Sabp Z 084

Best Practice
SABP-Z-084 20 April 2016
Operating Systems Hardening Guide – Windows Server 2012

Document Responsibility: Plants Networks Standards Committee
Saudi Aramco DeskTop Standards

Table of Contents
1 Introduction 2
2 Conflicts with Mandatory Standards 2
3 References 2
4 Definitions 3
5 Account & passwords Policies 5
6 Services and applications settings 10
7 Rights and Permission Policies 11
9 Hardening controls 14
10 Logs and Auditing 23
Previous Issue: New Next Planned Update: 3 May 2020

Page 1 of 25
Primary contact: Ouchn, Nabil J (ouchnnj) on +966-3-8801365
Copyright©Saudi Aramco 2016. All rights reserved.

Document Responsibility: Plants Networks Standards Committee SABP-Z-084
Issue Date: 20 April 2016 Operating Systems Hardening
Next Planned Update: 3 May 2020 Guide – Windows Server 2012
1 Introduction
1.1 Purpose and Intended Users
The purpose of this best practice document is to establish a recommended
methodology to implement advanced security configurations for Industrial
Control Systems (ICS). These guidelines are intended for plant network
administrator(s) and technical support staff for the purpose of prompt risk
mitigation and overall adherence to company’s cyber security regulations,
especially those intended for immediate implementation. The intended users
include engineers and / or technicians working as Process Automation Network
(PAN) Administrators.
1.2 Scope
This best practice defines the methodology to harden the Windows Server 2012
Operating System configurations settings, which might require software /
hardware to ensure “secure configuration” as per SAEP-99 “Process Automation
Networks and Systems Security” procedure.
1.3 Disclaimer
This Best Practice complements other procedures or best practices provided by
vendor and / or consulting agent for the implementation of security configurations
by the PAN administrator(s), and shall not be considered “exclusive” to provide
“comprehensive” compliance to SAEP-99 or any other Saudi Aramco
Engineering’s standards requirements.
The use of this Best Practice does not relieve the PAN administrator(s) from their
responsibility or duties to confirm and verify the accuracy of any information
presented herein and the thorough coordination with respective control system
steering committee chairman and vendor.
2 Conflicts with Mandatory Standards

In the event of a conflict between this Best Practice and other Mandatory Saudi Aramco
Engineering Requirements, the Mandatory Saudi Aramco Engineering Requirements
shall govern.
3 References
Specific sections of the following documents are referenced within the body of the
document. Material or equipment supplied to this best practice, shall comply with the
referenced sections of the latest edition of these specifications. Where specific sections
are not referenced, the system shall comply with the entire referenced document.
 Saudi Aramco References
Saudi Aramco Engineering Procedures
Page 2 of 25
SAEP-99 Process Automation Networks and Systems

Security
Saudi Aramco Engineering Standards
SAES-Z-001 Process Control Systems
SAES-Z-010 Process Automation Networks
General Instruction
GI-0710.002 Classification of Sensitive Information
4 Definitions
This section contains definitions for acronyms, abbreviations, words, and terms as they
are used in this document.
4.1 Acronyms
DHCP - Dynamic Host Configuration Protocol
HTTPS - HyperText Transfer Protocol Secure
IP - Internet Protocol
NTP - Network Time Protocol
PCS - Process Control Systems
PAN - Process Automation Network
SSH - Secure Shell
SNMP - Simple Network Management Protocol
4.2 Abbreviations
Authentication: A security measure designed to establish the validity of a
transmission, message, or originator, or a means of verifying an individual's
authorization to receive specific categories of information. When humans have
assets that are worth to be protected, the authentication always exists. The initial
step in protecting systems and information is authentication that identifies who.
Process Automation Systems (PAS): PAS include Networks and Systems
hardware and software such as Process Automation Network (PAN), Distributed
Control Systems (DCSs), Emergency Shutdown Systems (ESD), Programmable
Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA)
systems, Terminal Management Systems (TMS), networked electronic sensing
systems, and monitoring (such as VMS AND PMS), diagnostic, and related
industrial automation and control systems. PAS also include associated internal,
human, network, or machine interfaces used to provide control, safety,
maintenance, quality assurance, and other process operations functionalities to
continuous, batch, discrete, and combined processes.
Page 3 of 25
Logs: Files or prints of information in chronological order.

