- Overview
- Background
- Using the Tool
- Assessing the Assessment Tool
- Assessment Reports
- Summary
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Assessment Reports
The comprehensive assessment report is the final outcome that you expect after answering all the assessment questions. I performed an assessment of a small organization with about 50 employees. Interestingly, even if you run an assessment for a company with 10 employees and only one server, the MSAT report is titled Microsoft Security Assessment Tool For Midsize Organizations. This is because the application is designed for organizations with 50–500 workstations and/or 100–1,000 employees.
At the completion of the assessment, I uploaded the information to the MSAT secure web site and got a 60-page assessment report. Due to the "canned" nature of the report, many recommendations were repeated over and over for various findings. That was expected due to the nature of the tool.
The scorecard section of the report had a legend with three bullet items:
- Meets best practice (green bullet)
- Needs improvement (yellow bullet)
- Severely lacking (red bullet)
When I printed out the report on my black-and-white printer, the green and the red bullets looked identical (black), making it impossible for me to tell which categories met the best practices and which were severely lacking. The yellow bullet was light gray, so I was able to easily distinguish it. Perhaps the report assumes that you will only print the 60-page report in color, or look at the results on your computer screen, which shows the bullets in color. Whichever the case, the Scorecard section of the report, which gives you a nice overview of the assessment at a glance, will be completely useless for people who print the report.
The minimum password-length recommendation of 14 characters is mentioned numerous times throughout the report. A better recommendation would be a minimum length of 15 characters, so that Windows will use the more secure NTLM hash to store passwords, instead of the less secure LAN Manager hash, as discussed in detail in my article "How Secure Is Your Password?"
Some of the references and recommendations are very general in nature. For example, the report suggests that you consider converting your wireless network from WEP to WPA, but there’s no mention of WPA2, or any more details, as this topic is apparently left to Microsoft partners to address. However, this is appropriate, because the report is pointing out weaknesses at a relatively high level.
Although the tool can be used by the customers themselves, it seems that customers will be better off working with a Microsoft Certified Partner or a consultant, because a few portions of the report can be somewhat confusing. For example, the report suggests that if remote connectivity to a corporate network is required, you should consider deploying remote-access client software on all individual workstations. Does that mean that virtual private networks (VPNs) are being discouraged?
Some recommendations may seem too excessive, or not quite practical. For example, the recommendation for all companies to lock every workstation in the organization with cable locks may be a good practice to prevent theft, but most customers may not find it very practical; not only can it be cost-prohibitive, but it makes it more difficult for support personnel to move computers around. The recommendation for locking laptops with cable locks is much more reasonable because it’s much easier for someone to walk out with a small laptop under their arm, compared to a large desktop computer.
The recommendations for logging are also too excessive. Again, this is where a Microsoft Certified Partner can help the customer.
Some suggestions have no clear alternatives. For example, the report recommends that you remove administrative access for users, in order to limit the ability to modify the secure build. However, there’s no suggestion as to how users will continue to do their jobs if you take away their administrative privileges.
Microsoft recommends that you require a background and credit checks for all new critical-position hires. Background checks make sense, but I’m not sure why it’s important to do a credit check on every single critical hire. If an employee doesn’t pay his VISA bill on time, would you consider him a security risk?