by using the CA snap-in. Certificate manager Issue and Manage Certificates Corresponds with CC Officer role. Approve certificate enrollment and revocation requests. This is a CA role. This role is sometimes referred to as CA officer. These permissions are assigned by using the CA snap-in. Backup operator Back up file and directories Restore file and directories Corresponds with CC Operator role. Perform system backup and recovery. Backup is an operating system feature. Auditor Manage auditing and security log Corresponds with CC Auditor role.
4886 Low Certificate Services received a certificate request. Request ID: %1 Requester: %2 Attributes: %3 Issue and manage certificate requests 4887 Medium Certificate Services approved a certificate request and issued a certificate. Request ID: %1 Requester: %2 Attributes: %3 Disposition: %4 SKI: %5 Subject: %6 Issue and manage certificate requests Issuance of certificates that contain usages that allow the owner to perform privileged operations (Enrollment Agent, Code Signing etc.) or certificates issued to VIP users should be monitored. 4888 Medium Certificate Services denied a certificate request. Request ID: %1 Requester: %2 Attributes: %3 Disposition: %4 SKI: %5 Subject: %6 Issue and manage certificate requests 4889 Low Certificate Services set the status of a certificate request to pending. Request ID: %1 Requester: %2 Attributes: %3 Disposition: %4 SKI: %5 Subject: %6 Issue and manage certificate requests 4890 High The certificate manager settings for Certificate Services changed. Enable: %1 %2 Change CA security settings May indicate tampering with permissions with what users are able to enroll on behalf of other users, commonly
Remove Enterprise Admins and Domain Admins from local administrators group on CAs Tactical Medium Eliminate or limit the number of service accounts with administrative rights on CAs and RAs Tactical Medium Enable application whitelisting using AppLocker or another third party application Tactical High Internal Use secure administrative hosts or jump hosts to perform remote management tasks Strategic High Internal Disable Remote Management Boards on physical servers Tactical High Internal Require PKI administrators to use cards for all accounts that manage the PKI Strategic High Internal Use a Hardware Security Module in offline CAs Strategic High Internal Keep offline CAs truly offline, allow only physical access to all components Tactical Medium Use only authorized, dedicated devices to transfer files to/from offline CAs Tactical Medium Update offline CAs with service security updates specific to CA software, and updates related to system time (time zone changes) Tactical Medium Update HSM software and firmware when released Tactical Medium Ensure that any activity performed on an offline CA can be traced to an individual, either through individual accounts or additional auditing and surveillance Strategic Medium When virtualizing offline CAs, decouple the guest files from the physical hardware so the hardware can be easily replaced Tactical Medium When virtualizing offline CAs, use a dedicated host machine that is secured in a locked rack or safe. If Tactical Medium
dedicated hardware cannot be used, build a clean host OS each time the CA VMs need to be brought online When virtualizing offline CAs, securely build the VM on the dedicated hardware, do not build it on an online host and migrate it to the dedicated hardware Tactical Medium Prior to performing any operations on an offline CA, verify the system time is correct. Tactical Medium When virtualizing offline CAs, perform regular backups of hard disk files. Securely store the backups along with any required software at a backup site Tactical Medium When virtualizing online CAs, access to the host to only those who should have access to the PKI Tactical High Internal When virtualizing online CAs, use network attached HSMs for key protection Tactical High Internal When virtualizing online CAs, continue to take regular CA backups with all data needed to restore the CA Tactical Medium If using software keys, protect all key backups (PKCS#12, PFX files) with the same level of protection provided to the CA Tactical Medium Do not include backups of the private key as part of the standard backup process. Backup the key(s) as needed and physically protect them by storing in a safe, within a tamper-evident bag and audit all access to the backup Tactical Medium Do not connect backup systems directly to the CA. Backup the CA to another location which is backed up regularly to eliminate the need for backup software on the CA Tactical High Internal Isolate certificate systems from other systems on the network Strategic High External Implement “security to isolate certificate systems based on their criticality and relationship to each other Strategic High External
Renew an issuing CA certificate once before replacing the key pair Strategic Medium Use certificate expiration events in Windows 8® and Windows Server 2012® and above to assist in expiration notification Strategic Medium Match the strength of asymmetric key algorithms with the strength of the hash algorithm Strategic Medium Use the correct key usage for each certificate use case Strategic Medium Determine the extended key usages for each PKI use case Strategic Medium Constrain issuing CAs (use the path length constraint to ensure that CA can only issue end-entity certificates and limit application policies) Strategic Medium Protecting CA Keys and Critical Artifacts Recommendation Tactical or Strategic Impact Level If using network HSMs for offline CAs, do not connect the HSM to a routable network Tactical High Internal Create enough HSM tokens to account for disaster recovery Strategic Medium Use tamper-evident containers/packaging to store PKI artifacts such as HSM tokens or backup data Tactical High Internal Store PKI artifacts in a climate controlled location Tactical Medium Maintain an auditable chain of custody of PKI artifacts Strategic High Internal Maintain an inventory of PKI artifacts Strategic High Internal
Monitoring Public Key Infrastructure Recommendation Tactical or Strategic Impact Level Monitor Active Directory® for changes groups that control access to CAs, membership in the “Cert Publishers” group, changes to privileged and VIP accounts, and unauthorized changes to certificate templates Tactical High Internal Record and review physical access events Tactical High Internal Record and review all physical access to HSMs Tactical High Internal Record and review logs from network equipment that supports PKI Tactical High Internal Record and review physical access to PKI artifacts, such as access to Tactical High Internal Configure Windows® audit policy to enable auditing for Certification Services Tactical Medium Monitor changes to the CA registry Tactical High Internal Monitor for changes to certificate templates Tactical High Internal Compromise Response Recommendation Tactical or Strategic Impact Level Identify critical systems and processes that are dependent on PKI Strategic Medium Develop a basic plan of action for compromise before a compromise occurs Strategic Medium