PAN: Process Automation Network, or sometimes referred to as Plant
Information Network (PIN), is a plant-wide network (switches, routers, firewalls,
computers, etc. interconnecting process control system and provides an interface
to the corporate network. PAN Administrator: Process Automation Networks
(PAN) Administrator administers and performs system configuration and
monitoring and coordinating with Process Control System Administrator, if
different, as designated by the plant management. The PAN Administrator
assumes the ownership of the IA&CS including the PAN Firewall and has the
function of granting, revoking, and tracking access privileges and
communications of users on ICS including the Firewall.
Password: A form of secret authentication data that is used to control access to
a resource. Password authentication determines authenticity based on testing for
a device or a user that is requesting access to systems using for example a personal
identification number (PIN) or password. Password authentication scheme is the
simplest and most common mechanism.
Server: A dedicated un-manned data provider.
Page 4 of 25
5 Account & passwords Policies
W12-AP-01
W12-AP-02
12.0.a
Domain Windows Ref. W12-AP-03 BIT
12.0.c
W12-AP-05
W12-AP-06
Target Windows Server 2012 SAEP-99 5.1.6.1.a-f
Mapping
Set mininal password age
Set maximum password age
Set password complexity
Action
Set password length
Set password history
Storing password using Reverse encryption
State Final Version 1.0 Created on 02/02/16
R C
RACI Matrix Priority HIGH
A I
Pre requisite
Dependencies
1. Press Windows button + R to bring up the run command window, type

secpol.msc and press ENTER
2. Click on “Security Settings” then “Account Policies” then “Password

Policy”. Password parameters settings and Configure the following:
Instruction
• Minimum password length is set to at least 8 characters
• Password must meet complexity requirements is enabled
• Enforce password history is set to 6 passwords remembered.
• Maximum password age is set to 180 days
• Minimum password age is set 0 days
• Store using reversible encryption is set to Disabled
Page 5 of 25
W12-AP-09
Domain Windows Ref. W12-AP-10 BIT 12.0.a
W12-AP-11
Target Windows Server 2012 Mapping SAEP-99 5.1.6.1.a-f
Action Set account Lockout duration and threshold

R C
A I
Pre requisite
Dependencies
1. Press Windows button + R to bring up the run command window and
type secpol.msc and press ENTER
2. Click on “Security Settings” then “Account Policy” then “Account Lockout
Policy”. Configure the following:
Instruction
3. Account lockout duration is set to 1440 minutes (24 Hours)
4. Account lockout threshold is set to 5 invalid logon attempts.
5. Reset account not applicable
Page 6 of 25
Domain Windows Ref. W12-AP-14 BIT

Target Windows Server 2012 Mapping SAEP-99
Action Rename Administrator Account

R C
RACI Matrix Priority LOW
A I
Pre requisite
Dependencies
1. Press Windows button + R to bring up the run command window and

type compmgmt.msc and press ENTER
2. In the console tree, locate Local Users and Groups, and then click Users.
Instruction
3. In the right pane, right-click Administrator then select Rename
4. Enter new value
• NEW ADMIN NAME (toor_123 for example)
Page 7 of 25
Domain Windows Ref. W12-AP-16 BIT 8.6

Target Windows Server 2012 Mapping SAEP-99 5.1.6.1.l
Action Change SNMP default credentials

R C
RACI Matrix Priority MODERATE
A I
If SNMP required for alarming purposes (Consult with the vendor)
Pre requisite
Otherwise skip this control
Dependencies
1. Press Windows button + R to bring up the run command window and type
compmgmt.msc and press ENTER
2. In the console tree, locate Services and Applications, and then click
Services.
Instruction
3. In the right pane, double-click SNMP Service then select Properties
4. Click the Security tab.
5. In the “Community name” text box, edit public community and change it
accordingly to a new community name that respects at least:
Page 8 of 25
• Minimum password length is set to at least 8 characters

• Password must meet complexity requirements
6. Click on Security tab. If you already close SNMP Service Properties window, re-open
it.
7. Under “Accepted community names” section, click Add button.
8. Select the appropriate permission level for the community string in the “Community
Rights” drop down list to specify how the host processes SNMP requests from the
selected community.
• Set permissions to READ ONLY
Page 9 of 25
6 Services and applications settings
W12-SA-17
Domain Windows Ref. BIT 8.5
W12-SA-18
5.3.c
Target Windows Server 2012 Mapping SAEP-99 5.4.2.m
5.1.6.1.o
Disable Simple Network Management
Action
Protocol (SNMP) Service and Trap Service
R C
A I
Pre requisite
Dependencies
compmgmt.msc and press ENTER
2. From the Computer Management window, click “Services and Applications”
then click “Services”.
3. Locate “SNMP Service”. Double click and set value of startup type to
manual
Instruction
4. Locate “SNMP Trap”. Double click and set value of startup type to manual
Page 10 of 25
7 Rights and Permission Policies
Domain Windows Ref. W12-RP-54 BIT

