信息安全-风险评估-检查流程-操作系统安全评估检查表-Windows.pdf

《信息安全-风险评估-检查流程-操作系统安全评估检查表-Windows.pdf》由会员分享，可在线阅读，更多相关《信息安全-风险评估-检查流程-操作系统安全评估检查表-Windows.pdf（20页珍藏版）》请在淘文阁 - 分享文档赚钱的网站上搜索。

1、CnliuyCnliuy 免费资料免费资料操作系统审计检查表操作系统审计检查表WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号1 12 2审核项目审核项目补 丁 安 装情况主 要 帐 户策略审查审核策略密码长度最少8位,密码周期最长为90天审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法3 34 45 5对所有帐户登录事件进行审核对所有的帐户管理事件进行审核对所有登录事件进行审核审核失败访问的组件对策略更改事件进行审核审核失败的特权事件审核所有系统事件帐户策略最小密码历史:1 1天天最长密码周期:

2、9090 天天最小密码长度：8 8个字符个字符密码复杂度：EnabledEnabled密码历史:24 Passwords Remembered24 Passwords Remembered存储的密码是否可用于可逆加密：DisabledDisabled帐 户 锁 定帐户锁定周期：15 Minutes15 Minutes（minimum)策略帐户锁定条件:3 3 次失败登录次失败登录复位时间：15 Minutes15 Minutes（minimum）第 1 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核

3、项目事 件 日 志审核审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法6 6对于系统、安全、应用系统日志，审核下面的项目：最大日志容量：80 Mb80 Mb(minimum)限制GUEST帐户访问日志:EnabledEnabled日志保持方法:“必要时候重写日志必要时候重写日志”7 7主 要 安 全设置审核安全选项对外在的匿名用户禁止访问。8 8允许系统在未登录前关闭计算机：DisabledDisabled允许格式化和弹出可移动媒体：AdministratorsAdministratorsAmount of Idle T

4、ime Required Before DisconnectingSession:30 Minutes30 Minutes(maximum)在超过登录时间后强制注销:EnabledEnabled系统关闭时清除虚存页面文件：EnabledEnabled数字签名客户端通信（如可能):EnabledEnabled数字签名服务器端通信（如可能)：EnabledEnabled不需要按 CTRL+ALT+Delete 登录取:DisabledDisabled不显示上次登录的用户名:EnabledEnabledLAN Manager Authentication 标准l:“Send“SendNTLMv2 r

5、esponse only”NTLMv2 response only”（最少)用户登录时显示的消息文字：Custom MessageCustom Message or“This system is for the use of authorized users only。用户登录时显示的消息标题:“Warning:”or customcustomtitletitle.第 2 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说

6、明改进建议改进建议审核步骤审核步骤/方法方法可被缓存保存的前次登录个数:0 0禁止用户安装打印驱动：EnabledEnabled在密码到期前多少天提示用户更改密码:14 Days14 Days(minimum)恢复控制台（允许自动管理级登录）：DisabledDisabled恢复控制台（允许对所有的驱动器和文件夹进行软盘拷贝和访问）：DisabledDisabled重命名管理员帐户：除除AdministratorAdministrator外的其它任外的其它任何名称何名称重命名Guest 帐户：除除 GUESTGUEST 外的其它任何名称外的其它任何名称限制只有本地登录用户才允许访问软盘：Ena

7、bledEnabled对安全通道数据进行数字加密(如可能）:EnabledEnabled对安全通道数据进行数字签名（如可能）：EnabledEnabled发送为加密的密码连接第三方 SMB 服务器：DisabledDisabled智能卡移除操作:“锁定工作站锁定工作站”3.2.1.36 Strengthen Default Permissions of GlobalSystem Objects(e.g.Symbolic Links)：EnabledEnabled对未经过签名的驱动安装行为:“警告，警告，但允许安但允许安装装”或者“不允许安装不允许安装”。第 3 页 共 20 页CnliuyCn

