Microsoft Windows 10 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-OS-000480-GPOS-00227
Group -
Domain-joined systems must use Windows 10 Enterprise Edition 64-bit version.
Features such as Credential Guard use virtualization-based security to protect information that could be used in credential theft attacks if compromised. A number of system requirements must be met...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Windows 10 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use.
Credential Guard uses virtualization-based security to protect information that could be used in credential theft attacks if compromised. A number of system requirements must be met for Credential ...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Windows 10 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS.
UEFI provides additional security features in comparison to legacy BIOS firmware, including Secure Boot. UEFI is required to support additional security features in Windows 10, including Virtualiza...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Secure Boot must be enabled on Windows 10 systems.
Secure Boot is a standard that ensures systems boot only to a trusted operating system. Secure Boot is required to support additional security features in Windows 10, including Virtualization Based...Rule Low Severity -
SRG-OS-000191-GPOS-00080
Group -
SRG-OS-000185-GPOS-00079
Group -
Windows 10 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest.
If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, t...Rule High Severity -
SRG-OS-000185-GPOS-00079
Group -
Windows 10 systems must use a BitLocker PIN for pre-boot authentication.
If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, t...Rule High Severity -
SRG-OS-000185-GPOS-00079
Group -
SRG-OS-000370-GPOS-00155
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000480-GPOS-00227
Group -
The Windows 10 system must use an anti-virus program.
Malicious software can establish a base on individual desktops and servers. Employing an automated mechanism to detect this type of software will aid in elimination of the software from the operati...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
SRG-OS-000480-GPOS-00227
Group -
Alternate operating systems must not be permitted on the same system.
Allowing other operating systems to run on a secure system may allow security to be circumvented.Rule Medium Severity -
SRG-OS-000138-GPOS-00069
Group -
SRG-OS-000118-GPOS-00060
Group -
SRG-OS-000324-GPOS-00125
Group -
SRG-OS-000480-GPOS-00227
Group -
SRG-OS-000095-GPOS-00049
Group -
Only authorized user accounts must be allowed to create or run virtual machines on Windows 10 systems.
Allowing other operating systems to run on a secure system may allow users to circumvent security. For Hyper-V, preventing unauthorized users from being assigned to the Hyper-V Administrators group...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Standard local user accounts must not exist on a system in a domain.
To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain. Users must log on to worksta...Rule Low Severity -
SRG-OS-000076-GPOS-00044
Group -
Accounts must be configured to require password expiration.
Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.Rule Medium Severity -
SRG-OS-000312-GPOS-00122
Group -
SRG-OS-000095-GPOS-00049
Group -
Internet Information System (IIS) or its subcomponents must not be installed on a workstation.
Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted. Websites must only be hosted on servers that have been designed for that purpose and can be...Rule High Severity -
SRG-OS-000096-GPOS-00050
Group -
SRG-OS-000095-GPOS-00049
Group -
SRG-OS-000096-GPOS-00050
Group -
SRG-OS-000096-GPOS-00050
Group -
SRG-OS-000480-GPOS-00227
Group -
Software certificate installation files must be removed from Windows 10.
Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
A host-based firewall must be installed and enabled on the system.
A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Inbound exceptions to the firewall on Windows 10 domain workstations must only allow authorized remote management hosts.
Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised. Limiting inbound connections only from authorized remote...Rule Medium Severity -
SRG-OS-000433-GPOS-00192
Group -
Data Execution Prevention (DEP) must be configured to at least OptOut.
Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windo...Rule High Severity -
SRG-OS-000433-GPOS-00192
Group -
Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.
Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the Structured Exception Handli...Rule High Severity -
SRG-OS-000095-GPOS-00049
Group -
SRG-OS-000095-GPOS-00049
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.