Title

If several Windows PAWs are set up in virtual machines (VMs) on a host server, the host server must only contain PAW VMs. If the PAW is hosted, the hosting system must be separated either physically or logically from other servers. The server is restricted to only PAW hosting functions. (Cat II impact)

Discussion

A main security architectural construct of a PAW is to remove nonadministrative functions from the PAW. Many standard user functions, including email processing, internet browsing, and using business applications, can increase the security risk of the workstation. These apps and functions are susceptible to many security vulnerabilities, including phishing attacks and embedded malware. This increased risk is not acceptable for the highly privileged activities of a PAW. This requirement enforces this security concept in an environment where multiple PAW VMs are installed on a host server. Note: Relationship between the exception in WPAW-00-000500 and WPAW-00-001000 and requirement WPAW-00-001800: WPAW-00-000500 and WPAW-00-001000 allow an exception to the requirement for sites constrained in the number of available workstations. Lower-tier, high-value admin accounts can operate in a VM if the higher-tier, high-value admin accounts operate in the VM host-OS, but WPAW-00-001800 is more appropriate for a multiple PAW VM environment.

Check Content

Review the configuration of all host servers where PAW VMs are installed. Verify the only VMs installed on the host server are PAW VMs. If a host server where PAW VMs are installed contains non-PAW VMs, this is a finding.

Fix Text

Install only PAW VMs on a host server designated for PAWs.

Additional Identifiers

Rule ID: SV-243459r1107644_rule

Vulnerability ID: V-243459

Group Title: SRG-OS-000480-GPOS-00227

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.