Anyone have to implement a policy regarding signed scripts due to an internal or external audit?
Had an internal audit recently and one of the "observations" was this: A script is a program written by an end user to execute an application. It may be used for a variety of purposes, including logon scripts, administration and general automation. A script executed by privileged accounts creates security risks unless it is tightly controlled and protected from unauthorized changes or malicious coding. A signed script ensures the code was reviewed, approved and free from malicious coding. Audit noted that administrators can execute unsigned scripts from any workstation or server. Execution of a compromised script by an administrator increases the risk that unauthorized access or unauthorized changes on the network and data can occur With this as the "recommendation": Evaluate the feasibility of restricting administrators, administrative workstation and domain controllers from executing unsigned scripts. So I've been looking at the feasibility of actually doing something like this with combinations of Software Restriction Policies (certificate policies) and possibly AppLocker. Which look to be a nightmare to try and implement. The auditor has agreed to the following, which will be much less intrusive: All scripts created by Domain Admins for Domain admins, going forward would be signed Creating a policy document Creating documentation for the process Training the admins on the new process Obviously nothing is enforcing this, but it's a start. Just wondered if others have gone through something similar. Christopher Bodnar Enterprise Achitect I, Corporate Office of Technology Tel 610-807-6459 3900 Burgess Place, Bethlehem, PA 18017 [email protected] The Guardian Life Insurance Company of America www.guardianlife.com ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to [email protected] with the body: unsubscribe ntsysadmin
<<image/jpeg>>
