EPoS_Attach_6_Windows_10_STIG_Version_1_Release_9_April_2017.htm

HTM file 1 MB Posted Oct 11, 2017

Attached to: Electronic Point of Sale (EPoS) and Supporting Services
Solicitation number: SP4703-17-R-CB01
Issued by: Defense Logistics Agency Aviation

About this file

Written by GovTribe AI · Dec 30, 2023

This is a Request for Proposal (RFP) for an Indefinite-Delivery/Indefinite-Quantity (IDIQ) contract to provide a turn-key hardware and software solution for capturing military fleet management fuel retail transactions at unattended military service stations, mobile ground fuel transactions, and aviation fuel transactions for mobile airfield/flight line operations. The proposed ordering period includes a five-year base period plus ten (10) one-year option periods for a total of fifteen (15) years. The contractor is to deliver and install devices and sustain the hardware and software solution. The North American Industry Classification System (NAICS) Code 541519 other computer related services (small business size $27.5 million) applies to this acquisition. The Defense Logistics Agency Aviation is the federal agency issuing this RFP.

From the source

Attachment 6

Text of this file

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML xmlns:cdf="http://checklists.nist.gov/xccdf/1.1" xmlns:dc="http://purl.org/dc/elements/1.1/"><HEAD><META content="IE=5.0000" http-equiv="X-UA-Compatible">

UNCLASSIFIED

</TITLE>

<BODY>

UNCLASSIFIED

<IMG width="1100" height="330" align="center" src="Windows%2010%20STIG%20Version%201%20Release%209%20April%202017_files/DoD-DISA-logos-as-JPEG.jpg">   Windows 10 Security Technical Implementation Guide Version: 1 Release: 9 28 Apr 2017 XSL Release 1/29/2015     Sort by:   STIGID Description: The Windows 10 Security Technical Implementation Guide (STIG) is published as a tool to improve the security of Department of Defense (DoD) information systems.

Comments or proposed revisions to this document should be sent via e-mail to the following address: disa.stig_spt@mail.mil.

_____________________________________________________________

Group ID (Vulid):  V-63319 Group Title:  WN10-00-000005 Rule ID:  SV-77809r2_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000005 Rule Title: Domain-joined systems must use Windows 10 Enterprise Edition. Vulnerability Discussion:  Features such as Credential Guard use virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise. Check Content:  Verify domain-joined systems are using Windows 10 Enterprise Edition. For standalone systems, this is NA. Verify the version of Windows 10 is Enterprise. Run "System Information". Under "System Summary", verify "OS Name" = Microsoft Windows 10 Enterprise. If another version of Windows 10 is reported, this is a finding. Fix Text: Use Windows 10 Enterprise for domain-joined systems.   CCI: CCI-000366

_____________________________________________________________

Group ID (Vulid):  V-63323 Group Title:  WN10-00-000010 Rule ID:  SV-77813r4_rule Severity: CAT III Rule Version (STIG-ID):  WN10-00-000010 Rule Title: Domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use. Vulnerability Discussion:  Credential Guard uses virtualization based security to protect information that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software. Check Content:  Verify domain-joined systems have a TPM enabled and ready for use. For standalone systems, this is NA. Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop. For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. Verify the system has a TPM and is ready for use. Run "tpm.msc". Review the sections in the center pane. "Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken". TPM Manufacturer Information - Specific Version = 2.0 or 1.2 If a TPM is not found or is not ready for use, this is a finding. Fix Text: For standalone systems, this is NA. Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop. For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. Ensure domain-joined systems must have a Trusted Platform Module (TPM) that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.) The TPM must be enabled in the firmware. Run "tpm.msc" for configuration options in Windows.

