Questions tagged [cis-framework]
The cis-framework tag has no usage guidance.
10
questions
0
votes
1
answer
58
views
OS/DB Hardening Checklist Drafting Process
We are looking into reviewing our organization OS/DB hardening checklist (done by predecessor). We're aware that there are various benchmarks out there like CIS & STIG to guide on that, and the ...
- 3
-1
votes
1
answer
108
views
How to configure CDN GCP bucket access privileges
We use GCP Cloud Storage and Cloud CDN to deliver some static assets (html/css/js/.jpg/.png). The buckets used to store those are public with anonymous access (i.e. allUsers in GCP terms).
On one hand ...
- 99
0
votes
2
answers
66
views
Would the TCP port of a VPN with access to the VPC be considered as a "Server administration port" in CIS benchmark?
I'm deploying an AWS Infrastructure that should adhere the CIS Benchmark.
I'm trying to understand if the TCP port of the VPN server that permits access to the VPC has to be considered as a "...
- 111
0
votes
1
answer
87
views
The definition of 'Data' Asset Type under the Center for Internet Security (CIS) Controls v8, RAMv2, CDMv2
I am looking for what CIS defines as each of the Asset Types. They have each of the asset types within the glossaries of their documents (Controls, Risk Assessment Methodology, Community Defence ...
- 21
1
vote
1
answer
940
views
Where could we get CIS Hardening Scripts for AWS EC2?
CIS has published hardening standards for all operating systems of EC2 in AWS.
CIS also provides hardened images as well but they're quite expensive at $130/year/instance.
Is there a place where we ...
- 113
1
vote
1
answer
1k
views
CIS hardened linux vs SELinux(Security Enhanced)
What are the differences between the CIS hardened linux and SELinux(security linux)? Also, all the public cloud service providers support CIS hardened linux. Does it mean SELinux has lost the battle? ...
2
votes
0
answers
257
views
Why does the CIS benchmark consider the presence of passwd- a (high) risk [closed]
I've just seen a "high-risk security alert" for the presence of /etc/passwd- (note the trailing '-') on RHEL 8 servers, and don't understand the issue. Apparently the issue originates with ...
- 139
0
votes
2
answers
1k
views
What is the practical approach for CIS Benchmark (Ensure permissions on all logfiles are configured)?
I am trying to harden RHEL with CIS benchmark. One of the items states the following:
Ensure permissions on all logfiles are configured
Description: Log files stored in /var/log/ contain logged ...
- 36
0
votes
1
answer
1k
views
Minimum acceptable CIS compliance percentage?
How does a whole asset fail a CIS benchmarks assessment?
I am using Rapid7's InsightVM tool to run CIS scans on couple of our servers. One of them reported 68.27% compliance, while the other scored ...
- 1,307
0
votes
1
answer
1k
views
Map CIS benchmark recommendation to Severity
I am using CIS benchmark framework to audit my Linux OS, and I have received various pass/fail results. But is there any way to prioritize the fail results ? Is there any severity mapping available ...
- 433