Sabp Z 063

Best Practice
SABP-Z-063 7 May 2015

Operating Systems Hardening Guide – Windows Server 2008
Document Responsibility: Plants Networks Standards Committee
Saudi Aramco DeskTop Standards

Table of Contents
1 Introduction……………………............................ 2
2 Conflicts with Mandatory Standards................... 2
3 References......................................................... 2
4 Definitions........................................................... 3
5 Account & passwords Policies............................ 5
6 Services and applications settings.................... 11
7 Rights and Permission Policies......................... 12
8 Hardening controls............................................ 14
9 Logs and Auditing............................................. 21
Previous Issue: New Next Planned Update: 7 May 2020

Page 1 of 23
Primary contact: Ouchn, Nabil J (ouchnnj) on +966-3-8801365
Copyright©Saudi Aramco 2015. All rights reserved.

Document Responsibility: Plants Networks Standards Committee SABP-Z-063
Issue Date: 7 May 2015 Operating Systems Hardening
Next Planned Update: 7 May 2020 Guide – Windows Server 2008
1 Introduction
1.1 Purpose and Intended Users
The purpose of this best practice document is to establish a recommended
methodology to implement advanced security configurations for Industrial
Control Systems (ICS). These guidelines are intended for plant network
administrator(s) and technical support staff for the purpose of prompt risk
mitigation and overall adherence to company’s cyber security regulations,
especially those intended for immediate implementation. The intended users
include engineers and / or technicians working as Process Automation Network
(PAN) Administrators.
1.2 Scope
This best practice defines the methodology to harden the Windows 2008
Operating System configurations settings, which might require software /
hardware to ensure “secure configuration” as per SAEP-99 “Process Automation
Networks and Systems Security” procedure.
This implementation of this best practice shall satisfy the audit requirement for
the BIT recommendations and can be assessed using “Performing Security
Compliance Assessment Manual”
1.3 Disclaimer
This Best Practice complements other procedures or best practices provided by
vendor and / or consulting agent for the implementation of security
configurations by the PAN administrator(s), and shall not be considered
“exclusive” to provide “comprehensive” compliance to SAEP-99 or any other
Saudi Aramco Engineering’s standards requirements.
The use of this Best Practice does not relieve the PAN administrator(s) from
their responsibility or duties to confirm and verify the accuracy of any
information presented herein and the thorough coordination with respective
control system steering committee chairman and vendor.
2 Conflicts with Mandatory Standards

In the event of a conflict between this Best Practice and other Mandatory Saudi Aramco
Engineering Requirements, the Mandatory Saudi Aramco Engineering Requirements
shall govern.
3 References
Specific sections of the following documents are referenced within the body of the
document. Material or equipment supplied to this best practice, shall comply with the
referenced sections of the latest edition of these specifications. Where specific sections
are not referenced, the system shall comply with the entire referenced document.
Page 2 of 23
 Saudi Aramco References

Saudi Aramco Engineering Procedures
SAEP-99 Process Automation Networks and Systems
Security
SAEP-302 Instructions for Obtaining a Waiver of a
Mandatory Saudi Aramco Engineering
Requirement
Saudi Aramco Engineering Standards
SAES-Z-001 Process Control Systems
SAES-Z-010 Process Automation Networks
General Instruction
GI-0710.002 Classification of Sensitive Information
4 Definitions
This section contains definitions for acronyms, abbreviations, words, and terms as they
are used in this document.
4.1 Acronyms
DCS - Distributed Control System
ESD - Emergency Shutdown Systems
IP - Internet Protocol
ISA - The International Society of Automation
PCS - Process Control Systems
PAN - Process Automation Network
PMS - Power Monitoring System
SCADA - Supervisory Control and Data Acquisition
IP - Internet Protocol
TMS - Terminal Management System
VMS - Vibration Monitoring System
4.2 Abbreviations
Authentication: A security measure designed to establish the validity of a
transmission, message, or originator, or a means of verifying an individual's
authorization to receive specific categories of information. When humans have
assets that are worth to be protected, the authentication always exists. The initial
step in protecting systems and information is authentication that identifies who.
Page 3 of 23
Process Automation Systems (PAS): PAS include Networks and Systems

