Recommended Products or Services Member’s with No IT Staff Member’s With IT Staff Do not create email inboxes for any administrator accounts (Required) Do not create email inboxes for any administrator accounts (Required) Administrators must have a normal user account in addition to administrator accounts. The normal account is the only account that is allowed to use email or browse the Internet. They should never use an administrative account for these functions. (Required) Administrators must have a normal user account in addition to administrator accounts. The normal account is the only account that is allowed to use email or browse the Internet. They should never use an administrative account for these functions. (Required) Implement UTM Firewall Active Directory integration with LDAP. Alternatively the UTM Firewall could have a workstation client agent that passes the user name to the firewall. In both cases the firewall would have an access control to disallow internet access to administrative accounts. (Required) Implement UTM Firewall Active Directory integration with LDAP. Alternatively the UTM Firewall could have a workstation client agent that passes the user name to the firewall. In both cases the firewall would have an access control to disallow internet access to administrative accounts. (Required) If no active directory implement a client/host based firewall with account restriction features. (Optional) If no active directory implement a client/host based firewall with account restriction features. (Optional) Control No. 12 – Controlled Use of Administrative Privilege – Quick Win No. 8 12.8 Through policy and user awareness, require that administrators establish unique, different passwords for their administrator and non-administrator accounts. Each person requiring administrative access should be given his/her own separate account. Administrative accounts should never be shared. Users should only use the Windows “administrator” or Unix “root” accounts in emergency situations. Domain administration accounts should be used when required for system administration instead of local administrator accounts. 12.8 - Recommendations: Recommended Products or Services Member’s with No IT Staff Member’s With IT Staff Implement controls, such as dedicated administrative OU’s, that have unique password requirements Implement controls, such as dedicated administrative OU’s, that have unique password requirements Control No. 12 – Controlled Use of Administrative Privilege – Quick Win No. 9
Member’s with No IT Staff Member’s With IT Staff Have the local support contractor demonstrate how they meet this control and document the process in the service level agreement. Server and Workstation images should be stored near the production site in a secure logical and physical location. Images should be included in the backup strategy with the backup media stored off-site in a secure location with significant regional separation. Server and Workstation images should be stored at the member site, not at the local vendor site. Images should be included in the backup strategy with the backup media stored off-site in a secure location Disaster Recovery documentation must be provided that details how to use these images for recovery of servers or workstations. Disaster Recovery documentation must be provided that details how to use these images for recovery of servers or workstations. This is similar to new device build checklist but not the same. Implement ITL based change control procedures for image masters and changes to servers. Approved changes to servers, including patch management, should be performed on image masters. Implement integrity checking tools to ensure the approved image has not been altered before it is used. Consult the SANS Vendor Solutions link above for vendor products that perform this control. Control No. 3 – Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers – Quick Win No. 5 3.5 Run the last version of software and make sure it is fully patched. Remove outdated or older software from the system. 3.5 - Recommendations: Recommended Products or Services Member’s with No IT Staff Member’s With IT Staff This control requires that software be kept current – e.g. the last version. And it requires that the software be patched. This includes all software, not just the operating system, that is on a master image. This control requires that software be kept current – e.g. the last version. And it requires that the software be patched. This includes all software, not just the operating system, that is on a master image. The local support vendor should be retained to perform routine maintenance that includes software update and patching. Use products discussed earlier for patch management and vulnerability management tools to make sure servers, workstations, and image masters are kept current.