8、liuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目注 册 表 安全 设 置 审核审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法9 9禁止 Dr.Watson 创建DUMPS文件：HKLMSoftwareMicrosoftDrWatsonCreateCrasHKLMSoftwareMicrosoftDrWatsonCreateCrashDumphDump（REG_DWORDREG_DWORD）0 0禁止系统的自动诊断自动运行：HKLMHKLMSoftware

9、MicrosoftWindows NTCurrentVersionSoftwareMicrosoftWindows NTCurrentVersionAEDebugAutoAEDebugAuto（REG_DWORD)0REG_DWORD)0禁止从任何驱动器上自动运行任何应用程序：HKLMSoftwareMicrosoftWindowsCurrentVersHKLMSoftwareMicrosoftWindowsCurrentVersionionPoliciesExplorerNoDriveTypeAutoRunPoliciesExplorerNoDriveTypeAutoRun（REG_DWOR

10、DREG_DWORD）255255禁止现在的用户自动运行：HKCUSoftwareMicrosoftWindowsCurrentVersiHKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExploreronPoliciesExplorerNoDriveTypeAutoRunNoDriveTypeAutoRun（REG_DWORDREG_DWORD）255255禁止任何新用户自动运行HKU.DEFAULTSoftwareMicrosoftWindowsCHKU.DEFAULTSoftwareMicrosoftWindowsCurrentVers

11、ionurrentVersionPoliciesExplorerNoDriveTypeAutoRunPoliciesExplorerNoDriveTypeAutoRun(REG_DWORD(REG_DWORD）Not DefinedNot Defined禁止自动登录：HKLMHKLMSoftwareMicrosoftWindowsSoftwareMicrosoftWindowsNTCurrentVersionWinlogonAutoAdminLogonNTCurrentVersionWinlogonAutoAdminLogon第 4 页 共 20 页CnliuyCnliuy 免费资料免费资料W

12、INDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法(REG_SZ)0(REG_SZ)0隐藏键盘输入星号实际字符:HKLMSoftwareMicrosoftWindowsCurrentVHKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesNetworkersionPoliciesNetworkHideSharePwds(REG_DWORDHideSharePwds(REG_DWORD）1 1禁

13、止拨号访问：HKLMSoftwareMicrosoftWindowsCurrentVersHKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesNetworkionPoliciesNetworkNoDialIn(REG_DWORDNoDialIn(REG_DWORD）1 1禁止在蓝屏死机后自动重启：HKLMSystemCurrentControlSetControlHKLMSystemCurrentControlSetControlCrashControlAutoRebootCrashControlAutoReboot（REG_DWORDREG_D

14、WORD）0 0禁止CD自动播放：HKLMSystemCurrentControlSetServicesCDroHKLMSystemCurrentControlSetServicesCDromAutorunmAutorun（REG_DWORDREG_DWORD）0 0在服务器上清除管理共享：HKLMSystemCurrentControlSetServicesHKLMSystemCurrentControlSetServicesLanmanServerParametersAutoShareServerLanmanServerParametersAutoShareServer（REG_DWORD

15、REG_DWORD）0 0保护阻止Computer Browser Spoofing 攻击：HKLMSystemCurrentControlSetServicesMrxSHKLMSystemCurrentControlSetServicesMrxSmbmbParametersRefuseReset(REG_DWORDParametersRefuseReset(REG_DWORD）第 5 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员

16、补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法保护阻止 source-routing spoofing攻击：HKLMSystemCurrentControlSetServicesTcpipHKLMSystemCurrentControlSetServicesTcpipParametersParametersDisableIPSourceRoutingDisableIPSourceRouting（REG_DWORDREG_DWORD）2 2保护 默认网关网络设置：HKLMSystemCurrentControlSetServicesTcpipHKLMSystemCurrentCont

17、rolSetServicesTcpipParametersParametersEnableDeadGWDetectEnableDeadGWDetect（REG_DWORD)0REG_DWORD)0Ensure ICMP Routing via shortest path first：HKLMSystemCurrentControlSetServicesTcpipHKLMSystemCurrentControlSetServicesTcpipParametersParametersEnableICMPRedirectEnableICMPRedirect（REG_DWORD)0REG_DWORD)

