WPAW-00-000100 - Administrators of high-value IT resources must complete required training.

800-53|CM-6

CAT|III

CCI|CCI-000101

Rule-ID|SV-92847r1_rule

STIG-ID|WPAW-00-000100

Vuln-ID|V-78141

WPAW-00-000200 - Site IT resources designated as high value by the Authorizing Official (AO) must be remotely managed only via a Windows privileged access workstation (PAW) - AO must be remotely managed only via PAW

CAT|II

CCI|CCI-000366

Rule-ID|SV-92849r1_rule

STIG-ID|WPAW-00-000200

Vuln-ID|V-78143

WPAW-00-000400 - Administrative accounts of all high-value IT resources must be assigned to a specific administrative tier in Active Directory to separate highly privileged administrative accounts from less privileged administrative accounts.

800-53|AC-6

CCI|CCI-002227

Rule-ID|SV-92851r1_rule

STIG-ID|WPAW-00-000400

Vuln-ID|V-78145

WPAW-00-000500 - A Windows PAW must only be used to manage high-value IT resources assigned to the same tier.

Rule-ID|SV-92853r1_rule

STIG-ID|WPAW-00-000500

Vuln-ID|V-78147

WPAW-00-000600 - All high-value IT resources must be assigned to a specific administrative tier to separate highly sensitive resources from less sensitive resources.

Rule-ID|SV-92855r1_rule

STIG-ID|WPAW-00-000600

Vuln-ID|V-78149

WPAW-00-000700 - The Windows PAW must be configured with a vendor-supported version of Windows 10 and applicable security patches that are DoD approved - CurrentBuild

Rule-ID|SV-92857r1_rule

STIG-ID|WPAW-00-000700

Vuln-ID|V-78151

WPAW-00-000700 - The Windows PAW must be configured with a vendor-supported version of Windows 10 and applicable security patches that are DoD approved - ProductName

WPAW-00-000800 - A Windows update service must be available to provide software updates for the PAW platform - AUOptions

800-53|SI-2(5)

CSCv6|4.5

Rule-ID|SV-92859r1_rule

STIG-ID|WPAW-00-000800

Vuln-ID|V-78153

WPAW-00-000800 - A Windows update service must be available to provide software updates for the PAW platform - ScheduledInstallDay

WPAW-00-000800 - A Windows update service must be available to provide software updates for the PAW platform - ScheduledInstallTime

WPAW-00-000800 - A Windows update service must be available to provide software updates for the PAW platform - WUServer

WPAW-00-001000 - The Windows PAW must be configured so that all non-administrative-related applications and functions are blocked or removed from the PAW platform, including but not limited to email, Internet browsing, and line-of-business applications.

Rule-ID|SV-92861r1_rule

STIG-ID|WPAW-00-001000

Vuln-ID|V-78155

WPAW-00-001050 - Device Guard Code Integrity Policy must be used on the Windows PAW to restrict applications that can run on the system (Device Guard Code Integrity Policy).

Rule-ID|SV-92863r2_rule

STIG-ID|WPAW-00-001050

Vuln-ID|V-78157

WPAW-00-001060 - Device Guard Code Integrity Policy must be used on the Windows PAW to restrict applications that can run on the system (Device Guard User Mode Code Integrity).

Rule-ID|SV-92869r2_rule

STIG-ID|WPAW-00-001060

Vuln-ID|V-78163

WPAW-00-001100 - Windows PAWs must be restricted to only allow groups used to manage high-value IT resources and members of the local Administrators group to log on locally.

800-53|AC-6(7)

CSCv6|16

Rule-ID|SV-92871r1_rule

STIG-ID|WPAW-00-001100

Vuln-ID|V-78165

WPAW-00-001200 - The domain must be configured to restrict privileged administrator accounts from logging on to lower-tier hosts - Deny log on as a batch job

Rule-ID|SV-92873r1_rule

STIG-ID|WPAW-00-001200

Vuln-ID|V-78167

WPAW-00-001200 - The domain must be configured to restrict privileged administrator accounts from logging on to lower-tier hosts - Deny log on as a service

WPAW-00-001200 - The domain must be configured to restrict privileged administrator accounts from logging on to lower-tier hosts - Deny log on locally

WPAW-00-001300 - A Windows PAW used to manage domain controllers and directory services must not be used to manage any other type of high-value IT resource.

