Details
If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Pre-boot authentication prevents unauthorized users from accessing encrypted drives. Increasing the pin length requires a greater number of guesses for an attacker.
Solution
Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> BitLocker Drive Encryption >> Operating System Drives ‘Configure minimum PIN length for startup’ to ‘Enabled’ with ‘Minimum characters:’ set to ‘6’ or greater.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Windows.
References
- 800-53|SC-28
- 800-53|SC-28(1)
- CAT|II
- CCI|CCI-001199
- CCI|CCI-002475
- CCI|CCI-002476
- CSCv6|2
- CSCv6|13.2
- Rule-ID|SV-220704r569290_rule
- STIG-ID|WN10-00-000032
- STIG-Legacy|SV-104691
- STIG-Legacy|V-94861
- Vuln-ID|V-220704