18、0帮助阻止包碎片攻击：HKLMSystemCurrentControlSetServicesTcpipHKLMSystemCurrentControlSetServicesTcpipParametersParametersEnablePMTUDiscoveryEnablePMTUDiscovery（REG_DWORDREG_DWORD）0 0管理 Keepalive 时间：HKLMSystemCurrentControlSetServicesTcpipHKLMSystemCurrentControlSetServicesTcpipParametersKeepAliveTimeParameter

19、sKeepAliveTime(REG_DWORD(REG_DWORD）300000300000保护阻止恶意的 NameRelease 攻击：HKLMSystemCurrentControlSetServicesNetbtHKLMSystemCurrentControlSetServicesNetbtParametersParameters第 6 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审

20、核步骤/方法方法NoNameReleaseOnDemand(REG_DWORDNoNameReleaseOnDemand(REG_DWORD）1 1确保路由发现被禁止：HKLMSystemCurrentControlSetServicesTcpipHKLMSystemCurrentControlSetServicesTcpipParametersParametersPerformRouterDiscoveryPerformRouterDiscovery（REG_DWORD)0REG_DWORD)0保护阻止SYN Flood攻击：HKLMSystemCurrentControlSetServic

21、esTcpipHKLMSystemCurrentControlSetServicesTcpipParametersParametersSynAttackProtect(REG_DWORDSynAttackProtect(REG_DWORD）2 2SYN 攻击保护 管理 TCP 最大 halfopensockets:HKLMSystemCurrentControlSetServicesHKLMSystemCurrentControlSetServicesTcpipParametersTcpMaxHalfOpenTcpipParametersTcpMaxHalfOpen(REG_DWORD(REG

22、_DWORD）100 or 500100 or 500SYN 攻击保护 管理e TCP 最大half-open 保留sockets:HKLMSystemCurrentControlSetHKLMSystemCurrentControlSetServicesTcpipParametersTcpMaxHalfOpenRetirServicesTcpipParametersTcpMaxHalfOpenRetired(REG_DWORDed(REG_DWORD）80 or 40080 or 400启用 IPSec保护 Kerberos RSVP 传输：HKLMSystemCurrentControlS

23、etServicesIPSEHKLMSystemCurrentControlSetServicesIPSECCNoDefaultExempt(REG_DWORDNoDefaultExempt(REG_DWORD）1 1第 7 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核服务审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法1010Alerter DisabledDisabledClipbook DisabledDisa

24、bledComputer Browser DisabledDisabledFax Service DisabledDisabledFTP Publishing Service DisabledDisabled Warning:Warning:将将禁止禁止 FTPFTP 服务服务IIS Admin Service DisabledDisabled Warning Warning：This willThis willdisable Internet Information Services!disable Internet Information Services!Internet Connect

25、ion Sharing DisabledDisabledMessenger DisabledDisabledNetMeeting Remote Desktop Sharing DisabledDisabledRemote Registry Service DisabledDisabledRouting and Remote Access DisabledDisabledSimple Mail Transfer Protocol(SMTP）DisabledDisabled Warning:Warning:禁止在禁止在 IIS ServersIIS Servers上的上的SMTPSMTP服务。服务

26、。Simple Network Management Protocol(SNMP)Service DisabledDisabledSimple Network Management Protocol(SNMP)Trap DisabledDisabledTelnet DisabledDisabledWorld Wide Web Publishing Services DisabledDisabled WarningWarning：将禁止将禁止 Internet Information Services!Internet Information Services!Automatic Updates

27、 Not DefinedNot Defined第 8 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法Background Intelligent Transfer Service NotNotDefinedDefined用 户 权 利从网络访问此计算机:UsersUsers，AdministratorsAdministrators（oror审核nonenone）4。2。2 A

