Subcontrol 4.6

[adammontville]

Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring administrative access. This machine will be segmented from the organization's primary network and not be allowed Internet access. This machine will not be used for reading email, composing documents, or browsing the Internet.

Measures

M1 = # of total administrative account
M2 = # of administrative account login in machine reachable from outside(not in private network of organization)

Metrics

Enforcement Quality = (M1 - M2) / M1

[apiperCIS]

For Controls team:

1. If the machine is segmented from the organization's primary network, how can that machine be used to administer the machines on that network?

2. UNCC objected to the "composing documents" part. We pointed out the possibility of malicious documents from removable media.

[apiperCIS]

UNCC is proposing testing the level of isolation of the dedicated admin machine using a tool such as ConfigChecker.

[apiperCIS]

Coordinate this with 11.6 (IG2) which is very similar

[adammontville]

Inputs:

• EI: Endpoint inventory
• SI: Software inventory

Operations:

• Enumerate the devices used for administrative purposes based on the endpoint inventory
• Enumerate all software identified as administrative from the software inventory
• For each identified device:
  • Enumerate the devices configured/managed by this device
  • Examine its configuration noting whether it is appropriately or inappropriately configured:
  • The device has internet access
  • The device can run unauthorized software
  • The device can be reached by any device not in the enumeration identified above

Measures:

• M1 = List of devices used for administrative purposes
• M2 = List of administrative software
• M3 = List of appropriately configured devices
• M4 = List of inappropriately configured devices
• M5 = |M1|
• M6 = |M2|
• M7 = |M3|
• M8 = |M4|

Metrics:

• M7 / M5 = Ratio of appropriately configured administrative devices to the total number of administrative devices