What changed in Microsoft Windows PAW STIG V3R3V3R3 changes

Check text

Note: This requirement is Not Applicable (NA) if the Endpoint Security Solution (ESS) managed system is used on the PAW and application white listing is enforced. Verify Device Guard is enforcing a code integrity policy to restrict authorized applications. Run "PowerShell" with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root1Microsoft1Windows1DeviceGuard | FL *codeintegrity*" If "CodeIntegrityPolicyEnforcementStatus" does not have a value of "2" indicating "Enforced", this is a finding. (For reference: 0 - Not Configured; 1 - Audit; 2 - Enforced) Alternately: - Run "System Information". - Under "System Summary", verify the following: If "Device Guard Code Integrity Policy" does not display "Enforced", this is finding.

Fix text

Implement aan whitelistallowlist of authorized PAW applications using Device Guard. See the Device Guard Deployment Guide (https://docs.microsoft.com/en-us/windows/device-security/device-guard/device-guard-deployment-guide) for deployment information and hardware requirements and the IAD Device Guard document "Implementing a Secure Administrative Workstation using Device Guard" at https://github.com/iadgov/Secure-Host-Baseline/tree/master/Device%20Guard.

V-243450 in V3R3

Check text

Note: This requirement is Not Applicable (NA) if the Endpoint Security Solution (ESS) managed system is used on the PAW and application white listing is enforced. Verify Device Guard is enforcing a code integrity policy to restrict authorized applications. Run "PowerShell" with elevated privileges (run as administrator). Enter the following: "Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root1Microsoft1Windows1DeviceGuard | FL *codeintegrity*" If "UserModeCodeIntegrityPolicyEnforcementStatus" does not have a value of "2" indicating "Enforced", this is a finding. (For reference: 0 - Not Configured; 1 - Audit; 2 - Enforced) Alternately: - Run "System Information". - Under "System Summary", verify the following: If "Device Guard user mode Code Integrity" does not display "Enforced", this is finding.

Fix text

Implement aan whitelistallowlist of authorized PAW applications using Device Guard. See the Device Guard Deployment Guide (https://docs.microsoft.com/en-us/windows/device-security/device-guard/device-guard-deployment-guide) for deployment information and hardware requirements and the IAD Device Guard document "Implementing a Secure Administrative Workstation using Device Guard" at https://github.com/iadgov/Secure-Host-Baseline/tree/master/Device%20Guard.

V-243451 in V3R3

Check text

Obtain a list of all ports and services required for site monitoring, scanning, and management tools. Review the configuration setting of the PAW host-based firewall. Verify the firewall is configured to block all inbound ports and services from a PAW except as needed for monitoring, scanning, and management tools or when the inbound communication is a response to an outbound connection request. Note: The exact procedure for verifying the configuration will depend on which host-based firewall (for example, Endpoint Security Solution [ESS]) is used on the PAW. DoDDOD sites should refer to DoDDOD policies and firewall STIGs to determine acceptable firewallsfirewall products. If the PAW host-based firewall is not configured to block all inbound ports and services from a PAW except as needed for monitoring, scanning, and management tools or when the inbound communication is a response to an outbound connection request, this is a finding.

Fix text

Determine which inbound ports, services, addresses, or subnets are needed on the PAW for the organization's monitoring, scanning, and management tools. Configure the host-based firewall on the PAW to block all inbound connection requests except for organizational monitoring, scanning, and management tools or for inbound connections that are responses to outbound connection requests. Configure the host-based firewall on the PAW to block users with local administrative access from creating or modifying local firewall rules. Note: The exact configuration procedure will depend on which host-based firewall (for example, ESS) is used on the PAW. DoDDOD sites should refer to DoDDOD policies and firewall STIGs to determine acceptable firewallsfirewall products.

V-243460 in V3R3

Fix text

Configure the PAW host-based firewall to block outbound connection requests to the internet gateway or configure the PAW with an internet proxy address with a loopback address. Allowed exceptions include connections to communicate with IT resources being managed via the PAW, including the management console of authorized public cloud services, with domain controllers, or with a digital credential verification service (for example, OCSP). If the PAW host-based firewall method is used, configure the firewall to block outbound connection requests to the internet gateway. The exact configuration procedure will depend on which host-based firewall (for example, Endpoint Security Solution [ESS]) is used on the PAW. DoDDOD sites should refer to DoDDOD policies and firewall STIGs to determine acceptable firewallsfirewall products. If the internet proxy address with a loopback address method is used, consider using the configuration instructions listed in the Microsoft Privileged Access Workstation paper. In addition, disable the capability of the administrator to manually override the proxy settings on each PAW.

V-243461 in V3R3