Best Practice

SABP-Z-061 6 May 2015

Operating Systems Hardening Guide – Windows 8
Document Responsibility: Plants Networks Standards Committee

Saudi Aramco DeskTop Standards

Table of Contents

1 Introduction……………………............................ 2
2 Conflicts with Mandatory Standards................... 2
3 References......................................................... 2
4 Definitions........................................................... 3
5 Account & passwords Policies............................ 5
6 Services and applications settings.................... 12
7 Rights and Permission Policies......................... 14
8 Hardening controls............................................ 15
9 Logs and Auditing............................................. 22

Previous Issue: New Next Planned Update: 6 May 2020

Page 1 of 24
Primary contact: Ouchn, Nabil J (ouchnnj) on +966-3-8801365

Copyright©Saudi Aramco 2015. All rights reserved.

Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

1 Introduction
1.1 Purpose and Intended Users
The purpose of this best practice document is to establish a recommended
methodology to implement advanced security configurations for Industrial
Control Systems (ICS). These guidelines are intended for plant network
administrator(s) and technical support staff for the purpose of prompt risk
mitigation and overall adherence to company’s cyber security regulations,
especially those intended for immediate implementation. The intended users
include engineers and / or technicians working as Process Automation Network
(PAN) Administrators.
1.2 Scope
This best practice defines the methodology to harden the Windows 8
Operating System configurations settings, which might require software /
hardware to ensure “secure configuration” as per SAEP-99 “Process Automation
Networks and Systems Security” procedure.
This implementation of this best practice shall satisfy the audit requirement for
the BIT recommendations and can be assessed using “Performing Security
Compliance Assessment Manual”
1.3 Disclaimer
This Best Practice complements other procedures or best practices provided by
vendor and / or consulting agent for the implementation of security
configurations by the PAN administrator(s), and shall not be considered
“exclusive” to provide “comprehensive” compliance to SAEP-99 or any other
Saudi Aramco Engineering’s standards requirements.
The use of this Best Practice does not relieve the PAN administrator(s) from
their responsibility or duties to confirm and verify the accuracy of any
information presented herein and the thorough coordination with respective
control system steering committee chairman and vendor.

2 Conflicts with Mandatory Standards

In the event of a conflict between this Best Practice and other Mandatory Saudi Aramco
Engineering Requirements, the Mandatory Saudi Aramco Engineering Requirements
shall govern.
3 References
Specific sections of the following documents are referenced within the body of the
document. Material or equipment supplied to this best practice, shall comply with the
referenced sections of the latest edition of these specifications. Where specific sections
are not referenced, the system shall comply with the entire referenced document.

Page 2 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

 Saudi Aramco References

Saudi Aramco Engineering Procedures
SAEP-99 Process Automation Networks and Systems
Security
SAEP-302 Instructions for Obtaining a Waiver of a
Mandatory Saudi Aramco Engineering
Requirement
Saudi Aramco Engineering Standards
SAES-Z-001 Process Control Systems
SAES-Z-010 Process Automation Networks
General Instruction
GI-0710.002 Classification of Sensitive Information

4 Definitions
This section contains definitions for acronyms, abbreviations, words, and terms as they
are used in this document.
4.1 Acronyms
DCS - Distributed Control System
ESD - Emergency Shutdown Systems
IP - Internet Protocol
ISA - The International Society of Automation
PCS - Process Control Systems
PAN - Process Automation Network
PMS - Power Monitoring System
SCADA - Supervisory Control and Data Acquisition
IP - Internet Protocol
TMS - Terminal Management System
VMS - Vibration Monitoring System
4.2 Abbreviations
Authentication: A security measure designed to establish the validity of a
transmission, message, or originator, or a means of verifying an individual's
authorization to receive specific categories of information. When humans have
assets that are worth to be protected, the authentication always exists. The initial
step in protecting systems and information is authentication that identifies who.

