Setting Up Privileged Access Workstations (PAWs)

What are Privileged Access Workstations (PAWs)?

Privileged Access Workstations (PAWs) are hardened and dedicated computers used to perform sensitive tasks or access critical data and systems. They are a crucial component of the Administrative Tier Model, primarily used for Tier 0 administration.

Why Use PAWs?

• Reduce the risk of credential theft and lateral movement
• Protect high-privilege accounts from malware and other attacks
• Enforce the principle of least privilege
• Comply with regulatory requirements for secure administration

PAW Setup Checklist

Detailed Setup Instructions

1. Hardware Procurement

• Choose high-performance hardware to ensure smooth operation
• Consider hardware-based security features like TPM 2.0
• Opt for devices with biometric authentication capabilities

2. Clean OS Installation

• Use installation media from a trusted source
• Perform a clean install, not an upgrade
• Configure minimal roles and features

3. Security Updates

• Apply all available security updates
• Configure Windows Update for automatic updates
• Consider using Windows Server Update Services (WSUS) for controlled update deployment

4. Full-Disk Encryption

• Enable BitLocker with TPM + PIN
• Store BitLocker recovery keys securely in Active Directory

5. UEFI Secure Boot

• Enable Secure Boot in UEFI settings
• Verify that Secure Boot is active in Windows

6. Application Control

• Configure WDAC or AppLocker policies
• Whitelist only necessary applications and scripts
• Test policies thoroughly before enforcement

7. Network Isolation

• Place PAWs in a separate network segment
• Use firewalls to restrict network access
• Implement IPsec for secure communication

8. Multi-Factor Authentication

• Enforce MFA for all logins to PAWs
• Consider using smart cards or biometric authentication

9. Management Tools

• Install only necessary administrative tools
• Use remote server administration tools where possible
• Consider using Just Enough Administration (JEA) endpoints

10. Auditing and Monitoring

• Enable comprehensive auditing
• Configure centralized log collection
• Implement real-time alerting for suspicious activities

Best Practices for PAW Usage

• Use PAWs only for authorized administrative tasks
• Never use PAWs for daily activities like web browsing or email
• Regularly review and update PAW configurations
• Implement time-based access controls for PAW usage
• Conduct regular security assessments of PAWs

Maintaining PAWs

• Regularly update operating systems and applications
• Periodically review and refine application control policies
• Rotate local administrator passwords regularly
• Conduct periodic audits of PAW usage and configurations
• Keep PAW hardware physically secure