Target Windows Server 2012 Mapping SAEP-99
Allow only authorized administrator to access
Action
RDP service
R C
A I
Users should be pre-defined into group “Remote Desktop Users”
Pre requisite
RDP used within the Plants as defined by SAEP-99
Dependencies Refer to document RDP Remote Access - Mitigation Controls
Page 11 of 25
1. Log onto your Windows Server 2012, click on server manager, then click on
Local Server and under the Properties screen, you will see Remote Desktop
currently disabled
Instruction
2. Click on Disabled. The system properties screen will appear. Select ‘Allow remote
connections to this computer’, leave the Recommended check-box checked
Page 12 of 25
3. Click "Select Remote Users." and add only authorized administrators
Page 13 of 25
9 Hardening controls
Domain Windows Ref. W12-HC-66 BIT 22.2.b
Target Windows Server 2012 Mapping SAEP-99 5.3.c
Action Disable Remote Assistance

R C
RACI Matrix Priority MODERATE
A I
Pre requisite
Dependencies W12-HC-67 : Do not allow Remote Desktop services
Local Server and under the Properties screen
2. Click on Server Remote Desktop the system properties screen will appear.
3. Uncheck ‘Allow remote assistance to this computer’ if enabled
Instruction
Page 14 of 25
Domain Windows Ref. W12-HC-67 BIT 22.2.b
Target Windows Server 2012 SAEP-99 5.3.c

Mapping
Action Do not allow Remote Desktop services (RDP)

R C
A I
Pre requisite Hardening RDP protocol if enabled. Other skip.
Dependencies
Page 15 of 25
Local Server and under the Properties screen,
2. If you see Remote Desktop currently disabled. Then quit the configuration
Instruction 3. If RDP is not disabled. Click to Open System Properties and check Don’t Allow
remote connections to this computer
Page 16 of 25
Domain Windows Ref. W12-HC-68 BIT 16.3

Target Windows Server 2012 Mapping SAEP-99 5.3
Disable user access to Anti-Virus
Action
Management Settings
R C
A I
Pre requisite
Dependencies
1. Click Start, Programs, McAfee, VirusScan Console.
2. Double-click Access Protection.
3. Check “Prevent McAfee Services from being stopped” if not enabled
4. Click Apply and OK.
Instruction
Domain Windows Ref. W12-HC-69 Mapping BIT
Page 17 of 25
Target Windows Server 2012 SAEP-99

Change default Terminal Server TCP port
Action
3389
R C
RACI Matrix Priority LOW
A I
Pre requisite
Dependencies Refer to document RDP Remote Access - Mitigation Controls

Regedt32.exe and press ENTER
2. Go to this key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
Server\WinStations\RDP-Tcp
Instruction
3. Find the "PortNumber" subkey and notice the value of 00000D3D, hex for (3389).
Modify the port number in Hex and save the new value as
Page 18 of 25
0000344D which stands for 13389
Domain Windows Ref. W12-HC-72 Mapping BIT 8.3
Page 19 of 25
Target Windows Server 2012 SAEP-99 n/a
Action Configure the Host Name

R C
A I
Pre requisite Naming convention procedure should exists.
Dependencies
Page 20 of 25
1. Browse to System in “server manager” and click Local Server
Instruction 2. Click on the current name in Computer Name
3. System Properties will open
Page 21 of 25
4. Select Change to provide a new name
Proposal
- Geo location: 3 characters referring to City or Plant (URT, ABQ, DHR ...)
- Admin Area : 3 characters referring to whether it is an Oil or Gas plant
- Device role : 2 or 3 characters indicating the device role
o PLC, DCS..
o WRK stands for workstation
o SRV stands for server
o PRT stands for printer
o FW for Firewall , RT for Router and so on
- Incremental ID : 3 variables
Page 22 of 25
10 Logs and Auditing
Domain Windows Ref. W12-LA-12 BIT 18.0.a

