SYS.1.2.2 Windows Server 2012

Introduction

In Windows Server 2012, Microsoft released an operating system for servers in September 2012 that featured several improvements in security compared to previous Windows versions (particularly Windows Server 2008 R2). Rather than the code base of its predecessor, Windows Server 2021 builds on that of the Windows 8 client operating system from a technical point of view. In the Windows Server 2012 R2 release in October 2013, the operating system was updated and extended to make it the server equivalent of the client-side Windows 8.1.

This module addresses the process of securing both Windows Server 2012 and Windows Server 2012 R2. If both versions are meant, the uniform term "Windows Server 2012" is used. Differences in the R2 version are mentioned separately. The expiration dates for mainstream and extended support (“end of life”, EoL) for both operating systems are 9 January 2018 and 10 January 2023, respectively.

Objective

The objective of this module is to protect information and processes that are processed and controlled on server systems running Windows Server 2012.

Scoping and Modelling

Module SYS.1.2.2 Windows Server 2012 must be applied to all server systems on which the Microsoft Windows Server 2012 operating system is used.

This module specifies and adds specific features of Windows Server 2012 to the aspects included in module SYS.1.1 General Server. Accordingly, the two modules must always be used together.

Within the framework of this module, a default integration into an Active Directory domain is assumed, as is common in organisations. The particularities of stand-alone systems are only mentioned selectively where the differences appear to be particularly relevant. Requirements related to Active Directory are covered in module APP.2.2 Active Directory.

The security requirements of possible server roles and functions, such as file servers (APP.3.3 File Servers), web servers (APP.3.2 Web Servers), or Microsoft Exchange and Outlook (APP.5.2 Microsoft Exchange and Outlook), are covered in separate modules, as is the subject of virtualisation (SYS.1.5 Virtualisation). This module is about using built-in resources to achieve basic security at the operating system level regardless of the server's intended purpose.

Useful Resources

Microsoft provides the following additional information about Windows Server 2012:

Secure Windows (for Windows 8/8.1, but largely also applicable to Windows Server 2012 / 2012 R2): https://technet.microsoft.com/en-us/library/hh832031.aspx
Secure Windows Server 2012 R2 and Windows Server 2012: https://technet.microsoft.com/en-us/library/hh831360.aspx
Security and Protection: https://technet.microsoft.com/en-us/library/hh831778.aspx
List of security events on Windows 8.1 and Windows Server 2012: https://www.microsoft.com/en-us/download/confirmation.aspx?id=50034
Configuring Additional LSA Protection: https://docs.microsoft.com/de-de/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
Windows Server Guidance to Protect Against Speculative Execution: https://support.microsoft.com/en-us/help/4072698/windows-server-guidance-to-protect-against-speculative-execution

The Information Security Forum (ISF) provides specifications for the use of servers in “The Standard of Good Practice for Information Security”, in particular in Area SY1.2 ("Server Configuration").

NIST Special Publication 800-123, "Guide to General Server Security" (July 2008), is offered by the National Institute of Standards and Technology (NIST).

1. Przegląd

Tytuł	Norma
SYS.1.2.2.A1 Planning of Windows Server 2012 (B)	The use of Windows Server 2012 MUST be planned carefully prior to installation. The hardware requirements MUST be checked prior to procurement. A justified and documented decision for an appropriate edition of Windows Server 2012 MUST be taken. The purpose of the server and its integration into Active Directory MUST be specified. The use of cloud services integrated into the operating system MUST be considered and planned as a matter of principle. If they are not required, the configuration of Microsoft accounts on the server MUST be blocked.
SYS.1.2.2.A2 Secure Installation of Windows Server 2012 (B)	Server roles, features, and functions beyond those required MUST NOT be installed. If it is sufficient from a functional scope perspective, the server core variant MUST be installed. Otherwise, reasons why the server core variant is not sufficient MUST be cited. Servers MUST already be updated to a current patch status during the installation.
SYS.1.2.2.A3 Secure Administration of Windows Server 2012 (B)	All administrators responsible for a server system MUST have training in the security-relevant aspects of administering Windows Server 2012. Web browsers on the server MUST NOT be used for surfing the Internet.
SYS.1.2.2.A4 Secure Configuration of Windows Server 2012 (S)	A single server SHOULD NOT fulfil several essential functions or roles; they should be suitably divided. Prior to commissioning, a system SHOULD be fundamentally hardened. To this end, function-specific security templates for the entire organisation in question SHOULD be created, maintained, and rolled out to the servers. Internet Explorer SHOULD only be used in its enhanced security configuration and enhanced protected mode on a server.
SYS.1.2.2.A5 Protection Against Malware on Windows Server 2012 (S)	Except for IT systems running Windows Server 2012 that are operated as stand-alone devices without any network connection or removable media, an anti-virus protection program SHOULD be installed prior to establishing an initial connection to the Internet or removable media. The applicable malware protection concept SHOULD call for full scans of all hard drives on a regular basis. Alarms SHOULD be configured that will alert the responsible administrators when viruses are found.
SYS.1.2.2.A6 Secure Authentication and Authorisation in Windows Server 2012 (S)	In Windows Server 2012 R2, all users SHOULD be members of the security group “Protected Users”. Accounts for services and computers SHOULD NOT be members of the “Protected Users” group. Service accounts in Windows Server 2012 SHOULD be members of the “Managed Service Account” group. The PPL protection of the local security authority (LSA) SHOULD be activated. The use of dynamic access rules for resources SHOULD be preferred.
SYS.1.2.2.A8 Protection of System Integrity (S)	AppLocker SHOULD be enabled and configured as stringently as possible.
SYS.1.2.2.A11 Attack Detection in Windows Server 2012 (H)	Security-relevant events in Windows Server 2012 SHOULD be collected and analysed in a central location. Encrypted partitions SHOULD be blocked after a defined number of decryption attempts.
SYS.1.2.2.A12 Redundancy and High Availability in Windows Server 2012 (H)	The availability requirements that can be met or supported with the help of operating system functions such as Distributed File System (DFS), ReFS, failover clusters, network load balancing, or NIC teaming (LBFO) SHOULD be reviewed. For branch locations, BranchCache SHOULD be enabled.
SYS.1.2.2.A14 Shutting Down Encrypted Servers and Virtual Machines (H)	To protect encrypted data, servers that are not required (including virtual machines) SHOULD always be shut down. This SHOULD occur automatically whenever possible. Data encryption SHOULD require an interactive step or at least be documented in the security log.

1.1 Odwołania

1.2 Zidentyfikowane wymagania

1.3 Powiązane regulacje

2. Zidentyfikowane wymagania

Wymagania
Źródło	Wymaganie

3. Powiązane regulacje

Regulacje
Źródło	Regulacja

Powiązane zgłoszenia

Powiązania
Typ powiązania	Zgłoszenie
includes	SYS.1.2.2.G1. Poor Planning of Windows Server 2012
includes	SYS.1.2.2.G2. Careless Cloud usage
includes	SYS.1.2.2.G3. Improper Administration of Windows Servers
includes	SYS.1.2.2.G4. Improper Use of Group Policies (GPOs)
includes	SYS.1.2.2.G5. Loss of Integrity of Sensitive Information or Processes
includes	SYS.1.2.2.G6. Unauthorised Acquisition or Misuse of Administrator Rights
includes	SYS.1.2.2.G7. Compromised Remote Access

BSI -
Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)