Tamper protection is not measured boot

Lesson map

Lesson 17. Map, example, EX063.

flowchart TD
  C["Printed checklist, applied by hand"] --> F["Four settings"]
  F --> T["Tamper protection: Defender's settings stay on"]
  T --> N["Not a TPM quote"]
  N --> S["Not a STIG score"]
  N --> B["Not a CIS Benchmark score"]

One product switch. A local baseline. No scanned deviation report.

Logical drawing

four settings
    Windows Firewall on
    screen lock after five minutes
    built-in guest account off
    Microsoft Defender tamper protection on
not recorded
    a firewall rule
    a network profile
    a Secure Boot state
    a STIG or benchmark score

Learning outcomes

After this chapter, you should be able to:

1. Name the four settings and the reason the case gives for tamper protection.
2. Place the printed checklist as a local baseline, not as a scanned benchmark.
3. Refuse a STIG score, a rule export, or a Linux kernel setting on this Windows fleet.

17.1 A switch that protects one product is not an integrity measurement of the platform.

Chapter 2 applies four settings from the CIS Benchmark, chosen because they match this food bank, and applies them by hand. Twelve laptops do not yet justify a management service. The four are: Windows Firewall on, screen lock after five minutes, the built-in guest account off, and Microsoft Defender with tamper protection on. Tamper protection, in the sense the case uses, stops a harmful program from switching Defender off. That is a control on the antivirus product's own settings. It is not Secure Boot, it is not a TPM quote of boot measurements, and it is not the volume encryption discussed in chapter 11. A reader who treats "tamper protection on" as "the firmware was measured" has changed mechanisms.

The checklist is a local baseline in the sense of NIST SP 800-128: a defined configuration, plus a way to see that it has not quietly changed. SP 800-128 also expects change to be controlled. Leah's printed pages record which laptops have been done. They are not a scanned deviation report, and they are not a DISA STIG score. CIS Benchmarks are much larger than four lines. Dietrich and colleagues studied how operators introduce security misconfigurations. That literature is why a checklist can drift. This chapter does not import their counts. No firewall rule is exported. No network profile — domain, private, or public — is recorded, even though chapter 2's reason for the firewall is that laptops join other networks. Inventing an allow-list of ports would invent the rule base.

The kernel self-protection document in the references describes properties of the Linux kernel. Applying that webpage here would mix an unrelated kernel family into a charity laptop roll. That Linux page is not a result for FB01 through FB12. SP 800-53's SI-3 names malicious-code protection, and CM-6 names configuration settings. The food bank's evidence is the four settings and the paper checklist. It is not a score against either control, and it is not evidence that a management service has already been deployed. The service remains a later consideration, for a fleet that has not yet grown past twelve.

17.2 Worked example

Lesson table; scroll horizontally to read all columns →

Synthetic case. No port list and no network profile are added.

Errors and limits

A baseline that lives on paper drifts when the next hurried change is not written down. That is why the monthly routine exists. The routine does not create a STIG result.

Apply

• EX063 — Which baseline? The four settings include Defender tamper protection. A classmate reports a STIG score, a firewall rule export, and a Linux kernel setting. What did Leah actually record?
  Show marking criteria

  Rubric: 3 = the four settings and the paper checklist; tamper protection stays a Defender setting, not measured boot; no STIG score, benchmark score, rule list, network profile, or Linux kernel result is added;; 2 = the four settings stay the record;; 1 = one setting;; 0 = none.