hardware and software such as Process Automation Network (PAN), Distributed
Control Systems (DCSs), Emergency Shutdown Systems (ESD), Programmable
Logic Controllers (PLCs), Supervisory Control and Data Acquisition (SCADA)
systems, Terminal Management Systems (TMS), networked electronic sensing
systems, and monitoring (such as VMS AND PMS), diagnostic, and related
industrial automation and control systems. PAS also include associated internal,
human, network, or machine interfaces used to provide control, safety,
maintenance, quality assurance, and other process operations functionalities to
continuous, batch, discrete, and combined processes.
Logs: Files or prints of information in chronological order.
PAN: Process Automation Network, or sometimes referred to as Plant
Information Network (PIN), is a plant-wide network (switches, routers,
firewalls, computers, etc. interconnecting process control system and provides
an interface to the corporate network. PAN Administrator: Process Automation
Networks (PAN) Administrator administers and performs system configuration
and monitoring and coordinating with Process Control System Administrator, if
different, as designated by the plant management. The PAN Administrator
assumes the ownership of the IA&CS including the PAN Firewall and has the
function of granting, revoking, and tracking access privileges and
communications of users on ICS including the Firewall.
Password: A form of secret authentication data that is used to control access to
a resource. Password authentication determines authenticity based on testing for
a device or a user that is requesting access to systems using for example a
personal identification number (PIN) or password. Password authentication
scheme is the simplest and most common mechanism.
Server: A dedicated un-manned data provider.
Page 4 of 23
5 Account & passwords Policies
W2K8-AP-01
W2K8-AP-02
Windows 12.0.a
Domain Ref. W2K8-AP-03 BIT
Server 2008 12.0.c
W2K8-AP-05
W2K8-AP-06
Target Windows Server 2008 SAEP-99 5.1.6.1.a-f
Mapping
Set mininal password age
Set maximum password age
Set password complexity
Action
Set password length
Set password history
Storing password using Reverse encryption
State Final Version 1.0 Created on 10/29/13
R C
RACI Matrix Priority HIGH
A I
Pre requisite
Dependencies
1. Press Windows button + R to bring up the run command window, type
secpol.msc and press ENTER
Instruction
2. Click on “Security Settings” then “Account Policies” then “Password

Policy”. Password parameters settings and Configure the following:
• Minimum password length is set to at least 6 characters
• Password must meet complexity requirements is enabled
Page 5 of 23
• Enforce password history is set to 3 passwords remembered.

• Maximum password age is set to 180 days
• Minimum password age is set 0 days
• Store using reversible encryption is set to Disabled
Automated task no
W2K8-AP-09
Windows
Domain Ref. W2K8-AP-10 BIT #12.0.a
Server 2008
W2K8-AP-11
Target Windows Server 2008 Mapping SAEP-99 5.1.6.1.a-f
Action Set account Lockout duration and threshold

R C
A I
Pre requisite
Dependencies
1. Press Windows button + R to bring up the run command window and
type secpol.msc and press ENTER
2. Click on “Security Settings” then “Account Policy” then “Account
Lockout Policy”. Configure the following:
3. Account lockout duration is set to 1440 minutes.
4. Account lockout threshold is set to 5 invalid logon attempts.
5. Reset account not applicable
Instruction
Automated task no
Page 6 of 23
Windows
Domain Ref. W2K8-AP-14 BIT
Server 2008
Target Windows Server 2008 Mapping SAEP-99
Action Rename Administrator Account

R C
RACI Matrix Priority
A I
Pre requisite
Dependencies
1. Press Windows button + R to bring up the run command window and

type compmgmt.msc and press ENTER
2. In the console tree, e8and Local Users and Groups, and then click Users.
3. In the right pane, right-click Administrator then select Rename

4. Enter new value
• root_admin_2013
Instruction
Automated task yes
Page 7 of 23
Windows
Domain Ref. W2K8-AP-16 BIT 8.6
Server 2008
Target Mapping SAEP-99 5.1.6.1.l
Action Change SNMP default credentials

R C
A I
SNMP should be authorized and enabled
Pre requisite
If SNMP is disabled skip this control
Dependencies
1. Press Windows button + R to bring up the run command window and type
compmgmt.msc and press ENTER
2. In the console tree, e8and Services and Applications, and then click
Services.
3. In the right pane, double-click SNMP Service then select Properties
Instruction 4. Click the Traps tab.

