Detections
Analytics

2.3.9.2 Ensure 'Microsoft network server: Digitally sign communications (always)' is set to 'Enabled'

Information

This policy setting determines whether packet signing is required by the SMB server component. This setting should be enabled in a mixed environment to prevent downstream clients from using the workstation as a network server.

The recommended state for this setting is: Enabled.

Session hijacking uses tools that allow threat actors who have access to the same network as the client or server to interrupt, end, or steal a session in progress. Threat Actors can potentially intercept and modify unsigned SMB packets and then modify the traffic and forward it so that the server might perform undesirable actions. Alternatively, the threat actor could pose as the server or client after legitimate authentication and gain unauthorized access to data.

SMB is the resource sharing protocol that is supported by many Windows operating systems. It is the basis of NetBIOS and many other protocols. SMB signatures authenticate both users and the servers that host the data. If either side fails the authentication process, data transmission will not take place.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled :

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options\Microsoft network server: Digitally sign communications (always)

Impact:

The Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing.

Implementation of SMB signing may negatively affect performance, because each packet needs to be signed and verified. If these settings are enabled on a server that is performing multiple roles, such as a small business server that is serving as a Domain Controller, file server, print server, and application server performance may be substantially slowed. Additionally, if computers are configured to ignore all unsigned SMB communications, older applications and operating systems will not be able to connect. However, if SMB signing is completely disabled, computers will be vulnerable to session hijacking attacks.

See Also

https://workbench.cisecurity.org/benchmarks/26296

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1)

Plugin: Windows

Control ID: a9e9512bb1734cd10038e9fee3e85562f9bb857a37b13bf6247eb551ab96fdd6