Security Configuration Audit - CIS benchmarks

Question

I'm trying to conduct a comparative study between the standards used to conduct a security configuration audit. I only found CIS benchmarks. If you could suggest some more known standards it would be helpful.

Answer 1

Aside from CIS Benchmarks, I suggest what the U.S. government uses for FedRAMP clouds which are the USGCB checklists and the DISA STIGS.

Answer 2

CIS are good for any organization to implement, though they are dated. Work is being down presently to update the policies and keep up with the software version, but are severely behind the times. I see these as "non-audit" based standards, as some of the settings allow users to clear history (internet explorer) and such.

Microsoft has their own policies based on CIS, which they recommend as their "security standard". These are now part of their Security Compliance Toolkit and can be found here. There are very little differences between CIS and Microsoft, though the MS policies tend to be more forgiving when it comes to accessing systems and who has rights to do whatever.

DISA is a little more locked-down, and more audit-based, meaning they want the data left on your device so they have evidence of what you are doing, and to be able to track what you did, should you do something wrong. These are a bit more involved to implement, and wording the policies is very cut and dry. Policies for CAC enabled govt employees is found here, though they do give access to some STIGS for non-CAC. Non-govt users who have a .mil or .gov email address can get STIGS through SPAWAR here.

And as stated by LPT, USGCB is for the rest of us, and can be found here.

I saw an earlier post on DISA settings, where someone was asking why you need to remove Domain and Enterprise Admins from specific user rights. Remember, they want you to remove because they want you to come up with your own solution to make it more secure. Create a new group. Add the people who need the rights, and deploy your solution. Least privilege is key!

If you still need a comparative spreadsheet on DISA, CIS, and Microsoft, I started building one a few months ago to show the differences between them. With Windows versioning, the columns started to get a little unruly, so I stopped working on it. Really needs to be put in a database.