Target Windows Server 2012 Mapping SAEP-99 5.5.1.d.iv
Set maximum log size for Application,
Action
security and system events
R C
A I
Pre requisite
Dependencies
1. Start Event Viewer (Control Panel / System and Maintenance / Administrative Tools)
Instruction
2. On Action menu, click Properties and in Maximum log size (KB) use the spinner
control to set the following value you want and click OK .
 Specify the Application maximum log file size (KB) to 16384 kilobytes
 Specify the Security maximum log file size (KB) to 81920 kilobyte
 Specify the System maximum log file size (KB) to 16384 kilobytes
The maximum event log could not exceed 4GB
Page 23 of 25
Domain Windows Ref. W12-LA-13 BIT 18.0.a
Target Windows Server 2012 Mapping SAEP-99 5.5.1.d.iv

Set Log Retention for Application, Security
Action
and System
R C
A I
Pre requisite
Dependencies W12-LA-12: Application/Security/System Logs: Maximum Event Log Size

1. Start Event Viewer (Control Panel / System and Maintenance / Administrative Tools
2. On Action menu, click Properties and in Maximum log size (KB) use the spinner
control to set the following value you want and click OK .
3. In Enable Logging section of the General tab, select the option that corresponds to
the retention policy you want to set. Do not overwrite events
Instruction
During Monthly audit log reviews, move archived event logs stored at the log path
shown above to external storage to maintain a one year archive
• Repeat this procedure for the following event logs:
1. All PAS workstations and servers
1. System logs
Page 24 of 25
2. Application logs
3. Security logs
2. Windows AD server or Domain Controllers:
1. Directory Services.
Page 25 of 25

Sabp Z 084

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sabp Z 084

Uploaded by

Copyright:

Available Formats

Best Practice

SABP-Z-084 20 April 2016

Operating Systems Hardening Guide – Windows Server 2012

Saudi Aramco DeskTop Standards

Previous Issue: New Next Planned Update: 3 May 2020

Copyright©Saudi Aramco 2016. All rights reserved.

2 Conflicts with Mandatory Standards

SAEP-99 Process Automation Networks and Systems

Logs: Files or prints of information in chronological order.

5 Account & passwords Policies

1. Press Windows button + R to bring up the run command window, type

2. Click on “Security Settings” then “Account Policies” then “Password

Action Set account Lockout duration and threshold

State Final Version 1.0 Created on 02/02/16

Domain Windows Ref. W12-AP-14 BIT

Action Rename Administrator Account

State Final Version 1.0 Created on 02/02/16

1. Press Windows button + R to bring up the run command window and

Domain Windows Ref. W12-AP-16 BIT 8.6

Action Change SNMP default credentials

State Final Version 1.0 Created on 02/02/16

• Minimum password length is set to at least 8 characters

6 Services and applications settings

7 Rights and Permission Policies

Domain Windows Ref. W12-RP-54 BIT

3. Click "Select Remote Users." and add only authorized administrators

Action Disable Remote Assistance

State Final Version 1.0 Created on 02/02/16

Dependencies W12-HC-67 : Do not allow Remote Desktop services

3. Uncheck ‘Allow remote assistance to this computer’ if enabled

Domain Windows Ref. W12-HC-67 BIT 22.2.b

Target Windows Server 2012 SAEP-99 5.3.c

State Final Version 1.0 Created on 02/02/16

Domain Windows Ref. W12-HC-68 BIT 16.3

Domain Windows Ref. W12-HC-69 Mapping BIT

Target Windows Server 2012 SAEP-99

Dependencies Refer to document RDP Remote Access - Mitigation Controls

0000344D which stands for 13389

Domain Windows Ref. W12-HC-72 Mapping BIT 8.3

Target Windows Server 2012 SAEP-99 n/a

Action Configure the Host Name

State Final Version 1.0 Created on 02/02/16

1. Browse to System in “server manager” and click Local Server

Instruction 2. Click on the current name in Computer Name

3. System Properties will open

4. Select Change to provide a new name

10 Logs and Auditing

Domain Windows Ref. W12-LA-12 BIT 18.0.a

The maximum event log could not exceed 4GB

Domain Windows Ref. W12-LA-13 BIT 18.0.a

Target Windows Server 2012 Mapping SAEP-99 5.5.1.d.iv

Dependencies W12-LA-12: Application/Security/System Logs: Maximum Event Log Size

You might also like