Ensure NULL Cipher Suites is Disabled

TinggiLevel 1Otomatisiis

Deskripsi

The NULL cipher does not provide data confidentiality or integrity, therefore it is recommended that the NULL cipher be disabled. SCHANNEL\Ciphers\NULL must exist with Enabled=0 (read via the .NET registry API because the key names contain "/"). PowerShell 5.1; reads the registry (run elevated).

Cara pemeriksaan

Metode audit: Registry Windows

registry

$c = 'SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers'; function Get-Cipher($n) { $k = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("$c\$n"); $v = $null; if ($k) { $v = $k.GetValue('Enabled'); $k.Close() }; $v }; $bad = @('NULL' | Where-Object { $v = Get-Cipher $_; $null -eq $v -or [long]$v -ne 0 }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

([Microsoft.Win32.Registry]::LocalMachine.CreateSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL')).SetValue('Enabled', 0, 'DWord') for each listed cipher (PowerShell drive paths cannot contain '/'), then reboot.

Properti

Sistem operasi: Apa saja
Tag: iistls
Referensi: CIS Microsoft IIS 10 Benchmark v1.2.1 - 7.7 Ensure NULL Cipher Suites is Disabled

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target iis