CCI: CCI-000366

_____________________________________________________________

Group ID (Vulid):  V-63343 Group Title:  WN10-00-000025 Rule ID:  SV-77833r1_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000025 Rule Title: The operating system must employ automated mechanisms to determine the state of system components with regard to flaw remediation using the following frequency:

continuously, where HBSS is used; 30 days, for any additional internal network scans not covered by HBSS; and annually, for external scans by Computer Network Defense Service Provider (CNDSP). Vulnerability Discussion:  An approved tool for continuous network scanning must be installed and configured to run. Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. To support this requirement, the operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools, as specified in the requirement. Check Content:

Determine if an approved tool capable of continuous scanning is loaded on the system. The recommended system is the McAfee HBSS. If no such tool is installed on the system, this is a finding. Fix Text: Install an approved HBSS solution onto the system.   CCI: CCI-001233

_____________________________________________________________

Group ID (Vulid):  V-63337 Group Title:  WN10-00-000030 Rule ID:  SV-77827r1_rule Severity: CAT I Rule Version (STIG-ID):  WN10-00-000030 Rule Title: Mobile systems must encrypt all disks to protect the confidentiality and integrity of all information at rest. Vulnerability Discussion:  If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running. Check Content:

Verify mobile systems employ DoD-approved full disk encryption. If full disk encryption is not implemented, this is a finding. If BitLocker is used, verify it is turned on for the operating system drive and any fixed data drives. Open "BitLocker Drive Encryption" from the Control Panel. If the operating system drive or any fixed data drives have "Turn on BitLocker", this is a finding. Fix Text: Install an approved DoD encryption package and enable full disk encryption on mobile systems. BitLocker can be enabled in "BitLocker Drive Encryption" in the Control Panel.   CCI: CCI-001199 CCI: CCI-002475 CCI: CCI-002476

_____________________________________________________________

Group ID (Vulid):  V-63345 Group Title:  WN10-00-000035 Rule ID:  SV-77835r2_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000035 Rule Title: The operating system must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. Vulnerability Discussion:  Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting. Check Content:  This is applicable to unclassified systems, for other systems this is NA. Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems. If an application whitelisting program is not in use on the system, this is a finding. Configuration of whitelisting applications will vary by the program. AppLocker is a whitelisting application built into Windows 10 Enterprise. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. If AppLocker is used, perform the following to view the configuration of AppLocker: Run "PowerShell". Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" under the Microsoft Windows section of the following link: https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml Fix Text: This is applicable to unclassified systems, for other systems this is NA. Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. Configuration of whitelisting applications will vary by the program. AppLocker is a whitelisting application built into Windows 10 Enterprise. If AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >>

Security Settings >> Application Control Policies >>

AppLocker. Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" under the Microsoft Windows section of the following link: https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml   CCI: CCI-001774

_____________________________________________________________

Group ID (Vulid):  V-63349 Group Title:  WN10-00-000040 Rule ID:  SV-77839r3_rule Severity: CAT I Rule Version (STIG-ID):  WN10-00-000040 Rule Title: Systems must be maintained at a supported servicing level. Vulnerability Discussion:  Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation. Windows 10 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. The Current Branch (CB) is the only option for consumer versions and will be maintained for approximately 4 months before a new CB is declared. Only the current CB is serviced with updates. Professional and Enterprise versions may select the Current Branch for Business (CBB) which is declared at the end of a Current Branch period and will be maintained for approximately 8 additional months. There will only be 2 CBBs active at any given time which will be serviced with updates. A separate servicing branch intended for special purpose systems is the Long-Term Servicing Branch (LTSB) which will receive security updates for 10 years but excludes feature updates. Systems using an LTSB version may not be able to meet all requirements of the STIG as new features are added, which organizations will need to address. Check Content:  Run "winver.exe". If the "About Windows" dialog box does not display: "Microsoft Windows Version 1511 (OS Build 10586.0)" or greater, this is a finding. No preview versions will be used in a production environment. Special purpose systems using the Long-Term Servicing Branch (LTSB) must be at "Version 10.0 (OS Build 10240)" or greater. If LTSB versions are not at Build 10240 or greater, this is a finding. Fix Text: Update systems on the Current Branch (CB) or Current Branch for Business (CBB) to "Microsoft Windows Version 1511 (OS Build 10586.0)" or greater. Special purpose systems using the Long-Term Servicing Branch (LTSB) must be at Version 10.0 (OS Build 10240)" or greater.   CCI: CCI-000366

