How To Mitigate Results from Security Scans

 

Audience

Staff

 

Overview

Steps to mitigate those risks based on the results from a security scan against a given website.

 

When you have completed your security scan against a given website you can use the results to mitigate those risks by following the below steps.

 

NOTE: The below steps are focused on Windows Server IIS environments. For Tomcat/Apache services running on Windows you are required to make further modification in the configuration files (a separate Apache/Tomcat document will be created) . Linux based servers require a slightly different approach due to the variations of Linux flavors (a separate Linux document will be created). 

 

  1. The first step in mitigating the risks is installing the IIS Crypto tool (for Windows Servers)
    1. Download IISCrypto from the link below or use the SharePoint Link for the version already downloaded
      1.  Local downloaded copy:
        1. https://pitt.sharepoint.com/sites/HealthSciencesInformationTechnologyHSIT/Shared%20Documents/Forms/AllItems.aspx?id=%2Fsites%2FHealthSciencesInformationTechnologyHSIT%2FShared%20Documents%2FSoftware%2FApplications%2FDesktop%2FIISCrypto%2FIIS%20Crypto%20GUI%20V%5F3%2E3%2E17&viewid=ad7d10c8%2D932f%2D497e%2D805c%2D2553bb026a6f
      2. Newest Version: 
        1. https://www.nartac.com/Products/IISCrypto/Download
  2. After you have downloaded the software copy it to the hard drive of the selected server or desktop. It is recommended to create a folder/directory on the "E" drive called  "Software" and place the file there.
  3. Login to the intended system
  4. Navigate to the folder location of the downloaded file. Run the installer "As Administrator"
  5. You will receive the License agreement
    1. Click "Accept"
  6. You are now prompted with the default Windows Server options based upon the version of Windows running. This is your starting point and server default settings. NOTE if you every make a mistake in configuring settings you can always revert back to server default settings.
    1. The server default settings are designed to have the most compatibility choices. These are NOT based on any form of security at all.
  7.  It is possible to go through each tab checking or unchecking each option; however we have found the shortcut to resolving the risks faster by utilizing templates provided..
    1. From the main screen navigate on the left hand side to the Templates button and click it. If you have selected the correct option you will see the below screen.
    3. From the Templates Main Screen you will see a drop down box located in the top middle. This drop down list provides 5 options for security.
      1. Server Defaults
      2. Best Practices
      3. PCI 4.0 - This would be our starting point.
      4. Strict
      5. FIPS 140-2
    4. Select the PCI 4.0 template. This provides a description of the template and also provides some ramification when selected. CARE is NEEDED.
      1. Even though you have selected a template it is not applied until you click the Apply button on the bottom right.
      2. Click the Apply button now.
    5. After you have clicked the Apply button navigate back to the main screen to see what has changed.
    6. You are prompted that a reboot is required for the changes to take effect.
      2. Here is what changes when you chose the PCI 4.0 template.
      4. In addition to the  Schannel changes there are also changes to the Cipher Suites used. See the below for what else changed.
    7. As you can see there is a noticeable difference from the server defaults. This is where things get tricky. Some normal administrator functionality can be disrupted by these changes. One such area we ran into in the past is RDP become non-functional. We needed to use the vCenter to access through the console in order to get back in and resolve the RDP issue.
      1. On the Advanced Tab you can see the  DHE (Diffie Hellman) Bit Strength. This usually matches the Bit strength of the SSL certificate.
  8. After the initial PCI 4.0 template is applied you are ready for the reboot. Schedule the reboot so it have the least impact to our stakeholders.
  9. The system will require a rescan after the reboot to determine if anything has stopped working and also if we have resolved all the risks. If there are still some remaining risks you c an open the IISCrypto tool again and make the appropriate changes determined by the rescan.
  10. Continue to rescan the system after each change until all risks are mitigated.

 

 

 

 

 

Feedback and Concerns:

If you have any feedback regarding this article, please reach out to hsitkb@pitt.edu.  You can also leave a comment below as well. 

 

Print Article