Windows 10: Windows Security CIS Benchmark

Sergio.21 · Sep 2, 2021

Hello guys, hope that you were ok.I have a question related to CIS Benchmarks that apply to Workstations:According to the latest document issued https://workbench.cisecurity.org/sections/875515/recommendations/1438111 - Chapter 2.3.4.2 L2 Ensure 'Devices: Prevent users from installing printer drivers' is set to 'Enabled' AutomatedIs recommended the following instruction related to GPO to improve the security:Remediation:To establish the recommended configuration via GP, set

:)

Brink · Sep 2, 2021

CIS Microsoft 365 Foundations Benchmark now available

We’re excited to announce the availability of the Center for Internet Security’s (CIS) Microsoft 365 Foundations Benchmark—developed by CIS in partnership with Microsoft—to provide prescriptive guidance for establishing a secure baseline configuration for Microsoft 365. CIS is a nonprofit entity focused on developing global standards and recognized best practices for securing IT systems and data against the most pervasive attacks.

Microsoft 365 provides powerful online cloud services that enable collaboration, security, and compliance, mobility, intelligence, and analytics. Adopting cloud technologies requires a shared responsibility model for security, with Microsoft responsible for certain controls and the customer responsible for others, depending on the service delivery model chosen. To ensure that a customer’s cloud workloads are protected, it is important that they carefully consider and implement the appropriate architecture and enable the right set of configuration settings.

The CIS Microsoft 365 Foundations Benchmark is designed to assist organizations in establishing the foundation level of security for anyone adopting Microsoft 365. The benchmark should not be considered as an exhaustive list of all possible security configurations and architecture but as a starting point. Each organization must still evaluate their specific situation, workloads, and compliance requirements and tailor their environment accordingly.

The CIS benchmark contains two levels, each with slightly different technical specifications:

Level 1—Recommended minimum security settings that should be configured on any system and should cause little or no interruption of service or reduced functionality.

Level 2—Recommended security settings for highly secure environments and could result in some reduced functionality.

The CIS Microsoft 365 Security Benchmark is divided into the following sections:

[table][tr][td]Section[/td] [td]Description[/td] [td]# of recommended controls[/td] [/tr] [tr][td]Account/Authentication policies[/td] [td]Recommendations related to setting the appropriate account and authentication policies.[/td] [td]8[/td] [/tr] [tr][td]Application permissions[/td] [td]Recommendations related to the configuration of application permissions within Microsoft 365.[/td] [td]4[/td] [/tr] [tr][td]Data management[/td] [td]Recommendations for setting data management policies.[/td] [td]6[/td] [/tr] [tr][td]Email security/Exchange Online[/td] [td]Recommendations related to the configuration of Exchange Online and email security.[/td] [td]13[/td] [/tr] [tr][td]Auditing policies[/td] [td]Recommendations for setting auditing policies on your Microsoft 365 tenant.[/td] [td]14[/td] [/tr] [tr][td]Storage policies[/td] [td]Recommendations for securely configuring storage policies.[/td] [td]2[/td] [/tr] [tr][td]Mobile device management[/td] [td]Recommendations for managing devices connecting to Microsoft 365.[/td] [td]13[/td] [/tr] [tr][td]Total recommendations[/td] [td]60[/td] [/tr] [/table]

Each recommendation contains several sections, including a recommendation identification number, title, and description; level or profile applicability; rationale; instructions for auditing the control; remediation steps; impact of implementing the control; default value; and references. For example, the first control contained in the benchmark is under the Account/Authentication policies section and is titled: 1.1 (L1) Ensure multifactor authentication is enabled for all users in administrative roles (Scored).

A control is marked as “Scored” or “Not Scored” based on whether it can be programmatically tested. In this case, recommendation 1.1 can be audited leveraging the Microsoft Graph and PowerShell cmdlet. The specific steps for auditing the control are contained in the “Audit” section for this specific recommendation. This recommendation is listed as a Level 1 control because it is only applied to Microsoft 365 administrative users and would not have a company-wide impact or produce less functionality for users. The rationale for recommendation 1.1 is that Microsoft 365 administrative accounts need to be protected due to their powerful privileges and with Multiple Factor Authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk to the Azure tenant.

Download the benchmark and provide your feedback

The CIS Microsoft 365 Security Benchmark is freely available for download in PDF format on the CIS website. In the continuity of their mission, feedback provided by those entrenched in using and implementing the benchmarks provides us the opportunity for continuous improvement of our products. Feedback can be made visible to CIS by creating a discussion thread or ticket within the CIS Microsoft 365 Foundations Benchmark community. In addition, Microsoft has developed a set of Office 365 security guidelines and best practices for our customers to follow. These guides can be found in Office 365 Security and Compliance documentation.
Click to expand...

Source: Best practices for securely using Microsoft 365 - the CIS Microsoft 365 Foundations Benchmark now available - Microsoft Secure

Brink · Sep 2, 2021

CIS Microsoft 365 Foundations Benchmark now available

We’re excited to announce the availability of the Center for Internet Security’s (CIS) Microsoft 365 Foundations Benchmark—developed by CIS in partnership with Microsoft—to provide prescriptive guidance for establishing a secure baseline configuration for Microsoft 365. CIS is a nonprofit entity focused on developing global standards and recognized best practices for securing IT systems and data against the most pervasive attacks.

Microsoft 365 provides powerful online cloud services that enable collaboration, security, and compliance, mobility, intelligence, and analytics. Adopting cloud technologies requires a shared responsibility model for security, with Microsoft responsible for certain controls and the customer responsible for others, depending on the service delivery model chosen. To ensure that a customer’s cloud workloads are protected, it is important that they carefully consider and implement the appropriate architecture and enable the right set of configuration settings.

