+APP.2.2.A5 Hardening Active Directory (B)

APP.2.2.A5 Hardening Active Directory (B)

Built-in accounts MUST be configured with complex passwords. They MUST ONLY be used as emergency accounts. Privileged accounts MUST be members of the “protected users” group. Managed service accounts (for groups) MUST be used for service accounts.

All domain controllers MUST be assigned restrictive access rights at the operating system level. The Active Directory restore mode MUST be protected by an appropriate password. Work in this mode SHOULD only be performed in compliance with the two-person principle.

A map of the domain controller SHOULD be created on a regular basis. The authorisations for the “Everyone” group MUST be restricted. The domain controller MUST be protected against unauthorised restarts.

The policies for domains and domain controllers MUST include secure settings for passwords, account lockout, Kerberos authentication, user rights, and monitoring. A sufficient size MUST be set for the security log of the domain controller. If external trust relationships exist with other domains, user authorisation data MUST be filtered and anonymised.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.14 Interception of Information / Espionage
blocks G 0.15 Eavesdropping
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.28 Software Vulnerabilities or Errors
blocks G 0.29 Violations of Laws or Regulations
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.36 Identity theft
blocks G 0.37 Repudiation of Actions
blocks G 0.38 Misuse of Personal Information
blocks G 0.39 Malware
blocks G 0.40 Denial of Service
blocks G 0.43 Attack with Specially Crafted Messages
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information