Page 3 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

Process Automation Systems (PAS): PAS include Networks and Systems

hardware and software such as Process Automation Network (PAN), Distributed
Control Systems (DCSs), Emergency Shutdown Systems (ESD), Programmable
Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA)
systems, Terminal Management Systems (TMS), networked electronic sensing
systems, and monitoring (such as VMS AND PMS), diagnostic, and related
industrial automation and control systems. PAS also include associated internal,
human, network, or machine interfaces used to provide control, safety,
maintenance, quality assurance, and other process operations functionalities to
continuous, batch, discrete, and combined processes.
Logs: Files or prints of information in chronological order.
PAN: Process Automation Network, or sometimes referred to as Plant
Information Network (PIN), is a plant-wide network (switches, routers,
firewalls, computers, etc. interconnecting process control system and provides
an interface to the corporate network. PAN Administrator: Process Automation
Networks (PAN) Administrator administers and performs system configuration
and monitoring and coordinating with Process Control System Administrator, if
different, as designated by the plant management. The PAN Administrator
assumes the ownership of the IA&CS including the PAN Firewall and has the
function of granting, revoking, and tracking access privileges and
communications of users on ICS including the Firewall.
Password: A form of secret authentication data that is used to control access to
a resource. Password authentication determines authenticity based on testing for
a device or a user that is requesting access to systems using for example a
personal identification number (PIN) or password. Password authentication
scheme is the simplest and most common mechanism.
Server: A dedicated un-manned data provider.

Page 4 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

5 Account & passwords Policies

W8-AP-01
W8-AP-02
12.0.a
Domain Windows 8 Ref. W8-AP-03 BIT
12.0.c
W8-AP-05
W8-AP-06
Target Windows 8 SAEP-99 5.1.6.1.a-f
Mapping
Set mininal password age
Set maximum password age
Set password complexity
Action
Set password length
Set password history
Storing password using Reverse encryption
State Final Version 1.0 Created on 10/29/13
R C
RACI Matrix Priority HIGH
A I
Pre requisite

Dependencies

1. Press Windows button + R to bring up the run command window, type

secpol.msc and press ENTER

Instruction

2. Click on “Security Settings” then “Account Policies” then “Password

Policy”. Password parameters settings and Configure the following:
• Minimum password length is set to at least 6 characters

Page 5 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

• Password must meet complexity requirements is enabled

• Enforce password history is set to 3 passwords remembered.
• Maximum password age is set to 180 days
• Minimum password age is set 0 days
• Store using reversible encryption is set to Disabled

Automated task no

W8-AP-09
Domain Windows 8 Ref. W8-AP-10 BIT #12.0.a
W8-AP-11
Target Windows 8 versions Mapping SAEP-99 5.1.6.1.a-f

Action Set account Lockout duration and threshold

State Final Version 1.0 Created on 10/29/13

R C
RACI Matrix Priority HIGH
A I
Pre requisite

Dependencies
1. Press Windows button + R to bring up the run command window and
type secpol.msc and press ENTER
2. Click on “Security Settings” then “Account Policy” then “Account Lockout
Policy”. Configure the following:
3. Account lockout duration is set to 1440 minutes.
4. Account lockout threshold is set to 5 invalid logon attempts.
5. Reset account not applicable

Instruction

Automated task no

Page 6 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

Domain Windows 8 Ref. W8-AP-14 BIT

Target Windows 8 versions Mapping SAEP-99

Action Rename Administrator Account

State Final Version 1.0 Created on 10/29/13

R C
RACI Matrix Priority
A I
Pre requisite

Dependencies

1. Press Windows button + R to bring up the run command window and

type compmgmt.msc and press ENTER

2. In the console tree, e8and Local Users and Groups, and then click Users.

3. In the right pane, right-click Administrator then select Rename

4. Enter new value
• root_admin_2013

Instruction

Automated task yes

Page 7 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

Domain Windows 8 Ref. W8-AP-16 BIT 8.6

Target Mapping SAEP-99 5.1.6.1.l

Action Change SNMP default credentials

State Final Version 1.0 Created on 10/29/13

R C
RACI Matrix Priority HIGH
A I
SNMP should be authorized and enabled
Pre requisite
If SNMP is disabled skip this control
Dependencies

1. Press Windows button + R to bring up the run command window and type
compmgmt.msc and press ENTER
2. In the console tree, e8and Services and Applications, and then click
Services.
3. In the right pane, double-click SNMP Service then select Properties

Instruction 4. Click the Traps tab.