_____________________________________________________________

Group ID (Vulid):  V-63351 Group Title:  WN10-00-000045 Rule ID:  SV-77841r3_rule Severity: CAT I Rule Version (STIG-ID):  WN10-00-000045 Rule Title: A supported DoD antivirus program must be installed and used. Vulnerability Discussion:  Virus scan programs are a primary line of defense against the introduction of viruses and malicious code that can destroy data and even render a computer inoperable. Using a virus scan program provides the ability to detect malicious code before extensive damage occurs. Check Content:

Verify a supported DoD antivirus product has been installed on the system. If McAfee VirusScan Enterprise 8.8 Patch 6 or later is not installed on the system, this is a finding. If another recognized antivirus product is installed, this would still be a finding; however, the severity may be reduced to a CAT III. Fix Text: Install McAfee VirusScan Enterprise 8.8 Patch 6 or later on the system.   CCI: CCI-000366

_____________________________________________________________

Group ID (Vulid):  V-73811 Group Title:  WN10-00-000046 Rule ID:  SV-88485r1_rule Severity: CAT I Rule Version (STIG-ID):  WN10-00-000046 Rule Title: The antivirus program must be configured to update signature files on a daily basis. Vulnerability Discussion:  Virus scan programs are a primary line of defense against the introduction of viruses and malicious code that can destroy data and even render a computer inoperable. Using a virus scan program provides the ability to detect malicious code before extensive damage occurs.

Updated virus scan data files help protect a system, as constantly changing malware is identified by the antivirus software vendors. Check Content:  This requirement is NA if McAfee VirusScan Enterprise (VSE) is used. It will be addressed with the corresponding McAfee VSE STIG. Configurations will vary depending on the product. Review the antivirus program signature update configuration. If the antivirus program is not configured to update the signature files on a daily basis, this is a finding. It may not be possible for systems to receive updates on a daily basis due to various factors.

If the signature file is more than a week old, this is a finding. Fix Text: Configure the antivirus program to update signature files at least daily. Ensure the updates are occurring on timely basis and are not more than a week old.

CCI: CCI-000366

_____________________________________________________________

Group ID (Vulid):  V-63353 Group Title:  WN10-00-000050 Rule ID:  SV-77843r2_rule Severity: CAT I Rule Version (STIG-ID):  WN10-00-000050 Rule Title: Local volumes must be formatted using NTFS. Vulnerability Discussion:  The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, volumes must be formatted using the NTFS file system. Check Content:  Run "Computer Management". Navigate to Storage >> Disk Management. If the "File System" column does not indicate "NTFS" for each volume assigned a drive letter, this is a finding. This does not apply to system partitions such the Recovery and EFI System Partition. Fix Text: Format all local volumes to use NTFS.

CCI: CCI-000213

_____________________________________________________________

Group ID (Vulid):  V-63355 Group Title:  WN10-00-000055 Rule ID:  SV-77845r1_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000055 Rule Title: Alternate operating systems must not be permitted on the same system. Vulnerability Discussion:  Allowing other operating systems to run on a secure system may allow security to be circumvented. Check Content:

Verify the system does not include other operating system installations. Run "Advanced System Settings". Select the "Advanced" tab. Click the "Settings" button in the "Startup and Recovery" section. If the drop-down list box "Default operating system:" shows any operating system other than Windows 10, this is a finding. Fix Text: Ensure Windows 10 is the only operating system on a device. Remove alternate operating systems.   CCI: CCI-000366

_____________________________________________________________

Group ID (Vulid):  V-63357 Group Title:  WN10-00-000060 Rule ID:  SV-77847r1_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000060 Rule Title: Non system-created file shares on a system must limit access to groups that require it. Vulnerability Discussion:  Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information. If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it. Check Content:  Non system-created shares should not typically exist on workstations. If only system-created shares exist on the system this is NA. Run "Computer Management". Navigate to System Tools >> Shared Folders >>

Shares. If the only shares listed are "ADMIN$", "C$" and "IPC$", this is NA. (Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.) Right click any non-system-created shares. Select "Properties". Select the "Share Permissions" tab. Verify the necessity of any shares found. If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding. Select the "Security" tab. If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding. Fix Text: If a non system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it. Remove any unnecessary non-system created shares.

