Over the years I have used a number of different sources of security configuration guidance for a spectrum of systems including for example:
- https://www.us-cert.gov/security-publications etc
Given that there are so many different sources, in an attempt to prune the option space, do the following rules make sense?
First, follow government direction;
Second, in the absence of government direction follow the manufacturer's recommendation;
Third, in the absence of a manufacturer's recommendation follow the best practice authorities (eg. CIS) recommendation.
But since multiple best-practice authorities my provide alternate hardening advice for the same system, are there any criteria for preferring one best-practice authority over another (eg. CIS or Stig)?
PS I can't work out if NSA's Information Assurance function is still providing this kind of guidance - are they still in the business of doing this?