28、ct as part of the operating system:NoneNone增加工作站到域:Not applicableNot applicable备份文件和目录:AdministratorsAdministrators4。2.5 Bypass traverse checking：UsersUsers更改系统时间：AdministratorsAdministrators创建页面文件：AdministratorsAdministrators创建全局对象：NoneNone创建永久共享对象：NoneNone1111诊断程序：NoneNone拒绝从网络访问此计算机：GuestsGuests拒

29、绝作为批处理进行登录：None by default(others allowable as appropriate)None by default(others allowable as appropriate)Not DefinedNot Defined拒绝作为服务登录：None by defaultNone by default（othersothersallowable as appropriateallowable as appropriate）Not DefinedNot Defined拒绝本地登录:None by defaultNone by default（others all

30、owableothers allowableas appropriate)Not Definedas appropriate)Not Defined从远端强制关机：AdministratorsAdministrators第 9 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法管理和审核安全日志:NoneNone增加内存配额：AdministratorsAdministrator

31、s增加进度优先级AdministratorsAdministrators安装和卸载设备驱动程序：AdministratorsAdministrators内存中锁定页:NoneNone作为批作业登录:NoneNone（“Not Defined”“Not Defined”）作为服务登录：None(“Not Defined”)None(“Not Defined”)本地登录：AdministratorsAdministrators（other specific usersother specific usersallowable)allowable)管理审核和安全日志：AdministratorsAd

32、ministrators更改防火墙环境选项：AdministratorsAdministrators配置单一进程：AdministratorsAdministrators配置系统性能：AdministratorsAdministrators从插接工作站中取出计算机：AdministratorsAdministrators替换进程级记号：NoneNone恢复文件和目录：AdministratorsAdministrators关闭系统：AdministratorsAdministrators同步目录服务数据：Not ApplicableNot Applicable取得文件和其他对象的所有权：Adm

33、inistratorsAdministrators其 他 系 统1212需求确保磁盘卷为 NTFSNTFS文件系统。文件系统。第 10 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法文件权限%SystemDrive%Administrators:FullAdministrators:Full；SystemSystem：FullFull；Creator OwnerCreator

34、 Owner：Full;UsersFull;Users：Read and Execute,ListRead and Execute,List%SystemDrive%autoexec。bat AdministratorsAdministrators：Full;System:FullFull;System:FullSystemDrive%boot。ini Administrators:FullAdministrators:Full；System:FullSystem:FullSystemDriveconfig。sys AdministratorsAdministrators：Full;Syste

35、mFull;System：FullFullSystemDrive%io.sys Administrators:FullAdministrators:Full；SystemSystem：FullFull1313%SystemDrivemsdos.sys Administrators:FullAdministrators:Full；System:FullSystem:Full%SystemDriventbootdd.sys AdministratorsAdministrators：Full;SystemFull;System：FullFullSystemDrive%ntdetect。com Adm

36、inistrators:Administrators:FullFull；System:FullSystem:FullSystemDrive%ntldr-Administrators:Full;Administrators:Full;SystemSystem：FullFull%SystemDrive%Documents and Settings AdministratorsAdministrators：FullFull；System:FullSystem:Full；UsersUsers：Read and Execute,ListRead and Execute,ListSystemDrive%D

37、ocuments and第 11 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法SettingsAdministrator Administrators:Full;Administrators:Full;SystemSystem：FullFullSystemDriveDocuments and SettingsAll Users Administrators:Full;Sys

38、temAdministrators:Full;System：FullFull；UsersUsers：Read and ExecuteRead and Execute，ListListSystemDriveDocuments and SettingsAllUsersDocuments DrWatson Administrators:Administrators:FullFull；System:FullSystem:Full；Creator Owner:Full;Users:TraverseCreator Owner:Full;Users:TraverseFolder/Execute FileFo

39、lder/Execute File，List Folder/Read Data,ReadList Folder/Read Data,ReadAttributes,Read ExtendedAttributes,Read ExtendedAttributesAttributes，Read Permissions(This folderRead Permissions(This folder，subfolderssubfolders，and filesand files）；）；UsersUsers：TraverseTraverseFolder/Execute FilesFolder/Execute

