V-259367

Discussion

The cornerstone of the PKI is the private key used to encrypt or digitally sign information. If the private key is stolen, it will lead to the compromise of the authentication and nonrepudiation gained through PKI because the attacker can use the private key to digitally sign documents and pretend to be the authorized user. Both the holders of a digital certificate and the issuing authority must protect the computers, storage devices, or whatever they use to keep the private keys. SIG(0) is used for server-to-server authentication for DNS transactions, and it uses PKI-based authentication. In cases where SIG(0) is being used instead of TSIG (which uses a shared key, not PKI-based authentication), this requirement is applicable. Satisfies: SRG-APP-000176-DNS-000017, SRG-APP-000176-DNS-000019

Check Content

Note: This check is not applicable for Windows DNS Servers that host only Active Directory (AD)-integrated zones or for Windows DNS Servers on a classified network.

Navigate to the following location:

%ALLUSERSPROFILE%\Microsoft\Crypto\Keys

Note: If the folder above does not exist, this is not applicable.

Verify the permissions on the folder, subfolders, and files are limited to SYSTEM and Administrators FULL CONTROL.

In File Explorer:

For each folder, subfolder, and file, view the Properties.

Select the "Security" tab and then click "Advanced".

Default permissions:
C:\ProgramData\Microsoft\Crypto\Keys
Type - "Allow" for all
Inherited from - "None" for all

Principal - Access - Applies to

SYSTEM - Full control - This folder, subfolders and files
Administrators - Full control - This folder, subfolders and files
Everyone - Read  - This folder, subfolders, and files

Alternately, use icacls:

Open a command prompt and enter "icacls" followed by the directory.

For each folder, subfolder, and file, view the Properties.

"icacls %ALLUSERSPROFILE%\Microsoft\Crypto\Keys"

C:\ProgramData\microsoft\crypto\keys
NT AUTHORITY\SYSTEM:(OI)(CI)(F)
BUILTIN\Administrators:(OI)(CI)(F)
Everyone:(OI)(CI)(R)
Successfully processed 1 files; Failed processing 0 files

If any other user or group has greater than READ privileges to the %ALLUSERSPROFILE%\Microsoft\Crypto\Keys folder, subfolders, and files, this is a finding.