800-53|SC-2

CAT|I

CCI|CCI-001082

Rule-ID|SV-92875r1_rule

STIG-ID|WPAW-00-001300

Vuln-ID|V-78169

WPAW-00-001400 - PAWs used to manage Active Directory must only allow groups specifically designated to manage Active Directory, such as Enterprise and Domain Admins and members of the local Administrators group, to log on locally.

Rule-ID|SV-92877r1_rule

STIG-ID|WPAW-00-001400

Vuln-ID|V-78171

WPAW-00-001500 - In a Windows PAW, administrator accounts used for maintaining the PAW must be separate from administrative accounts used to manage high-value IT resources.

Rule-ID|SV-92879r1_rule

STIG-ID|WPAW-00-001500

Vuln-ID|V-78173

WPAW-00-001600 - The Windows PAW must be configured to enforce two-factor authentication and use Active Directory for authentication management.

800-53|IA-5(11)

CCI|CCI-000767

Rule-ID|SV-92881r1_rule

STIG-ID|WPAW-00-001600

Vuln-ID|V-78175

WPAW-00-001700 - The Windows PAW must use a trusted channel for all connections between a PAW and IT resources managed from the PAW.

800-53|SC-13

CCI|CCI-001135

CCI|CCI-001136

CCI|CCI-002426

Rule-ID|SV-92883r1_rule

STIG-ID|WPAW-00-001700

Vuln-ID|V-78177

WPAW-00-001800 - If several Windows PAWs are set up in virtual machines (VMs) on a host server, the host server must only contain PAW VMs.

Rule-ID|SV-92885r1_rule

STIG-ID|WPAW-00-001800

Vuln-ID|V-78179

WPAW-00-002100 - The Windows PAW must be configured so that all inbound ports and services to a PAW are blocked except as needed for monitoring, scanning, and management tools or when the inbound communication is a response to an outbound connection request.

CCI|CCI-002403

Rule-ID|SV-92887r1_rule

STIG-ID|WPAW-00-002100

Vuln-ID|V-78181

WPAW-00-002200 - The Windows PAW must be configured so that all outbound connections to the Internet from a PAW are blocked.

CCI|CCI-002399

Rule-ID|SV-92889r1_rule

STIG-ID|WPAW-00-002200

Vuln-ID|V-78183

WPAW-00-002300 - The local Administrators group on the Windows PAW must only include groups with accounts specifically designated to administer the PAW.

Rule-ID|SV-92891r1_rule

STIG-ID|WPAW-00-002300

Vuln-ID|V-78185

WPAW-00-002400 - Local privileged groups (excluding Administrators) on the Windows PAW must be restricted to include no members - Backup Operators

Rule-ID|SV-92865r1_rule

STIG-ID|WPAW-00-002400

Vuln-ID|V-78159

WPAW-00-002400 - Local privileged groups (excluding Administrators) on the Windows PAW must be restricted to include no members - Cryptographic Operators

WPAW-00-002400 - Local privileged groups (excluding Administrators) on the Windows PAW must be restricted to include no members - excluding Administrators must be restricted to include no members -Power Users

WPAW-00-002400 - Local privileged groups (excluding Administrators) on the Windows PAW must be restricted to include no members - Hyper-V Administrators

WPAW-00-002400 - Local privileged groups (excluding Administrators) on the Windows PAW must be restricted to include no members - Network Configuration Operators

WPAW-00-002400 - Local privileged groups (excluding Administrators) on the Windows PAW must be restricted to include no members - Remote Desktop Users

800-53|AC-17

WPAW-00-002400 - Local privileged groups (excluding Administrators) on the Windows PAW must be restricted to include no members - Replicator

WPAW-00-002500 - Restricted remote administration must be enabled for high-value systems - DisableRestrictedAdmin

Rule-ID|SV-92867r1_rule

STIG-ID|WPAW-00-002500

Vuln-ID|V-78161

WPAW-00-002500 - Restricted remote administration must be enabled for high-value systems - RestrictedRemoteAdministration

WPAW-00-002600 - If several PAWs are set up in virtual machines (VMs) on a host server, domain administrative accounts used to manage high-value IT resources must not have access to the VM host operating system (OS) (only domain administrative accounts designated to manage PAWs should be able to access the VM host OS).

Detections

Analytics

Revision 1.2

Nov 17, 2020

Functional Update