Amazon WorkSpaces STIG-compliant Windows image guidelines
This document provides prescriptive guidance for configuring Amazon WorkSpaces using the Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG).
Severity category code | DISA category code guidelines |
---|---|
CAT I | Any vulnerability, the exploitation of which will directly and immediately result in loss of confidentiality, availability, or integrity. |
CAT II | Any vulnerability, the exploitation of which has a potential to result in loss of confidentiality, availability, or integrity. |
CAT III | Any vulnerability, the existence of which degrades measures to protect against loss of confidentiality, availability, or integrity. |
- MS_Windows_Server_2022_STIG
- E_11_STIG
- MS_EDGE_STIG
- MOZ_Firefox_Windows
- MS_Dot_Net_Framework
- Create Group Policy objects for the applicable STIGs listed in the previous section. It is recommended to create separate policies for each applicable STIG as each STIG may be deployed independently.
- Import the associated STIG policy into the GPO created in Step 1.
- Apply the GPO to the associated Organizational Unit (OU) for deployment.
- Windows_Server_2019_STIG
- IE_11_STIG
- MOZ_Firefox_Windows
- MS_Defender_Antivirus
- MS_Dot_Net_Framework
- Windows_Firewall_with_Advanced_Security
- Create Group Policy objects for the applicable STIGs listed in the previous section. It is recommended to create separate policies for each applicable STIG as each STIG may be deployed independently.
- Import the associated STIG policy into the GPO created in Step 1.
- Apply the GPO to the associated Organizational Unit (OU) for deployment.
Severity | Description | Notes |
---|---|---|
CAT II | Windows Server 2019 domain-joined systems must have a Trusted Platform Module (TPM) enabled and ready for use. | TPM modules are not supported on AWS provided Windows Server 2019 bundles. |
CAT III | Windows Server 2019 systems must have Unified Extensible Firmware Interface (UEFI) firmware and be configured to run in UEFI mode, not Legacy BIOS | UEFI firmware is not supported on AWS provided Windows Server 2019 bundles. |
CAT III | Windows Server 2019 must have Secure Boot enabled | Secure boot is not supported on AWS provided Windows Server 2019 bundles. |
- Windows_Server_2016_STIG
- IE_11_STIG
- MOZ_Firefox_Windows
- MS_Defender_Antivirus
- MS_Dot_Net_Framework
- Windows_Firewall_with_Advanced_Security
- Create Group Policy objects for the applicable STIGs listed in the previous section. It is recommended to create separate policies for each applicable STIG as each STIG may be deployed independently.
- Import the associated STIG Group Policy into the GPO created in Step 1.
- Apply the GPO to the associated Organizational Unit (OU) for deployment.
- Microsoft_Windows_11_STIG
- MS_Edge_STIG
- Create Group Policy objects for the applicable STIGs listed in the previous section. It is recommended to create separate policies for each applicable STIG as each STIG may be deployed independently.
- Import the associated STIG Group Policy into the GPO created in Step 1.
- Apply the GPO to the associated Organizational Unit (OU) for deployment.
Category | Description | Notes |
---|---|---|
CAT II | Windows 11 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest. | NOT A FINDING: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN11-00-000031 and WN11-00-000032). See. https://docs.aws.amazon.com/workspaces/latest/adminguide/encrypt-workspaces.html |
CAT II | Windows 11 must use multi-factor authentication for local and network access to privileged and non-privileged accounts | NOT A FINDING: If the system is a member of a domain this is Not Applicable. |
- MS_Windows_10_STIG
- MS_Defender_Antivirus
- MS_Dot_Net_Framework
- Windows_Firewall_with_Advanced_Security
- MS_Edge_STIG
- Create Group Policy objects for the applicable STIGs listed in the previous section. It is recommended to create separate policies for each applicable STIG as each STIG may be deployed independently.
- Import the associated STIG Group Policy into the GPO created in Step 1.
- Apply the GPO to the associated Organizational Unit (OU) for deployment.
Category | Description | Notes |
---|---|---|
CAT II | Windows 11 information systems must use BitLocker to encrypt all disks to protect the confidentiality and integrity of all information at rest. | NOT A FINDING: An alternate encryption application may be used in lieu of BitLocker providing it is configured for full disk encryption and satisfies the pre-boot authentication requirements (WN11-00-000031 and WN11-00-000032). |
CAT II | Windows 11 must use multifactor authentication for local and network access to privileged and non-privileged accounts | NOT A FINDING: If the system is a member of a domain this is Not Applicable. |
Any opinions in this post are those of the individual author and may not reflect the opinions of AWS.