5. In the “Community name” text box, edit public community and change it
accordingly to a new community name that respects at least:
• Minimum password length is set to at least 6 characters
• Password must meet complexity requirements

Page 8 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

6. Click on Security tab. If you already close SNMP Service Properties window, re-open
it.
7. Under “Accepted community names” section, click Add button.
8. Select the appropriate permission level for the community string in the “Community
Rights” drop down list to specify how the host processes SNMP requests from the
selected community.
• Set permissions to READ ONLY

Page 9 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

Automated task no

Page 10 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

6 Services and applications settings

W8-SA-17
Domain Windows 8 Ref. BIT 8.5
W8-SA-18
5.3.c
Target Windows 8 versions Mapping SAEP-99 5.4.2.m
5.1.6.1.o
Disable Simple Network Management
Action
Protocol (SNMP) Service and Trap Service
State Final Version 1.0 Created on 10/29/13
R C
RACI Matrix Priority HIGH
A I
Pre requisite

Dependencies
1. Press Windows button + R to bring up the run command window and type
compmgmt.msc and press ENTER
2. From the Computer Management window, click “Services and Applications”
then click “Services”.

3. Locate “SNMP Service”. Double click and set value of startup type to
manual

Instruction

4. Locate “SNMP Trap”. Double click and set value of startup type to manual

Automated task yes

Page 11 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

7 Rights and Permission Policies

Domain Windows 8 Ref. W8-RP-54 BIT

Target Mapping SAEP-99
Allow only authorized administrator to access
Action
RDP service
State Final Version 1.0 Created on 10/29/13
R C
RACI Matrix Priority
A I
Pre requisite Users should be pre-defined into group “Remote Desktop Users”

Dependencies W8-HC-70 : Set client connection 128-bit encryption level

1. Browse to System in “Control Panel”

2. Click on Remote Settings Option that is located on the upper left of the opened
screen and so click on Remote

Instruction

Page 12 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

3. Enable “Allow users to connect remotely to this computer”

4. Click "Select Remote Users."

5. Press Windows button + R to bring up the run command window and type
secpol.msc and press ENTER

6. Under Local Policies - User Rights Assignment, "Allow logon through

Terminal Services." And just next to it is "Administrators, Remote Desktop

Page 13 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

Users."

Automated task no

Page 14 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

8 Hardening controls

Domain Windows 8 Ref. W8-HC-66 BIT 22.2.b

Target OS Versions Mapping SAEP-99 5.3.c

Action Disable Remote Assistance

State Final Version 1.0 Created on 10/29/13

R C
RACI Matrix Priority HIGH
A I
Pre requisite

Dependencies W8-HC-67 : Do not allow Remote Desktop services

1. Browse to System in “Control Panel”

2. Click on Remote Settings Option that is located on the upper left of the
opened screen and so click on Remote

Instruction

Page 15 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

3. Ensure this option is not enabled by unchecking “Allow Remote

Assistance”

Automated task

Domain Windows 8 Ref. W8-HC-67 BIT 22.2.b

Target Windows 8 versions SAEP-99 5.3.c

Mapping
Action Do not allow Remote Desktop services (RDP)

State Final Version 1.0 Created on 10/29/13

R C
RACI Matrix Priority HIGH
A I
Pre requisite Hardening RDP protocol if enabled. Other skip.

W8-HC-66: Disable Remote Assistance

Dependencies W8-AP-14: Rename administrator account
W8-HC-69: Change default Terminal Server TCP port 3389

1. Browse to System in “Control Panel”

Instruction 2. Click on Remote Settings Option that is located on the upper left of the opened
screen and so click on Remote

Page 16 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

3. Be sure to clear the checkbox “Allow users to connect remotely to this

computer”.

Automated task

Page 17 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

Domain Windows 8 Ref. W8-HC-68 BIT 16.3

Target Windows 8 versions Mapping SAEP-99 5.3
Disable user access to Anti-Virus
Action
Management Settings
State Final Version 1.0 Created on 10/29/13
R C
RACI Matrix Priority HIGH
A I
Pre requisite

Dependencies
1. Click Start, Programs, McAfee, VirusScan Console.
2. Double-click Access Protection.
3. Check “Prevent McAfee Services from being stopped” if not enabled
4. Click Apply and OK.

