Questions tagged [cis-framework]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-1 votes
1 answer
19 views

How to configure CDN GCP bucket access privileges

We use GCP Cloud Storage and Cloud CDN to deliver some static assets (html/css/js/.jpg/.png). The buckets used to store those are public with anonymous access (i.e. allUsers in GCP terms). On one hand ...
user avatar
0 votes
2 answers
35 views

Would the TCP port of a VPN with access to the VPC be considered as a "Server administration port" in CIS benchmark?

I'm deploying an AWS Infrastructure that should adhere the CIS Benchmark. I'm trying to understand if the TCP port of the VPN server that permits access to the VPC has to be considered as a "...
user avatar
  • 111
0 votes
1 answer
20 views

The definition of 'Data' Asset Type under the Center for Internet Security (CIS) Controls v8, RAMv2, CDMv2

I am looking for what CIS defines as each of the Asset Types. They have each of the asset types within the glossaries of their documents (Controls, Risk Assessment Methodology, Community Defence ...
user avatar
1 vote
1 answer
139 views

Where could we get CIS Hardening Scripts for AWS EC2?

CIS has published hardening standards for all operating systems of EC2 in AWS. CIS also provides hardened images as well but they're quite expensive at $130/year/instance. Is there a place where we ...
user avatar
  • 113
0 votes
1 answer
466 views

CIS hardened linux vs SELinux(Security Enhanced)

What are the differences between the CIS hardened linux and SELinux(security linux)? Also, all the public cloud service providers support CIS hardened linux. Does it mean SELinux has lost the battle? ...
user avatar
2 votes
0 answers
158 views

Why does the CIS benchmark consider the presence of passwd- a (high) risk [closed]

I've just seen a "high-risk security alert" for the presence of /etc/passwd- (note the trailing '-') on RHEL 8 servers, and don't understand the issue. Apparently the issue originates with ...
user avatar
0 votes
2 answers
605 views

What is the practical approach for CIS Benchmark (Ensure permissions on all logfiles are configured)?

I am trying to harden RHEL with CIS benchmark. One of the items states the following: Ensure permissions on all logfiles are configured Description: Log files stored in /var/log/ contain logged ...
user avatar
  • 26
0 votes
1 answer
380 views

Minimum acceptable CIS compliance percentage?

How does a whole asset fail a CIS benchmarks assessment? I am using Rapid7's InsightVM tool to run CIS scans on couple of our servers. One of them reported 68.27% compliance, while the other scored ...
user avatar
  • 1,297
0 votes
1 answer
620 views

Map CIS benchmark recommendation to Severity

I am using CIS benchmark framework to audit my Linux OS, and I have received various pass/fail results. But is there any way to prioritize the fail results ? Is there any severity mapping available ...
user avatar