Details

Older versions of operating systems usually contain vulnerabilities that have been fixed in later released versions. In addition, most operating system patches contain fixes for recently discovered security vulnerabilities. Due to the highly privileged activities of a PAW, it must be maintained at the highest security posture possible and therefore must have one of the current vendor-supported operating system versions installed.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Install one of the current vendor-supported versions of Windows 10 on site PAWs, including the most recently released patches.

Note: There is no central list in the DoD of ‘approved’ operating system versions. The Microsoft website will list supported versions of Windows 10 and patches. If a STIG is available for one or more of the vendor-supported versions of Windows 10, the version can be considered to be DoD approved. Local AOs usually have implemented a procedure for testing Windows updates before they are deployed. Check with the local AO’s staff to determine the latest approved version of Windows 10.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_Windows_PAW_V2R1_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.

References

• 800-53|CM-6b.
• CAT|II
• CCI|CCI-000366
• Rule-ID|SV-243447r722912_rule
• STIG-ID|WPAW-00-000700
• STIG-Legacy|SV-92857
• STIG-Legacy|V-78151
• Vuln-ID|V-243447

Source

• Tenable.com/audits