hpaul-osi

Extreme PI System Hardening
High value systems warrant hardcore hardening measures. The PI System resides at a critical junction, communicating across strict network boundaries. Under this paradigm, the PI System acts as a 'safe harbor' for data, defending critical systems by reducing the number of users inside the security perimeter while enabling growth in the number of users getting value from OT data. An application can only be as secure as its operating platform, so this session will start from the ground up. We will establish a solid foundation with advanced hardening measures for the Windows operating system that OSIsoft has collected over many years working with the platform, such as security baselines, PowerShell’s Desired State Configuration, and arcane corners of the Windows Advanced Firewall. With the platform locked down, we will explore application hardening measures built within and tailored to the PI System. Emphasis will be on using the latest technology and tools available to embrace agility

hpaul-osi

This gist contains examples from the S4x18 sponsor talk, Hardcore Windows Hardening.
https://s4x18.com/sessions/sponsor-stage-13/

hpaul-osi

Configuration EnableVBSFeatures
{
param(
	[System.String]
	$NodeName = 'localhost'
)

	Import-DSCResource -ModuleName 'PSDesiredStateConfiguration'
	
	Node $NodeName

hpaul-osi

Configuration EnableWER
{
param(
	[System.String]
	$NodeName = 'localhost',

	[System.String]
	$DumpFolder = ''
)

hpaul-osi

# Disable extraneous services on Server 2016 Desktop Experience
# https://blogs.technet.microsoft.com/secguide/2017/05/29/guidance-on-disabling-system-services-on-windows-server-2016-with-desktop-experience/
Configuration DisablingServicesOnServer2016wDE
{
    param(
        [String]$ComputerName = "localhost",
        [ValidateSet('ShouldBeDisabledOnly','ShouldBeDisabledAndDefaultOnly','OKToDisable','OKToDisablePrinter','OKToDisableDC')]
        [String]$Level = 'OKToDisable'
    )

hpaul-osi

# Tested with Server 2016 and Server 2012 R2, PS 4 and PS 5
Configuration StrongCipherSettings
{
	param
	(
		$ComputerName = "localhost",
		# TLS/SSL Security Considerations
		# https://technet.microsoft.com/en-us/library/dn786446(v=ws.11).aspx
		$schannelProtocols = @{
                	                "PCT 1.0"=$false;