Instruction

Automated task

Page 18 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

Domain Windows 8 Ref. W8-HC-69 BIT

Target Mapping SAEP-99
Change default Terminal Server TCP port
Action
3389
State Final Version 1.0 Created on 10/29/13
R C
RACI Matrix Priority
A I
Applied to only Windows 8
Pre requisite Computer should be restarted to reflect the changes
Client Side should be modified to connect to the new TCP port
Dependencies
1. Press Windows button + R to bring up the run command window and type
Regedt32.exe and press ENTER
2. Go to this key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal
Server\WinStations\RDP-Tcp

Instruction

3. Find the "PortNumber" subkey and notice the value of 00000D3D, hex for (3389).
Modify the port number in Hex and save the new value as

a. 0000344D which stands for 13389

Page 19 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

Automated task no

Domain Windows 8 Ref. W8-HC-72 BIT 8.3

Target OS Versions Mapping SAEP-99 n/a

Action Configure the Host Name

State Final Version 1.0 Created on 10/29/13

R C
RACI Matrix Priority HIGH
A I
Pre requisite Naming convention procedure should exists. Router/Switch should reflect the type and role.

Dependencies

1. Browse to System in “Control Panel”

2. Click System
3. Click on Change Settings on lower right

Instruction

4. Select Change to provide a new name

Page 20 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

Proposal
- Geo location: 3 characters referring to City or Plant (URT, ABQ, DHR ...)
- Admin Area : 3 characters referring to whether it is an Oil or Gas plant
- Device role : 2 or 3 characters indicating the device role
o PLC, DCS..
o WRK stands for workstation
o SRV stands for server
o PRT stands for printer
o FW for Firewall , RT for Router and so on
- Incremental ID : 3 variables
Ex : ABQ-WKS-005 : means Workstation 5 in Abqaiq plant

Automated task

Page 21 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

9 Logs and Auditing

Domain Windows 8 Ref. W8-LA-12 BIT 18.0.a

Target Windows 8 versions Mapping SAEP-99 5.5.1.d.iv
Set maximum log size for Application,
Action
security and system events
State Final Version 1.0 Created on 10/29/13
R C
RACI Matrix Priority HIGH
A I
Pre requisite

Dependencies W8-RP-53 : Restrict access to logs files

1. Press Windows button + R to bring up the run command window and type
gpedit.msc and press ENTER

2. Browse to Local Computer Policy/Computer Configuration/Administrative

Templates/Windows Components/Event Log Service.

Instruction

3. Select Application folder and set the recommended logs size values as follow:
 Specify the Application maximum log file size (KB) to 16384 kilobytes

Page 22 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

4. Select Security folder and set the recommended logs size values as follow:
 Specify the Security maximum log file size (KB) to 81920 kilobyte

5. Select System folder and set the recommended logs size values as follow:
 Specify the System maximum log file size (KB) to 16384 kilobytes

The maximum event log could not exceed 4GB

Automated task N/A

Domain Windows 8 Ref. W8-LA-13 BIT 18.0.a

Target Windows 8 versions Mapping SAEP-99 5.5.1.d.iv

Set Log Retention for Application, Security
Action
and System
State Final Version 1.0 Created on 10/29/13
R C
RACI Matrix Priority HIGH
A I
Pre requisite

Dependencies W8-LA-12: Application/Security/System Logs: Maximum Event Log Size

1. Press Windows button + R to bring up the run command window and type
eventvwr.msc and press ENTER to open de Event Viewer.

2. Browse to the left panel, click on Windows Logs then Application, now right click
Instruction on Application and select Properties.

3. Check the options

• Do not overwrite events

Page 23 of 24
Document Responsibility: Plants Networks Standards Committee SABP-Z-061
Issue Date: 6 May 2015 Operating Systems Hardening
Next Planned Update: 6 May 2020 Guide – Windows 8

During Monthly audit log reviews, move archived event logs stored at the log path
shown above to external storage to maintain a one year archive
• Repeat this procedure for the following event logs:
1. All PAS workstations and servers
1. System logs
2. Application logs
3. Security logs
2. Windows AD server or Domain Controllers:
1. Directory Services.

Automated task N/A

Revision Summary
6 May 2015 New Saudi Aramco Best Practice.

Page 24 of 24