The CIS Microsoft 365 Foundations Benchmark is designed to assist organizations in establishing the foundation level of security for anyone adopting Microsoft 365. The benchmark should not be considered as an exhaustive list of all possible security configurations and architecture but as a starting point. Each organization must still evaluate their specific situation, workloads, and compliance requirements and tailor their environment accordingly.

The CIS benchmark contains two levels, each with slightly different technical specifications:

Level 1—Recommended minimum security settings that should be configured on any system and should cause little or no interruption of service or reduced functionality.

Level 2—Recommended security settings for highly secure environments and could result in some reduced functionality.

The CIS Microsoft 365 Security Benchmark is divided into the following sections:

[table][tr][td]Section[/td] [td]Description[/td] [td]# of recommended controls[/td] [/tr] [tr][td]Account/Authentication policies[/td] [td]Recommendations related to setting the appropriate account and authentication policies.[/td] [td]8[/td] [/tr] [tr][td]Application permissions[/td] [td]Recommendations related to the configuration of application permissions within Microsoft 365.[/td] [td]4[/td] [/tr] [tr][td]Data management[/td] [td]Recommendations for setting data management policies.[/td] [td]6[/td] [/tr] [tr][td]Email security/Exchange Online[/td] [td]Recommendations related to the configuration of Exchange Online and email security.[/td] [td]13[/td] [/tr] [tr][td]Auditing policies[/td] [td]Recommendations for setting auditing policies on your Microsoft 365 tenant.[/td] [td]14[/td] [/tr] [tr][td]Storage policies[/td] [td]Recommendations for securely configuring storage policies.[/td] [td]2[/td] [/tr] [tr][td]Mobile device management[/td] [td]Recommendations for managing devices connecting to Microsoft 365.[/td] [td]13[/td] [/tr] [tr][td]Total recommendations[/td] [td]60[/td] [/tr] [/table]

Each recommendation contains several sections, including a recommendation identification number, title, and description; level or profile applicability; rationale; instructions for auditing the control; remediation steps; impact of implementing the control; default value; and references. For example, the first control contained in the benchmark is under the Account/Authentication policies section and is titled: 1.1 (L1) Ensure multifactor authentication is enabled for all users in administrative roles (Scored).

A control is marked as “Scored” or “Not Scored” based on whether it can be programmatically tested. In this case, recommendation 1.1 can be audited leveraging the Microsoft Graph and PowerShell cmdlet. The specific steps for auditing the control are contained in the “Audit” section for this specific recommendation. This recommendation is listed as a Level 1 control because it is only applied to Microsoft 365 administrative users and would not have a company-wide impact or produce less functionality for users. The rationale for recommendation 1.1 is that Microsoft 365 administrative accounts need to be protected due to their powerful privileges and with Multiple Factor Authentication, an attacker would need to compromise at least two different authentication mechanisms, increasing the difficulty of compromise and thus reducing the risk to the Azure tenant.

Download the benchmark and provide your feedback

The CIS Microsoft 365 Security Benchmark is freely available for download in PDF format on the CIS website. In the continuity of their mission, feedback provided by those entrenched in using and implementing the benchmarks provides us the opportunity for continuous improvement of our products. Feedback can be made visible to CIS by creating a discussion thread or ticket within the CIS Microsoft 365 Foundations Benchmark community. In addition, Microsoft has developed a set of Office 365 security guidelines and best practices for our customers to follow. These guides can be found in Office 365 Security and Compliance documentation.
Click to expand...

Source: Best practices for securely using Microsoft 365 - the CIS Microsoft 365 Foundations Benchmark now available - Microsoft Secure

catcollector · Sep 2, 2021

Windows 2019 CIS Benchmark Level 1

We have a CIS Benchmark - level 1 compliance Windows 2019 server installed. We have configured local users and added them to Remote Desktop Users group. When we created the user, they were provided a default password. The user was able to select remote desktop
servers > include their user name > log in with the default password. Once they're in the machine, we would like for them to be able to update their password so that they're not using the default password we provided. User would do the following and receive
an error: Start > Settings > Accounts > Change password > a current password screen appears, they key in the default password used to log into the instance > an error message shows up indicating "Incorrect password. Try again". We have used the reveal password
icon to ensure that the current password keyed in here matches the default password provided AND used to log into the machine via rdp.

We have a similar Windows 2019 server installed and tested the same functionality. This works just fine. I have a feeling this is related to something CIS benchmark level 1 server has enabled or disabled...I just can't pinpoint what setting could be causing
this issue. Any help is appreciated. Thank you.

Windows 10: Windows Security CIS Benchmark

Windows Security CIS Benchmark

Windows Security CIS Benchmark

Windows Security CIS Benchmark

Windows Security CIS Benchmark - Similar Threads - Security CIS Benchmark

CIS benchmarks blocks enabling windows firewall in local group policy using powershell command.

CIS benchmarks blocks enabling windows firewall in local group policy using powershell command.

CIS benchmarks blocks enabling windows firewall in local group policy using powershell command.

Is Microsoft-published security compliance baselines are compliant to CIS and NIST...

Is Microsoft-published security compliance baselines are compliant to CIS and NIST...

Is Microsoft-published security compliance baselines are compliant to CIS and NIST...

Windows benchmark

Windows 2019 CIS Benchmark Level 1

CIS Microsoft 365 Foundations Benchmark now available