Remove Enterprise Admins and Domain Admins from local Tactical Medium administrators group on CAs Eliminate or limit the number of service accounts with Tactical Medium administrative rights on CAs and RAs Enable application whitelisting using AppLocker or another Tactical High third party application Internal Use secure administrative hosts or jump hosts to perform Strategic High remote management tasks Internal Disable Remote Management Boards on physical servers Tactical High Internal Require PKI administrators to use cards for all Strategic High accounts that manage the PKI Internal Use a Hardware Security Module in offline CAs Strategic High Internal Keep offline CAs truly offline, allow only physical access to Tactical Medium all components Use only authorized, dedicated devices to transfer files Tactical Medium to/from offline CAs Update offline CAs with service security updates Tactical Medium specific to CA software, and updates related to system time (time zone changes) Update HSM software and firmware when released Tactical Medium Ensure that any activity performed on an offline CA can be Strategic Medium traced to an individual, either through individual accounts or additional auditing and surveillance When virtualizing offline CAs, decouple the guest files Tactical Medium from the physical hardware so the hardware can be easily replaced When virtualizing offline CAs, use a dedicated host Tactical Medium machine that is secured in a locked rack or safe. If
Remove Enterprise Admins and Domain Admins from local administrators group on CAs Tactical Medium Eliminate or limit the number of service accounts with administrative rights on CAs and RAs Tactical Medium Enable application whitelisting using AppLocker or another third party application Tactical High Internal Use secure administrative hosts or jump hosts to perform remote management tasks Strategic High Internal Disable Remote Management Boards on physical servers Tactical High Internal Require PKI administrators to use cards for all accounts that manage the PKI Strategic High Internal Use a Hardware Security Module in offline CAs Strategic High Internal Keep offline CAs truly offline, allow only physical access to all components Tactical Medium Use only authorized, dedicated devices to transfer files to/from offline CAs Tactical Medium Update offline CAs with service security updates specific to CA software, and updates related to system time (time zone changes) Tactical Medium Update HSM software and firmware when released Tactical Medium Ensure that any activity performed on an offline CA can be traced to an individual, either through individual accounts or additional auditing and surveillance Strategic Medium When virtualizing offline CAs, decouple the guest files from the physical hardware so the hardware can be easily replaced Tactical Medium When virtualizing offline CAs, use a dedicated host machine that is secured in a locked rack or safe. If Tactical Medium
Securing%20Public%20Key%20Infrastructure%20(PKI).docx