CCI: CCI-001090

_____________________________________________________________

Group ID (Vulid):  V-63359 Group Title:  WN10-00-000065 Rule ID:  SV-77849r1_rule Severity: CAT III Rule Version (STIG-ID):  WN10-00-000065 Rule Title: Unused accounts must be disabled or removed from the system after 35 days of inactivity. Vulnerability Discussion:  Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disable until needed. Check Content:  Run "PowerShell". Copy the lines below to the PowerShell window and enter. "([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { $user = ([ADSI]$_.Path) $lastLogin = $user.Properties.LastLogin.Value $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 if ($lastLogin -eq $null) { $lastLogin = 'Never' } Write-Host $user.Name $lastLogin $enabled }" This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). For example: User1 10/31/2015 5:49:56 AM True Review the list to determine the finding validity for each account reported. Exclude the following accounts: Built-in administrator account (Disabled, SID ending in 500) Built-in guest account (Disabled, SID ending in 501) Built-in DefaultAccount (Disabled, SID ending in 503) Local administrator account If any enabled accounts have not been logged on to within the past 35 days, this is a finding. Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO. Fix Text: Regularly review local accounts and verify their necessity. Disable or delete any active accounts that have not been used in the last 35 days.   CCI: CCI-000795

_____________________________________________________________

Group ID (Vulid):  V-63361 Group Title:  WN10-00-000070 Rule ID:  SV-77851r1_rule Severity: CAT I Rule Version (STIG-ID):  WN10-00-000070 Rule Title: Only accounts responsible for the administration of a system must have Administrator rights on the system. Vulnerability Discussion:  An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. System administrators must log on to systems only using accounts with the minimum level of authority necessary. For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG). Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks. Systems dedicated to the management of Active Directory (AD admin platforms, see V-36436 in the Active Directory Domain STIG) are exempt from this. AD admin platforms may use the Domain Admins group or a domain administrative group created specifically for AD admin platforms (see V-43711 in the Active Directory Domain STIG). Standard user accounts must not be members of the local administrators group. Check Content:  Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Review the members of the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group. Systems dedicated to the management of Active Directory (AD admin platforms, see V-36436 in the Active Directory Domain STIG) are exempt from this. AD admin platforms may use the Domain Admins group or a domain administrative group created specifically for AD admin platforms (see V-43711 in the Active Directory Domain STIG). Standard user accounts must not be members of the local administrator group. If prohibited accounts are members of the local administrators group, this is a finding. The built-in Administrator account or other required administrative accounts would not be a finding. Fix Text: Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group. For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group. Systems dedicated to the management of Active Directory (AD admin platforms, see V-36436 in the Active Directory Domain STIG) are exempt from this. AD admin platforms may use the Domain Admins group or a domain administrative group created specifically for AD admin platforms (see V-43711 in the Active Directory Domain STIG). Remove any standard user accounts.   CCI: CCI-002235

_____________________________________________________________

Group ID (Vulid):  V-63363 Group Title:  WN10-00-000075 Rule ID:  SV-77853r1_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000075 Rule Title: Only accounts responsible for the backup operations must be members of the Backup Operators group. Vulnerability Discussion:  Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it.

Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes.

Members of the Backup Operators group must have separate logon accounts for performing backup duties. Check Content:  Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Review the members of the Backup Operators group. If the group contains no accounts, this is not a finding. If the group contains any accounts, the accounts must be specifically for backup functions. If the group contains any standard user accounts used for performing normal user tasks, this is a finding. Fix Text: Create separate accounts for backup operations for users with this privilege.

CCI: CCI-000366

_____________________________________________________________

Group ID (Vulid):  V-63365 Group Title:  WN10-00-000080 Rule ID:  SV-77855r1_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000080 Rule Title: Users must not be allowed to run virtual machines in Hyper-V on the system. Vulnerability Discussion:  Allowing other operating systems to run on a secure system may allow users to circumvent security. Hyper-V is used by the Credential Guard feature on Windows 10. Preventing users from being assigned to the Hyper-V Administrators group will prevent them from accessing or creating virtual machines on the system. Check Content:  Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Double click on "Hyper-V Administrators". If any groups or user accounts are listed in "Members:", this is a finding. Fix Text: Remove any groups or users from the "Hyper-V Administrators" group.   CCI: CCI-000381

