Detections
Analytics

1.206 WN11-SO-000100

Information

The Windows SMB client must be configured to always perform SMB packet signing.

GROUP ID: V-253449
RULE ID: SV-253449r958908

The server message block (SMB) protocol provides the basis for many network operations. Digitally signed SMB packets aid in preventing man-in-the-middle attacks. If this policy is enabled, the SMB client will only communicate with an SMB server that performs SMB packet signing.

Solution

Configure the policy value for

Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> 'Microsoft network client: Digitally sign communications (always)'

to 'Enabled'.

See Also

https://workbench.cisecurity.org/benchmarks/27756

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-8, CCI|CCI-002418, Rule-ID|SV-253449r958908_rule, STIG-ID|WN11-SO-000100, Vuln-ID|V-253449

Plugin: Windows

Control ID: 4e5937571c8ea902afa7db1620d90f5f620acf87a1fcdb3b6452368b2d8eb08a