zone. -View the validity period for the DS Resource Record. +View the validity period for the DS Resource Record. If the validity period for the DS Resource Record for the child domain is less than two days (48 hours) or more than one week (168 hours), this is a finding. @@ -2357,9 +2432,10 @@ If the validity period for the DS Resource Record for the child domain is less t A network administrator may choose to use a "hidden" master authoritative server and only have secondary servers visible on the network. A hidden master authoritative server is an authoritative DNS server whose IP address does not appear in the name server set for a zone. If the master authoritative name server is "hidden", a secondary authoritative name server may reside in the same building as the hidden master.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls> False + V-58577 False - Windows DNS Servers that are Active Directory integrated must be located where required to meet the Active Directory services. + Windows DNS Servers that are Active Directory integrated must be located where required to meet the Active Directory services. If all of the Windows DNS Servers are AD integrated, this check is Not Applicable. @@ -2394,6 +2470,7 @@ SIG(0) is used for server-to-server authentication for DNS transactions, and it True False + V-58641 False %ALLUSERSPROFILE%\Microsoft\Crypto\Keys @@ -2433,12 +2510,13 @@ If any other user or group has greater than READ privileges to the %ALLUSERSPROF V-215604 True False + V-58643 False %ALLUSERSPROFILE%\Microsoft\Crypto\Keys Access Services on the Windows DNS Server and locate the DNS Server Service. -Determine the account under which the DNS Server Service is running. +Determine the account under which the DNS Server Service is running. Access Windows Explorer. @@ -2477,6 +2555,7 @@ If any other user or group is listed as OWNER of the %ALLUSERSPROFILE%\Microsoft V-215604 True False + V-58645 False %ALLUSERSPROFILE%\Microsoft\Crypto\Keys @@ -2527,6 +2606,7 @@ Since the configuration of the audit logs on the DNS server dictates which event True False + V-58553.a False %windir%\SYSTEM32\WINEVT\LOGS\DNS Server.evtx @@ -2538,12 +2618,12 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo If any accounts or groups other than the following are granted the "Manage auditing and security log" user right, this is a finding: -Administrators +Administrators Auditors (if the site has an Auditors group that further limits this privilege.) -If an application requires this user right, this would not be a finding. -Vendor documentation must support the requirement for having the user right. -The requirement must be documented with the ISSO. +If an application requires this user right, this would not be a finding. +Vendor documentation must support the requirement for having the user right. +The requirement must be documented with the ISSO. The application account must meet requirements for application account passwords. Verify the permissions on the DNS logs. @@ -2575,15 +2655,16 @@ If the permissions for these files are not as restrictive as the ACLs listed, th Present False HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters + V-58627 True ValueData is set to 255 which disables IPv6 Note: If the Windows 2012 DNS server is hosting IPv6 records, this requirement is not applicable. If the Windows 2012 DNS server is only hosting IPv4 records, this requirement must be met. Log on to the DNS server using the Domain Admin or Enterprise Admin account or Local Administrator account. -From a command prompt, run regedit. -In the User Account Control dialog box, click Continue. -In Registry Editor, locate and then click the following registry subkey: +From a command prompt, run regedit. +In the User Account Control dialog box, click Continue. +In Registry Editor, locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters \ Verify the value for “DisabledComponents” is “255 (0xff)”. @@ -2605,6 +2686,7 @@ If the “DisabledComponents” exists but is not set to “255 (0xff)”, and t True Administrators False + V-58697 False If any accounts or groups other than the following are granted the "Allow log on through Remote Desktop Services" user right, this is a finding: @@ -2619,6 +2701,7 @@ Administrators False Guests False + V-58697 False If the following accounts or groups are not defined for the "Deny access to this computer from the network" user right, this is a finding: @@ -2633,6 +2716,7 @@ Guests Group False Guests False + V-58697 False If the following accounts or groups are not defined for the "Deny log on locally" user right, this is a finding: @@ -2649,6 +2733,7 @@ Since the configuration of the audit logs on the DNS server dictates which event True Administrators,Auditors,Verify the permissions on the DNS logs.,Standard user accounts or groups must not have greater than READ access.,DNS Server %SystemRoot%\System32\Winevt\Logs\DNS Server.evtx,Using the file explorer tool navigate to the DNS Server log file.,Right click on the log file, select the “Security” tab.,Eventlog - Full Control,SYSTEM - Full Control,Administrators - Full Control False + V-58553.b False Verify the effective setting in Local Group Policy Editor. @@ -2659,12 +2744,12 @@ Navigate to Local Computer Policy >> Computer Configuration >> Windo If any accounts or groups other than the following are granted the "Manage auditing and security log" user right, this is a finding: -Administrators +Administrators Auditors (if the site has an Auditors group that further limits this privilege.) -If an application requires this user right, this would not be a finding. -Vendor documentation must support the requirement for having the user right. -The requirement must be documented with the ISSO. +If an application requires this user right, this would not be a finding. +Vendor documentation must support the requirement for having the user right. +The requirement must be documented with the ISSO. The application account must meet requirements for application account passwords. Verify the permissions on the DNS logs.