5. In the “Community name” text box, edit public community and change it
accordingly to a new community name that respects at least:
• Minimum password length is set to at least 6 characters
• Password must meet complexity requirements
Page 8 of 23
6. Click on Security tab. If you already close SNMP Service Properties window, re-open
it.
7. Under “Accepted community names” section, click Add button.
8. Select the appropriate permission level for the community string in the “Community
Rights” drop down list to specify how the host processes SNMP requests from the
selected community.
• Set permissions to READ ONLY
Page 9 of 23
Automated task no
Page 10 of 23
6 Services and applications settings
Windows W2K8-SA-17
Domain Ref. BIT 8.5
Server 2008 W2K8-SA-18
5.3.c
Target Windows Server 2008 Mapping SAEP-99 5.4.2.m
5.1.6.1.o
Disable Simple Network Management
Action
Protocol (SNMP) Service and Trap Service
R C
A I
Pre requisite
Dependencies
compmgmt.msc and press ENTER
2. From the Computer Management window, click “Services and Applications”
then click “Services”.
3. Locate “SNMP Service”. Double click and set value of startup type to
manual
Instruction
4. Locate “SNMP Trap” service. Double click and set value of startup type to
manual
Automated task yes
Page 11 of 23
7 Rights and Permission Policies
Windows
Domain Ref. W2K8-RP-54 BIT
Server 2008
Target Mapping SAEP-99
Allow only authorized administrator to access
Action
RDP service
R C
A I
Pre requisite Users should be pre-defined into group “Remote Desktop Users”
Dependencies W2K8-HC-70 : Set client connection 128-bit encryption level

sysdm.cpl and press ENTER
2. Click on Remote Tab
3. Enable “Allow connections only from computers running Remote Desktop
with Network Level Authentication”
Instruction
4. Click "Select Remote Users."
Page 12 of 23
secpol.msc and press ENTER
6. Under Local Policies - User Rights Assignment, "Allow logon through

Terminal Services." And just next to it is "Administrators, Remote Desktop
Users."
Automated task no
Page 13 of 23
8 Hardening controls
Windows
Domain Ref. W2K8-HC-66 BIT 22.2.b
Server 2008
Target OS Versions Mapping SAEP-99 5.3.c
Action Disable Remote Assistance

R C
A I
Pre requisite
Dependencies W2K8-HC-67 : Do not allow Remote Desktop services

Instruction
3. Ensure this option is not enabled by unchecking “Allow Remote

Assistance”
Automated task
Page 14 of 23
Windows 22.2.b
Domain Ref. W2K8-HC-67 BIT
Server 2008
Target Windows Server 2008 Mapping SAEP-99 5.3.c
Action Do not allow Remote Desktop services (RDP)

R C
A I
Pre requisite Hardening RDP protocol if enabled. Other skip.
W2K8-HC-66: Disable Remote Assistance

Dependencies W2K8-AP-14: Rename administrator account
W2K8-HC-69: Change default Terminal Server TCP port 3389
Instruction
6. Be sure to check the checkbox “Don’t allow connections to this computer”.
Automated task
Page 15 of 23
Windows
Domain Ref. W2K8-HC-68 BIT 16.3
Server 2008
Target Windows Server 2008 Mapping SAEP-99 5.3
Disable user access to Anti-Virus
Action
Management Settings
R C
A I
Pre requisite
Dependencies
1. Click Start, Programs, McAfee, VirusScan Console.
2. Double-click Access Protection.
3. Check “Prevent McAfee Services from being stopped” if not enabled
4. Click Apply and OK.
Instruction
Automated task
Page 16 of 23
Windows
Domain Ref. W2K8-HC-69 BIT
Server 2008
Target Mapping SAEP-99
Change default Terminal Server TCP port
Action
3389
R C
A I
Applied to only Windows Server 2008
Pre requisite Computer should be restarted to reflect the changes
Client Side should be modified to connect to the new TCP port
Dependencies
Regedt32.exe and press ENTER
2. Go to this key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal
Server\WinStations\RDP-Tcp
Instruction
3. Find the "PortNumber" subkey and notice the value of 00000D3D, hex for (3389).
Modify the port number in Hex and save the new value as
a. 0000344D which stands for 13389
Page 17 of 23
Automated task no
Page 18 of 23
Windows
Domain Ref. W2K8-HC-72 BIT 8.3
Server 2008
Target OS Versions Mapping SAEP-99 n/a
Action Configure the Host Name

