Check: 3.014
Windows Vista STIG:
3.014
(in versions v6 r42 through v6 r41)
Title
The Windows dialog box title for the legal banner must be configured. (Cat III impact)
Discussion
Failure to display the logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.
Check Content
Analyze the system using the Security Configuration and Analysis snap-in. Expand the Security Configuration and Analysis tree view. Navigate to Local Policies -> Security Options. If the value for “Interactive Logon: Message title for users attempting to log on” is not set to “DoD Notice and Consent Banner”, “US Department of Defense Warning Statement”, or a site defined equivalent, this is a finding. If a site defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089. Automated tools may only search for the titles defined above. If a site defined title is used, a manual review will be required. The policy referenced configures the following registry value: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \Software\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: LegalNoticeCaption Value Type: REG_SZ Value: See message title above
Fix Text
Configure the policy value for Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options “Interactive Logon: Message title for users attempting to log on” to “DoD Notice and Consent Banner”, “US Department of Defense Warning Statement”, or a site defined equivalent. If a site defined title is used, it can in no case contravene or modify the language of the banner text required in V-1089.
Additional Identifiers
Rule ID: SV-34590r2_rule
Vulnerability ID: V-26359
Group Title: Legal Banner Dialog Box Title
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000048 |
The information system displays an organization-defined system use notification message or banner before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. |
| CCI-001384 |
The information system, for publicly accessible systems, displays system use information organization-defined conditions before granting further access. |
| CCI-001385 |
The information system, for publicly accessible systems, displays references, if any, to monitoring that are consistent with privacy accommodations for such systems that generally prohibit those activities. |
| CCI-001386 |
The information system, for publicly accessible systems, displays references, if any, to recording that are consistent with privacy accommodations for such systems that generally prohibit those activities. |
| CCI-001387 |
The information system, for publicly accessible systems, displays references, if any, to auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities. |
| CCI-001388 |
The information system, for publicly accessible systems, includes a description of the authorized uses of the system. |
Controls
| Number | Title |
|---|---|
| AC-8 |
System Use Notification |