_____________________________________________________________

Group ID (Vulid):  V-63367 Group Title:  WN10-00-000085 Rule ID:  SV-77857r1_rule Severity: CAT III Rule Version (STIG-ID):  WN10-00-000085 Rule Title: Standard local user accounts must not exist on a system in a domain. Vulnerability Discussion:  To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain. Users must log onto workstations in a domain with their domain accounts. Check Content:  Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. If local users other than the accounts listed below exist on a workstation in a domain, this is a finding. Built-in Administrator account (Disabled) Built-in Guest account (Disabled) Built-in Default Account (Disabled) Local administrator account(s) Fix Text: Limit local user accounts on domain-joined systems. Remove any unauthorized local accounts.   CCI: CCI-000366

_____________________________________________________________

Group ID (Vulid):  V-63371 Group Title:  WN10-00-000090 Rule ID:  SV-77861r1_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000090 Rule Title: Accounts must be configured to require password expiration. Vulnerability Discussion:  Passwords that do not expire increase exposure with a greater probability of being discovered or cracked. Check Content:  Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. Double click each active account. If "Password never expires" is selected for any account, this is a finding. Fix Text: Configure all passwords to expire. Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. Double click each active account. Ensure "Password never expires" is not checked on all active accounts.   CCI: CCI-000199

_____________________________________________________________

Group ID (Vulid):  V-63373 Group Title:  WN10-00-000095 Rule ID:  SV-77863r1_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000095 Rule Title: Permissions for system files and directories must conform to minimum requirements. Vulnerability Discussion:  Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications. Check Content:

The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160). If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding. Verify the default permissions for the sample directories below.

Non-privileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults.

(Individual accounts must not be used to assign permissions.) Viewing in File Explorer: Select the "Security" tab, and the "Advanced" button. C:\ Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to Administrators - Full control - This folder, subfolders and files SYSTEM - Full control - This folder, subfolders and files Users - Read & execute - This folder, subfolders and files Authenticated Users - Modify - Subfolders and files only Authenticated Users - Create folders / append data - This folder only \Program Files Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to TrustedInstaller - Full control - This folder and subfolders SYSTEM - Modify - This folder only SYSTEM - Full control - Subfolders and files only Administrators - Modify - This folder only Administrators - Full control - Subfolders and files only Users - Read & execute - This folder, subfolders and files CREATOR OWNER - Full control - Subfolders and files only ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files \Windows Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to TrustedInstaller - Full control - This folder and subfolders SYSTEM - Modify - This folder only SYSTEM - Full control - Subfolders and files only Administrators - Modify - This folder only Administrators - Full control - Subfolders and files only Users - Read & execute - This folder, subfolders and files CREATOR OWNER - Full control - Subfolders and files only ALL APPLICATION PACKAGES - Read &

execute - This folder, subfolders and files Alternately use icacls. Run "CMD" as administrator. Enter "icacls" followed by the directory. icacls c:\ icacls "c:\program files" icacls c:\windows The following results will be displayed as each is entered: c:\ BUILTIN\Administrators:(OI)(CI)(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Users:(OI)(CI)(RX) NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M) NT AUTHORITY\Authenticated Users:(AD) Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW) Successfully processed 1 files; Failed processing 0 files c:\program files NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR

OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION

PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION

PACKAGES:(OI)(CI)(IO)(GR,GE) Successfully processed 1 files; Failed processing 0 files c:\windows NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR

OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION

PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION

PACKAGES:(OI)(CI)(IO)(GR,GE) Successfully processed 1 files; Failed processing 0 files Fix Text: Maintain the default file system permissions and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (WN10-SO-000160).   CCI: CCI-002165

