III - Administrative Sensitive
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000096-GPOS-00050
Group -
The TFTP Client must not be installed on the system.
The "TFTP Client" is not installed by default. Some protocols and services do not support required security features, such as encrypting passwords or traffic.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Software certificate installation files must be removed from Windows 11.
Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
A host-based firewall must be installed and enabled on the system.
A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.Rule Medium Severity -
SRG-OS-000480-GPOS-00232
Group -
Inbound exceptions to the firewall on Windows 11 domain workstations must only allow authorized remote management hosts.
Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised. Limiting inbound connections only from authorized remote ...Rule Medium Severity -
SRG-OS-000433-GPOS-00193
Group -
Data Execution Prevention (DEP) must be configured to at least OptOut.
Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windo...Rule High Severity -
SRG-OS-000433-GPOS-00192
Group -
Structured Exception Handling Overwrite Protection (SEHOP) must be enabled.
Attackers are constantly looking for vulnerabilities in systems and applications. Structured Exception Handling Overwrite Protection (SEHOP) blocks exploits that use the Structured Exception Handli...Rule High Severity -
SRG-OS-000095-GPOS-00049
Group -
The Windows PowerShell 2.0 feature must be disabled on the system.
Windows PowerShell 5.0 added advanced logging features which can provide additional detail when malware has been run on a system. Disabling the Windows PowerShell 2.0 mitigates against a downgrade ...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
The Server Message Block (SMB) v1 protocol must be disabled on the system.
SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS complian...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
The Server Message Block (SMB) v1 protocol must be disabled on the SMB server.
SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS complian...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
The Server Message Block (SMB) v1 protocol must be disabled on the SMB client.
SMBv1 is a legacy protocol that uses the MD5 algorithm as part of SMB. MD5 is known to be vulnerable to a number of attacks such as collision and preimage attacks as well as not being FIPS complian...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
The Secondary Logon service must be disabled on Windows 11.
The Secondary Logon service provides a means for entering alternate credentials, typically used to run commands with elevated privileges. Using privileged credentials in a standard user session can...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Orphaned security identifiers (SIDs) must be removed from user rights on Windows 11.
Accounts or groups given rights on a system may show up as unresolved SIDs for various reasons including deletion of the accounts or groups. If the account or group objects are reanimated, there is...Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
Bluetooth must be turned off unless approved by the organization.
If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.Rule Medium Severity -
SRG-OS-000095-GPOS-00049
Group -
Bluetooth must be turned off when not in use.
If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The system must notify the user when a Bluetooth device attempts to connect.
If not configured properly, Bluetooth may allow rogue devices to communicate with a system. If a rogue device is paired with a system, there is potential for sensitive information to be compromised.Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
Administrative accounts must not be used with applications that access the internet, such as web browsers, or with potential internet sources, such as email.
Using applications that access the internet or have potential internet sources using administrative privileges exposes a system to compromise. If a flaw in an application is exploited while running...Rule High Severity -
SRG-OS-000185-GPOS-00079
Group -
Windows 11 nonpersistent VM sessions must not exceed 24 hours.
For virtual desktop implementations (VDIs) where the virtual desktop instance is deleted or refreshed upon logoff, the organization must enforce that sessions be terminated within 24 hours. This wo...Rule Medium Severity -
SRG-OS-000355-GPOS-00143
Group -
The Windows 11 time service must synchronize with an appropriate DOD time source.
The Windows Time Service controls time synchronization settings. Time synchronization is essential for authentication and auditing purposes. If the Windows Time Service is used, it must synchronize...Rule Low Severity -
SRG-OS-000329-GPOS-00128
Group -
Windows 11 account lockout duration must be configured to 15 minutes or greater.
The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the amount of time that an account will remain locked after the specified nu...Rule Medium Severity -
SRG-OS-000021-GPOS-00005
Group -
The number of allowed bad logon attempts must be configured to three or less.
The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the lo...Rule Medium Severity -
SRG-OS-000021-GPOS-00005
Group -
The period of time before the bad logon counter is reset must be configured to 15 minutes.
The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the cou...Rule Medium Severity -
SRG-OS-000077-GPOS-00045
Group -
The password history must be configured to 24 passwords remembered.
A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change a password to a unique password on a regularly schedule...Rule Medium Severity -
SRG-OS-000076-GPOS-00044
Group -
The maximum password age must be configured to 60 days or less.
The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system ...Rule Medium Severity -
SRG-OS-000075-GPOS-00043
Group -
The minimum password age must be configured to at least 1 day.
Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose o...Rule Medium Severity -
SRG-OS-000078-GPOS-00046
Group -
Passwords must, at a minimum, be 14 characters.
Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system an...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.