DokuWiki

CeRTNA ERDS workstations must pass a security audit prior to processing production level transactions through the CeRTNA ERDS platform. Per the California DOJ Baseline Security Requirements, CeRTNA ERDS workstations must be used only for CeRTNA ERDS activity. The follow topics are designed to help you prepare your workstation so that it will meet the CeRTNA ERDS audit requirements.

In addition to the hardware recommendations outlined in the Hardware & OS Requirements document, CeRTNA ERDS workstations must also have Anti-Virus/Anti-Malware software installed.

For Windows 7 workstations, CeRTNA recommends the installation of Microsoft Security Essentials, however, other software tools are also acceptable, such as Symantec Endpoint Protection. Microsoft Security Essentials can be downloaded for free from the following URL:

https://www.microsoft.com/en-us/download/details.aspx?id=5201

For Windows 10 workstations, Microsoft Security Essentials is built into the operating system in the form of a product named Windows Defender. As with Windows 7 workstations, other products such as Symantec Endpoint Protection are also acceptable.

The CeRTNA ERDS workstation audit will require a clean Microsoft Baseline Security Analyzer (MBSA) report. The Microsoft Baseline Security Analyzer 2.3 (MBSA) software can be downloaded from the following URL:

https://admin.certna.org/Downloads/MBSA23x64.zip

Once you have downloaded and installed the MBSA software, complete the following tasks:

• Rename the Administrator account on the CeRTNA ERDS workstation.
• Create individual user accounts (non-admin) for the users that are or will be authorized to use
• the CeRTNA ERDS workstation.
• Disable the local Guest account.
• Ensure the anti-virus/anti-malware software is active.
• As an Administrator run the MBSA 2.2 software and clear all issues. (Exceptions)

Run the Microsoft Baseline Security Analyzer (MBSA) and scan the ERDS workstation. Resolve any items that are flagged on the MBSA scan.

During your system audit, you will be asked to perform the following tasks as an Administrator to show that the CeRTNA ERDS workstation meets the workstation security configuration requirements:

• Record output

Path: Control Panel\System

• Windows 10 operating system with 8.00 GB RAM (minimum)
• or
• Windows 7 (x86 or x64) operating system with 4.0 GB RAM (minimum)

• Record output

Path: Control Panel\Administrative Tools\Local Security Policy\Account Policies\Password Policy

Path: Control Panel\Administrative Tools\Local Security Policy\Account Policies\Account Lockout Policy

Path: Control Panel\Administrative Tools\Local Security Policy\Local Policies\Audit Policy

• Select all items for audit of success and failure.

Path: Control Panel\Administrative Tools\Local Security Policy\Local Policies\Security Options (s=

Path (Win10): Control Panel\System and Security\Windows Defender Firewall\Customize Settings (See note)

Path (Win7): Control Panel\System and Security\Windows Firewall\Customize Settings (See note)

Note: CeRTNA does not require any custom firewall rules to be applied. The only requirement is that a local workstation based firewall is enabled with the default settings. Organizations that have a product like Symantec Endpoint Protection will use the Symantec Endpoint Protection firewall, which will disable the Windows Firewall. Regardless of the local firewall that is used, you will need to show the auditor that the firewall for private and public networks is enabled.

Path (Win10):System\Windows Update

By default Windows 10 Updates are enabled. Verify the Windows Update History to show that the updates are being applied.

Path (Win7):System\Windows Update

Control Panel\All Control Panel Items\Power Options\System Settings

Path (Win10):Settings\Lock Screen\Screen saver settings

If you are using Windows 7 Security Essentials or Windows 10 Defender, you will need to have your anti-virus and anti-malware settings enabled. If you are using a 3rd party product, such as Symantec Endpoint Protection or AVG Anti-Virus protection, you will need to show the auditor equivalent settings that show that the computer is being protected with anti-virus/anti-malware software, the version information for the software and the virus definition files, the scan frequency, and a history showing the scans are being performed.

The administration UI for Windows 10 Defender settings is significantly different than the UI for Windows 7 Security Essentials. As such, the configuration and verification of each of these environments must be documented separately to achieve the same end goals as they relate to Virus Protection and Scan Settings.

To manage the Windows 7 Security Essentials settings, launch the Microsoft Security Essentials from the Windows 7 Start menu (button). The following settings can be reviewed/updated from the Settings tab on the Security Essentials UI.

Settings/Scheduled scan

Settings/Default actions

Settings/Real-time protection

Settings/Excluded files and locations, Settings/Excluded file types, Settings/Excluded processes are all optional settings that are not required for the audit.

Settings/Advanced

Settings/MAPS (Microsoft SpyNet)

Validate Screen Saver Settings:

To manage the Windows 10 Defender settings, launch the Windows Defender Security Center. You can click the Start menu button and then start typing Windows Defender Security Center and as you type you will see the program listed in the filtered search list. Click the Windows Defender Security Center app to start the applicaton.

Option: Virus & Threat Protection / Threat History

Option: Virus & Threat Protection / Virus & threat protection settings

Option: Virus & Threat Protection / Virus & threat protection updates

Option: Virus & Threat Protection / Ransomware Protection

Option: Firewall & Network Protection: (Default inbound/outbound rules are sufficient.)

The following options are not managed in the Windows Defender Security Center

From the Start Menu, type Settings to launch the Windows Settings app.

Option: Personalization / Lock screen / Screen saver settings

The following configuration item is still under review because it is only achievable using the gpedit console.