+SYS.2.2.3.A9 Secure Central Authentication of Windows Networks (S)

SYS.2.2.3.A9 Secure Central Authentication of Windows Networks (S)

Only Kerberos SHOULD be used for central authentication. A group policy SHOULD prevent the use of older protocols. If this is not possible, NTLMv2 MUST be implemented as an alternative. Authentication by means of LAN Manager and NTLMv1 MUST NOT be allowed within an organisation or production operating environments. The cryptographic mechanisms used SHOULD be configured and documented according to the identified protection needs and based on the applicable internal guidelines. Deviating settings SHOULD be justified and coordinated with the respective security management personnel.

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

Requirements

3. Related Regulations

Regulations

Linked Issues

Issuelinks
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems