WIN2K Checklist v2111 - Section 3 MSE安全攻防资料.docVIP

SYSTEM Administrator/ISSO Interview Questions This section lists questions that must be asked of the System Administrator or the Information Systems Security Officer (ISSO) in an interview prior to the SRR. 3 SYSTEM Administrator/ISSO Interview Questions 3-1 3.1 Controlling Access to Automated Information Systems (AISs) 3-2 3.2 Users with Administrative Privileges 3-2 3.3 Users with Backup Operator Privileges 3-3 3.4 Shared Accounts 3-3 3.5 Access to Security Event Log 3-3 3.6 CMOS Configuration ? 3-3 3.7 Emergency Repair Disk (ERD) 3-4 3.8 Windows Security Configuration Tools 3-5 3.9 Active Directory Backup Policy (Windows 2000 domain controllers) 3-5 3.10 System Configuration Changes (Future Check) 3-5 3.11 Unencrypted Remote Access (Future Check) 3-6 3.12 Intrusion Detection (Servers) (Future Check) 3-6 _____________________________________________________________________________________________ A “?” symbol appearing in a section title indicates a Platinum Standard setting. The label “(Future Check)” next to a section title is to alert sites that this is a new check that will become active in the near future. This is meant to give sites sufficient time to incorporate these changes prior to being held accountable in a Security Readiness Review. Controlling Access to Automated Information Systems (AISs) This check verifies, by observation, that the equipment and all ancillary devices are adequately protected. Note: Critical servers should be located in rooms, or locked cabinets, that are accessible only to authorized systems personnel. User workstations containing sensitive data should be in access controlled areas. Category: II PDI: 1.001: Physical security of Windows NT Server/Workstation does not meet DISA requirements. Reference: NSA WIN2K Guide, File Disk Resources: Chap. 4, p. 17 Users with Administrative Privileges This check verifies that each user with administrative privileges has been assigned a unique account, separate from the built-in “Admi