40、 Files，CreateCreateFiles/Write DataFiles/Write Data，Create Folder/Append DataCreate Folder/Append Data(Subfolders and files only(Subfolders and files only）SystemDrive%Documents and SettingsDefaultUser Administrators:FullAdministrators:Full；System:FullSystem:Full；Users:Users:Read and ExecuteRead and

41、Execute，ListListSystemDrive%System Volume Information (Do(Donot allow permissions on this folder to benot allow permissions on this folder to bereplacedreplaced）第 12 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法

42、%SystemDriveTemp Administrators:FullAdministrators:Full；System:Full;Creator Owner:Full;Users:System:Full;Creator Owner:Full;Users:Traverse Folders/ExecuteTraverse Folders/ExecuteFiles,Create Files/Write Data,CreateFiles,Create Files/Write Data,CreateFolders/Append DataFolders/Append Data%ProgramFile

43、s Administrators:Full;System:Administrators:Full;System:Full;Creator Owner:FullFull;Creator Owner:Full；UsersUsers：Read andRead andExecute,ListExecute,List%SystemDriveProgram FilesResource Kit Administrators:FullAdministrators:Full；SystemSystem：FullFull%SystemRoot AdministratorsAdministrators：FullFul

44、l；System:System:FullFull；Creator OwnerCreator Owner：FullFull；UsersUsers：Read andRead andExecute,ListExecute,ListSystemRoot%$NtServicePackUninstall$AdministratorsAdministrators：FullFull；SystemSystem：FullFullSystemRootCSC AdministratorsAdministrators：Full;Full;SystemSystem：FullFullSystemRootDebug-Admi

45、nistratorsAdministrators：FullFull；System:FullSystem:Full；Creator Owner:FullCreator Owner:Full；UsersUsers：ReadReadand Execute,Listand Execute,List%SystemRoot%DebugUserMode-Administrators:Administrators:Full;System:FullFull;System:Full；Users:TraverseUsers:TraverseFolder/Execute FileFolder/Execute File

46、，ListList第 13 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法folder/Read data,Create files/Write data(Thisfolder/Read data,Create files/Write data(Thisfolder,onlyfolder,only）;Create files/Write data;Create files/W

47、rite data，CreateCreatefolders/Append datafolders/Append data(Files only(Files only）%SystemRootOffline Web Pages (Do not allow(Do not allowpermissions on this key to be replaced)permissions on this key to be replaced)%SystemRootRegistration-AdministratorsAdministrators：FullFull；System:FullSystem:Full

48、；Users:ReadUsers:ReadSystemRoot%repair AdministratorsAdministrators：FullFull；System:FullSystem:Full%SystemRootsecurity-AdministratorsAdministrators：Full;Full;SystemSystem：Full;Creator OwnerFull;Creator Owner：FullFull%SystemRoot%system32 Administrators:Full;Administrators:Full;SystemSystem：FullFull；C

49、reator OwnerCreator Owner：Full;Users:ReadFull;Users:Readand Executeand Execute，ListListSystemRootsystem32at.exe AdministratorsAdministrators：FullFull；System:FullSystem:Full4。4.1。30%SystemRootsystem32Ntbackup.exe AdministratorsAdministrators：Full;SystemFull;System：FullFull4.4。1。31%SystemRootsystem32r

50、cp。exe Administrators:FullAdministrators:Full；System:FullSystem:Full4。4.1。32%SystemRootregedit。exe AdministratorsAdministrators：Full;System:FullFull;System:Full第 14 页 共 20 页CnliuyCnliuy 免费资料免费资料WINDOWSWINDOWS安全审核安全审核被审核部门被审核部门序序号号审核项目审核项目审核人员审核人员审核日期审核日期审核结果审核结果陪同人员陪同人员补充说明补充说明改进建议改进建议审核步骤审核步骤/方法方法%