## Chapter 17 — Tamper protection is not measured boot ### Lesson map Lesson 17. Map, example, EX063. ```mermaid flowchart TD C["Printed checklist, applied by hand"] --> F["Four settings"] F --> T["Tamper protection: Defender's settings stay on"] T --> N["Not a TPM quote"] N --> S["Not a STIG score"] N --> B["Not a CIS Benchmark score"] ``` One product switch. A local baseline. No scanned deviation report. ### Logical drawing ```text four settings Windows Firewall on screen lock after five minutes built-in guest account off Microsoft Defender tamper protection on not recorded a firewall rule a network profile a Secure Boot state a STIG or benchmark score ``` ### Learning outcomes After this chapter, you should be able to: 1. Name the four settings and the reason the case gives for tamper protection. 2. Place the printed checklist as a local baseline, not as a scanned benchmark. 3. Refuse a STIG score, a rule export, or a Linux kernel setting on this Windows fleet. ### 17.1 A switch that protects one product is not an integrity measurement of the platform. Chapter 2 applies four settings from the CIS Benchmark, chosen because they match this food bank, and applies them by hand. Twelve laptops do not yet justify a management service. The four are: Windows Firewall on, screen lock after five minutes, the built-in guest account off, and Microsoft Defender with tamper protection on. Tamper protection, in the sense the case uses, stops a harmful program from switching Defender off. That is a control on the antivirus product's own settings. It is not Secure Boot, it is not a TPM quote of boot measurements, and it is not the volume encryption discussed in chapter 11. A reader who treats "tamper protection on" as "the firmware was measured" has changed mechanisms. The checklist is a local baseline in the sense of NIST SP 800-128: a defined configuration, plus a way to see that it has not quietly changed. SP 800-128 also expects change to be controlled. Leah's printed pages record which laptops have been done. They are not a scanned deviation report, and they are not a DISA STIG score. CIS Benchmarks are much larger than four lines. Dietrich and colleagues studied how operators introduce security misconfigurations. That literature is why a checklist can drift. This chapter does not import their counts. No firewall rule is exported. No network profile — domain, private, or public — is recorded, even though chapter 2's reason for the firewall is that laptops join other networks. Inventing an allow-list of ports would invent the rule base. The kernel self-protection document in the references describes properties of the Linux kernel. Applying that webpage here would mix an unrelated kernel family into a charity laptop roll. That Linux page is not a result for `FB01` through `FB12`. SP 800-53's SI-3 names malicious-code protection, and CM-6 names configuration settings. The food bank's evidence is the four settings and the paper checklist. It is not a score against either control, and it is not evidence that a management service has already been deployed. The service remains a later consideration, for a fleet that has not yet grown past twelve. ### 17.2 Worked example | Claim | Mechanism it assumes | Decision | |---|---|---| | "Tamper protection resists Defender being switched off." | The case's own setting | May stay | | "The four settings were applied from a printed checklist." | Chapter 2 | May stay | | "A STIG score was 90." | No score was produced | Refuse | | "Kernel self-protection was enabled on FB01." | These are Windows laptops | Refuse | > **Synthetic case.** No port list and no network profile are added. ### Errors and limits A baseline that lives on paper drifts when the next hurried change is not written down. That is why the monthly routine exists. The routine does not create a STIG result. ### Apply - **EX063 — Which baseline?** The four settings include Defender tamper protection. A classmate reports a STIG score, a firewall rule export, and a Linux kernel setting. What did Leah actually record? *Rubric:* 3 = the four settings and the paper checklist; tamper protection stays a Defender setting, not measured boot; no STIG score, benchmark score, rule list, network profile, or Linux kernel result is added;; 2 = the four settings stay the record;; 1 = one setting;; 0 = none. ### Continue studying — lesson 17 (chapter 17 of 20) [← Chapter 16](#ch-16) · [Course chapter index](../SUBJECTS.md) · [Chapter 18 →](#ch-18) Continue to the next authored lesson. ## Worked answers **EX063.** Leah recorded the four settings and the paper checklist. Tamper protection stays a Defender setting. No STIG score, rule list, network profile or Linux kernel result is added.