The Windows PAW must be configured with a vendor-supported version of Windows 10 and applicable security patches that are DoD approved.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-243447	WPAW-00-000700	SV-243447r722912_rule		Medium

Description
Older versions of operating systems usually contain vulnerabilities that have been fixed in later released versions. In addition, most operating system patches contain fixes for recently discovered security vulnerabilities. Due to the highly privileged activities of a PAW, it must be maintained at the highest security posture possible and therefore must have one of the current vendor-supported operating system versions installed.

Description

Older versions of operating systems usually contain vulnerabilities that have been fixed in later released versions. In addition, most operating system patches contain fixes for recently discovered security vulnerabilities. Due to the highly privileged activities of a PAW, it must be maintained at the highest security posture possible and therefore must have one of the current vendor-supported operating system versions installed.

STIG	Date
Microsoft Windows PAW Security Technical Implementation Guide	2022-03-01

Details

Check Text ( C-46722r722910_chk )
Determine the current approved versions of Windows 10. Talk to the Authorizing Official (AO) staff, Information System Security Manager (ISSM), or PAW system administrator to determine the approved versions of Windows 10. Review the configuration of the PAW and determine which version of Windows is installed on the PAW. Verify the installed Windows 10 version is an approved version. If the installed Windows 10 version on the PAW is not the same as an approved version, this is a finding.

Check Text ( C-46722r722910_chk )

Determine the current approved versions of Windows 10.

Talk to the Authorizing Official (AO) staff, Information System Security Manager (ISSM), or PAW system administrator to determine the approved versions of Windows 10.

Review the configuration of the PAW and determine which version of Windows is installed on the PAW.

Verify the installed Windows 10 version is an approved version.

If the installed Windows 10 version on the PAW is not the same as an approved version, this is a finding.

Fix Text (F-46679r722911_fix)
Install one of the current vendor-supported versions of Windows 10 on site PAWs, including the most recently released patches. Note: There is no central list in the DoD of "approved" operating system versions. The Microsoft website will list supported versions of Windows 10 and patches. If a STIG is available for one or more of the vendor-supported versions of Windows 10, the version can be considered to be DoD approved. Local AOs usually have implemented a procedure for testing Windows updates before they are deployed. Check with the local AO's staff to determine the latest approved version of Windows 10.

Fix Text (F-46679r722911_fix)

Install one of the current vendor-supported versions of Windows 10 on site PAWs, including the most recently released patches.

Note: There is no central list in the DoD of "approved" operating system versions. The Microsoft website will list supported versions of Windows 10 and patches. If a STIG is available for one or more of the vendor-supported versions of Windows 10, the version can be considered to be DoD approved. Local AOs usually have implemented a procedure for testing Windows updates before they are deployed. Check with the local AO's staff to determine the latest approved version of Windows 10.