Detections
Analytics

4.10.24.1 Ensure 'Allow Custom SSPs and APs to be loaded into LSASS' is set to 'Disabled'

Information

This policy setting controls the configuration under which the Local Security Authority Subsystem Service (LSASS) will load custom Security Support Provider/Authentication Package (SSP/AP).

The recommended state for this setting is: Disabled.

Vulnerabilities exist where threat actors can intercept logon credentials via SSP/AP. Disabling Custom SSPs and APs to be loaded into LSASS minimizes this vulnerability.

Solution

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Disabled :

System > Local Security Authority\Allow Custom SSPs and APs to be loaded into LSASS

Impact:

Custom Security Support Provider/Authentication Packages will not be permitted to load this may impact some legitimate third-party packages.

See Also

https://workbench.cisecurity.org/benchmarks/27282

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-16, CSCv7|8.3

Plugin: Windows

Control ID: b8c5db32b505e9e874147a5bdcf499dbc03f598364cb4b057239029a9a8fb9e7