R C
A I
Pre requisite Naming convention procedure should exists. Router/Switch should reflect the type and role.
Dependencies
2. Click on Computer Name
Instruction
3. Select Change to provide a new name
Page 19 of 23
Proposal
- Geo location: 3 characters referring to City or Plant (URT, ABQ, DHR ...)
- Admin Area : 3 characters referring to whether it is an Oil or Gas plant
- Device role : 2 or 3 characters indicating the device role
o PLC, DCS..
o WRK stands for workstation
o SRV stands for server
o PRT stands for printer
o FW for Firewall , RT for Router and so on
- Incremental ID : 3 variables
Ex : ABQ-WKS-005 : means Workstation 5 in Abqaiq plant
Automated task
Page 20 of 23
9 Logs and Auditing
Windows
Domain Ref. W2K8-LA-12 BIT 18.0.a
Server 2008
Target Windows Server 2008 Mapping SAEP-99 5.5.1.d.iv
Set maximum log size for Application,
Action
security and system events
R C
A I
Pre requisite
Dependencies W2K8-RP-53 : Restrict access to logs files
gpedit.msc and press ENTER
2. Browse to Local Computer Policy/Computer Configuration/Administrative

Templates/Windows Components/Event Log Service.
Instruction
3. Select Application folder and set the recommended logs size values as follow:
Page 21 of 23
 Specify the Application maximum log file size (KB) to 16384 kilobytes
4. Select Security folder and set the recommended logs size values as follow:
 Specify the Security maximum log file size (KB) to 81920 kilobyte
5. Select System folder and set the recommended logs size values as follow:
 Specify the System maximum log file size (KB) to 16384 kilobytes
The maximum event log could not exceed 4GB

Automated task N/A
Windows 18.0.a
Domain Ref. W2K8-LA-13 BIT
Server 2008
Target Windows Server 2008 Mapping SAEP-99 5.5.1.d.iv
Set Log Retention for Application, Security
Action
and System
R C
A I
Pre requisite
Dependencies W2K8-LA-12: Application/Security/System Logs: Maximum Event Log Size

eventvwr.msc and press ENTER to open de Event Viewer.
Instruction 2. Browse to the left panel, click on Windows Logs then Application, now right click
on Application and select Properties.
3. Check the options

• Do not overwrite events
Page 22 of 23
During Monthly audit log reviews, move archived event logs stored at the log path
shown above to external storage to maintain a one year archive
• Repeat this procedure for the following event logs:
1. All PAS workstations and servers
1. System logs
2. Application logs
3. Security logs
2. Windows AD server or Domain Controllers:
1. Directory Services.
Automated task N/A
Revision Summary
7 May 2015 New Saudi Aramco Best Practice.
Page 23 of 23

Sabp Z 063

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sabp Z 063

Uploaded by

Copyright:

Available Formats

Best Practice

SABP-Z-063 7 May 2015

Saudi Aramco DeskTop Standards

Previous Issue: New Next Planned Update: 7 May 2020

Copyright©Saudi Aramco 2015. All rights reserved.

2 Conflicts with Mandatory Standards

 Saudi Aramco References

Process Automation Systems (PAS): PAS include Networks and Systems

5 Account & passwords Policies

2. Click on “Security Settings” then “Account Policies” then “Password

• Enforce password history is set to 3 passwords remembered.

Action Set account Lockout duration and threshold

State Final Version 1.0 Created on 10/29/13

Action Rename Administrator Account

State Final Version 1.0 Created on 10/29/13

1. Press Windows button + R to bring up the run command window and

3. In the right pane, right-click Administrator then select Rename

Automated task yes

Action Change SNMP default credentials

State Final Version 1.0 Created on 10/29/13

Instruction 4. Click the Traps tab.

6 Services and applications settings

Automated task yes

7 Rights and Permission Policies

Dependencies W2K8-HC-70 : Set client connection 128-bit encryption level

4. Click "Select Remote Users."

6. Under Local Policies - User Rights Assignment, "Allow logon through

Action Disable Remote Assistance

State Final Version 1.0 Created on 10/29/13

Dependencies W2K8-HC-67 : Do not allow Remote Desktop services

3. Ensure this option is not enabled by unchecking “Allow Remote

Action Do not allow Remote Desktop services (RDP)

State Final Version 1.0 Created on 10/29/13

W2K8-HC-66: Disable Remote Assistance

6. Be sure to check the checkbox “Don’t allow connections to this computer”.

a. 0000344D which stands for 13389

Action Configure the Host Name

State Final Version 1.0 Created on 10/29/13

2. Click on Computer Name

3. Select Change to provide a new name

9 Logs and Auditing

Dependencies W2K8-RP-53 : Restrict access to logs files

2. Browse to Local Computer Policy/Computer Configuration/Administrative

The maximum event log could not exceed 4GB

Dependencies W2K8-LA-12: Application/Security/System Logs: Maximum Event Log Size

3. Check the options

Automated task N/A

You might also like