_____________________________________________________________

Group ID (Vulid):  V-63377 Group Title:  WN10-00-000100 Rule ID:  SV-77867r1_rule Severity: CAT I Rule Version (STIG-ID):  WN10-00-000100 Rule Title: Internet Information System (IIS) or its subcomponents must not be installed on a workstation. Vulnerability Discussion:  Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted. Websites must only be hosted on servers that have been designed for that purpose and can be adequately secured. Check Content:  IIS is not installed by default. Verify it has not been installed on the system. Run "Programs and Features". Select "Turn Windows features on or off". If the entries for "Internet Information Services" or "Internet Information Services Hostable Web Core" are selected, this is a finding. If an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO. In addition, any applicable requirements from the IIS STIG must be addressed. Fix Text: Uninstall "Internet Information Services" or "Internet Information Services Hostable Web Core" from the system.   CCI: CCI-000381

_____________________________________________________________

Group ID (Vulid):  V-63381 Group Title:  WN10-00-000105 Rule ID:  SV-77871r1_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000105 Rule Title: Simple Network Management Protocol (SNMP) must not be installed on the system. Vulnerability Discussion:  Some protocols and services do not support required security features, such as encrypting passwords or traffic. Check Content:

"SNMP" is not installed by default. Verify it has not been installed. Navigate to the Windows\System32 directory. If the "SNMP" application exists, this is a finding. Fix Text: Uninstall "Simple Network Management Protocol (SNMP)" from the system. Run "Programs and Features". Select "Turn Windows Features on or off". De-select "Simple Network Management Protocol (SNMP)".   CCI: CCI-000382

_____________________________________________________________

Group ID (Vulid):  V-63383 Group Title:  WN10-00-000110 Rule ID:  SV-77873r1_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000110 Rule Title: Simple TCP/IP Services must not be installed on the system. Vulnerability Discussion:  Some protocols and services do not support required security features, such as encrypting passwords or traffic. Check Content:  "Simple TCP/IP Services" is not installed by default.

Verify it has not been installed. Run "Services.msc". If "Simple TCP/IP Services" is listed, this is a finding. Fix Text: Uninstall "Simple TCPIP Services (i.e. echo, daytime etc)" from the system. Run "Programs and Features". Select "Turn Windows Features on or off". De-select "Simple TCPIP Services (i.e.

echo, daytime etc)".   CCI: CCI-000381

_____________________________________________________________

Group ID (Vulid):  V-63385 Group Title:  WN10-00-000115 Rule ID:  SV-77875r1_rule Severity: CAT II Rule Version (STIG-ID):  WN10-00-000115 Rule Title: The Telnet Client must not be installed on the system. Vulnerability Discussion:  Some protocols and services do not support required security features, such as encrypting passwords or traffic. Check Content:  The "Telnet Client" is not installed by default.

This is the start of the file's text. The full file is on GovTribe.

