I'm researching OS hardening and it seems there are a variety of recommended configuration guides. I realize the different configuration providers supply different offerings per Operating System, but let's assume (for convenience) we're talking about Linux. Consider the following :
Is there any obvious differences between these that might compel someone to choose one over the others?
Some additional context, per answer submissions that asked for additional detail:
- I don't have a requirement to harden against a given benchmark or guideline, I'm simply trying to understand the current best practices used in industry & government. However, I do plan to turn my findings into a research paper for class.
- I will not be audited, except by those that read my paper.
- My professor and a couple of students may be familiar with the auditing process, but I hope to make my paper approachable for everyone. I'd like to write about how to use a tool to automatically scan a system per some guidelines or vulnerability database. I'm fairly new to this area, but I'm researching OpenSCAP and OpenVAS. OpenSCAP seems more approachable than OpenVAS, and appears to be written to test against NIST standards. I'm not sure which NIST are tested by OpenSCAP, but I'll add NIST the NIST guidelines to my list of guides to consider.
- Tate Hansen suggested using Nessus for scanning, however I'd like to stick strictly to Open Source applications to suite my needs for this research.
- A sub-question, it looks like the NIST standards guide for hardening is SP 800-123 and SCAP is simply a format (XML?) for tools to perform and communicate analysis of a system. Is that correct?