TMA-IIS-7.7

Ensure NULL Cipher Suites is Disabled

VisokaNivo 1Automatskaiis

Opis

The NULL cipher does not provide data confidentiality or integrity, therefore it is recommended that the NULL cipher be disabled. SCHANNEL\Ciphers\NULL must exist with Enabled=0 (read via the .NET registry API because the key names contain "/"). PowerShell 5.1; reads the registry (run elevated).

Kako se proverava

Metod provere: Windows registar

registry

$c = 'SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers'; function Get-Cipher($n) { $k = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("$c\$n"); $v = $null; if ($k) { $v = $k.GetValue('Enabled'); $k.Close() }; $v }; $bad = @('NULL' | Where-Object { $v = Get-Cipher $_; $null -eq $v -or [long]$v -ne 0 }); if ($bad.Count -eq 0) { 'compliant' } else { 'noncompliant' }

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

([Microsoft.Win32.Registry]::LocalMachine.CreateSubKey('SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL')).SetValue('Enabled', 0, 'DWord') for each listed cipher (PowerShell drive paths cannot contain '/'), then reboot.

Svojstva

Operativni sistemi: Bilo koji
Oznake: iistls
Referenca: CIS Microsoft IIS 10 Benchmark v1.2.1 - 7.7 Ensure NULL Cipher Suites is Disabled

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target iis