Other files

File	Type	Posted
Epos_Amend_0005.zip	ZIP file	Dec 20, 2017
Epos_Q&A__4.zip	ZIP file	Dec 20, 2017
15 EPoS Attach 15 Group 2 Task Order 3 Fixed Installation_Sustainment PWS 20171113 CC.docx	DOCX document	Dec 18, 2017
8 EPoS Attach 8 Solution Demonstration 20171213 CC.docx	DOCX document	Dec 18, 2017
12 EPoS Attach 12 Group 1 Task Order 1 Active Directory PWS 20171113 CC.docx	DOCX document	Dec 18, 2017
13 EPoS Attach 13 Group 2 Task Order 1 Fixed Software Development PWS 20171113 CC.docx	DOCX document	Dec 18, 2017
EPoS Attach 19 Pricing Sheet for Group 3 Mobile Devices 20171113 CC.xlsx	XLSX spreadsheet	Dec 18, 2017
SP470317RCB01 Amend 0004.pdf	PDF	Dec 18, 2017
2 EPoS Attach 2 Evaluation Factors for Award 20171207 CC.DOCX	DOCX document	Dec 18, 2017
16 EPoS Attach 16 Group 3 Task Order 1 Mobile Device Integration PWS 20171201 CC.docx	DOCX document	Dec 18, 2017
14 EPoS Attach 14 Group 2 Task Order 2 Fixed Software Sustainment PWS 20171113 CC.docx	DOCX document	Dec 18, 2017
Attachment 20 - Location and Pump Details Sorted.xlsm	XLSM spreadsheet	Dec 18, 2017
3 EPoS Attach 3 IDIQ Performance Work Statement 20171213 CC.docx	DOCX document	Dec 18, 2017
EPoS Attach 17 Pricing Sheet for Group 1 Active Directory Services 20171113 CC.xlsx	XLSX spreadsheet	Dec 18, 2017
1 EPoS Attach 1 Instructions to Offerors 20171207 CC.DOCX	DOCX document	Dec 18, 2017
9 EPoS Attach 9 Cybersecurity Demonstration 20171201 CC.docx	DOCX document	Dec 18, 2017
EPoS Attach 18 Pricing Sheet for Group 2 Fixed Facility Devices 20171113 CC.xlsx	XLSX spreadsheet	Dec 18, 2017
EPoS Attach 4 List of Fixed Device Locations Oct 2017 Revised 20171113 CC.xlsx	XLSX spreadsheet	Dec 18, 2017
Epos_Q&A__3.zip	ZIP file	Dec 14, 2017
SP470317RCB01_Amend_0003.pdf	PDF	Dec 6, 2017
Epos_Q&A__2.zip	ZIP file	Dec 4, 2017
SP470317RCB01_Amend_0002.pdf	PDF	Nov 16, 2017
SP470317RCB01_Amend_0001.pdf	PDF	Nov 3, 2017
EPoS_Attach_13_Group_2_Task_Order_1_Fixed_Software_Development_PWS_20170820.docx	DOCX document	Oct 11, 2017
EPoS_Attach_10_Key_Personnel_Resume_Template_20170803.docx	DOCX document	Oct 11, 2017
EPoS_Attach_15_Group_2_Task_Order_3_Fixed_Installation_Sustainment_PWS_20170820.docx	DOCX document	Oct 11, 2017
EPoS_Attach_19_Pricing_Sheet_for_Group_3_Mobile_Devices_20170823.xlsx	XLSX spreadsheet	Oct 11, 2017
EPoS_Attach_14_Group_2_Task_Order_2_Fixed_Software_Sustainment_PWS_20170820.docx	DOCX document	Oct 11, 2017
EPoS_Attach_18_Pricing_Sheet_for_Group_2_Fixed_Facility_Devices_20170822.xlsx	XLSX spreadsheet	Oct 11, 2017
EPoS_Solicitation_SF1449_20171011.docx	DOCX document	Oct 11, 2017
EPoS_Attach_12_Group_1_Task_Order_1_Active_Directory_PWS_20170820.docx	DOCX document	Oct 11, 2017
EPoS_Attach_17_Pricing_Sheet_for_Group_1_Active_Directory_Services_20170822.xlsx	XLSX spreadsheet	Oct 11, 2017
EPoS_Attach_3_IDIQ_Performance_Work_Statement_20170913.docx	DOCX document	Oct 11, 2017
EPoS_Attach_4_List_of_Fixed_Device_Locations_Sept_2017.xlsx	XLSX spreadsheet	Oct 11, 2017
EPoS_Attach_16_Group_3_Task_Order_1_Mobile_Device_Integration_PWS_20170820.docx	DOCX document	Oct 11, 2017
EPoS_Attach_2_Evaluation_Factors_for_Award_20170821.docx	DOCX document	Oct 11, 2017
EPoS_Attach_11_Past_Performance_Questionnaire_20170622.docx	DOCX document	Oct 11, 2017
EPoS_Attach_1_Instructions_to_Offerors_20171011.docx	DOCX document	Oct 11, 2017
EPoS_Attach_7_Employee_Confidentiality_Non-Disclosure_of_Non-Public_Information.docx	DOCX document	Oct 11, 2017
EPoS_Attach_9_Cybersecurity_Demonstration_20170819.docx	DOCX document	Oct 11, 2017
EPoS_Attach_5_ASDS_STIG_Version_4_Release_3_April_2017.htm	HTM file	Oct 11, 2017
EPoS_Attach_8_Solution_Demonstration_201708131.docx	DOCX document	Oct 11, 2017

Show all 42

On GovTribe

Work with this file

Download the original file
Contacts named in this file
Similar government files
Ask GovTribe AI about this file

Try for free Login

File details come from the government source that posted it. Updated Nov 14, 2017.