SV-83437r1: Data Execution Prevention (DEP) must be configured to at least OptOut. | Windows 7 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

Data Execution Prevention (DEP) must be configured to at least OptOut.

Description

Discussion Text

Attackers are constantly looking for vulnerabilities in systems and applications. Data Execution Prevention (DEP) prevents harmful code from running in protected memory locations reserved for Windows and other programs.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-002824

References

DPMS Target Windows 7 DISA DPMS Target Windows 7 1712

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

# Windows PowerShell
# Reconstructed from oval:mil.disa.fso.windows:def:5151
# Data Execution Prevention (DEP) must be configured to at least OptOut.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# Verifies EMET is installed
# registry_object (registry_test)
function test_1 {
  return (($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products' -Name 'Comments')) -or ($null -ne (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products' -Name 'Comments')))
}
# Verifies EMET 5.5 or higher is installed
# registry_object (registry_test)
function test_2 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\').GetValueKind('DisplayVersion').ToString()]) -eq 'reg_sz') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\' -Name 'DisplayVersion' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'DisplayVersion') -ge '5.5'))
}
# Verifies 'System DEP' is set to 'Enabled' with 'Application Opt Out' selected
# registry_object (registry_test)
function test_3 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\SysSettings').GetValueKind('DEP').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\SysSettings' -Name 'DEP' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'DEP') -eq 2))
}
# Verifies 'System DEP' is set to 'Enabled' with 'Always On' selected
# registry_object (registry_test)
function test_4 {
  return (((@{String='reg_sz';ExpandString='reg_expand_sz';Binary='reg_binary';DWord='reg_dword';MultiString='reg_multi_sz';QWord='reg_qword';None='reg_none'}[(Get-Item -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\SysSettings').GetValueKind('DEP').ToString()]) -eq 'reg_dword') -and (((Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\SysSettings' -Name 'DEP' -ErrorAction SilentlyContinue) | Select-Object -ExpandProperty 'DEP') -eq 1))
}
# Verifies DEP is set to 'OptOut'
# wmi57_object (wmi57_test)
function test_5 {
  return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT dataexecutionprevention_supportpolicy FROM win32_operatingsystem' | Select-Object -First 1) | Select-Object -ExpandProperty 'dataexecutionprevention_supportpolicy') -eq '3')
}
# Verifies DEP is set to 'AlwaysOn'
# wmi57_object (wmi57_test)
function test_6 {
  return (((Get-CimInstance -Namespace 'root\cimv2' -Query 'SELECT dataexecutionprevention_supportpolicy FROM win32_operatingsystem' | Select-Object -First 1) | Select-Object -ExpandProperty 'dataexecutionprevention_supportpolicy') -eq '1')
}

if (((test_1 -and test_2 -and (test_3 -or test_4)) -or test_5 -or test_6)) {
  Write-Output "PASS"
} else {
  Write-Output "FAIL"
}

Remediation

Configure DEP to at least OptOut.

				Open a command prompt (cmd.exe) or PowerShell with elevated privileges (Run as administrator).
				Enter "BCDEDIT /set {current} nx OptOut".  (If using PowerShell "{current}" must be enclosed in quotes.)
				"AlwaysOn", a more restrictive selection, is also valid but does not allow applications that do not function properly to be opted out of DEP.

				Note: Suspend BitLocker before making changes to the DEP configuration.

				Opted out exceptions can be configured in the "System Properties".

				Open "System" in Control Panel.
				Select "Advanced system settings".
				Click "Settings" in the "Performance" section.
				Select the "Data Execution Prevention" tab.
				Applications that are opted out are configured in the window below the selection "Turn on DEP for all programs and services except those I select:".