Hacker News Reader

Comment by jSherz | Hacker News Reader

The CIS benchmarks are a great place to start for hardening a system (https://www.cisecurity.org/cis-benchmarks/) and there's also OpenSCAP gives you a nice way to scan systems for compliance against a set of hardening rules (https://www.open-scap.org/).

View on HN

Yes! This guide is good for securing maybe a personal server, but any business systems should use a server hardening standard that has industry mindshare (CIS, STIG, etc.) I can speak from personal experience that QSAs give you a very skeptical look when you say "our security standard is homebrewed."

Meh, QSAs check boxes. In my experience they are not very technically capable. Some are, of course. Most are not.

Sure but the point still stands. Why should anyone trust that you, or your company, is any good at security compared to say CIS?

If you have homegrown security and can show your QSA your detailed policy document and that it's a superset of CIS, STIG, NIST, etc. with documented exceptions then it'll be no problem.

I avoid homegrown whenever possible because it's a rabbit hole that never ends. If you instead say CIS level 2 then you can clearly define when you've done enough.

Because, checked boxes don’t mean much. CIS level 2 = a lot of checked boxes. Using cyber security frameworks is great, but some of the most compliant and “advanced” organizations have the worst legacy cruft you can imagine. We work with orgs all the time and organizations that use these frameworks with expert guidance can easily secure their most critical assets while only implementing the right parts of a framework. And the best frameworks have risk based targeting for maturity levels (NIST Cybersecurity) of various activities. These frameworks can end up being a bit of security theatre if you are just implementing it for the sake of “having security”. Guess I am just jaded after breaking software and networks for over a decade. Some of the most secure organizations have very adaptive security practices that focus on application security. Some of the worst are ISO, CIS, STIG policy template hardened blah blah blah. Just don’t put these frameworks and policies on a pedastal. The real security work happens in the margins.

Thanks. What about using the hardened images they provide? https://www.cisecurity.org/cis-hardened-image-list/

Their hardened images are fine but there are two issues. First, you'll need to test / dev with them as full implementations of CIS can break things (though not as bad as the STIGs) and, IIRC, they charge extra for you to use their images on public clouds.

From what I can tell, their images are only for the big three cloud providers.

I am in the process of going through one of their benchmarks right now. They have some good stuff but I'm on page 130 of 431 and so far I haven't come across anything that needed to be changed from a standard Debian install.

Reply on news.ycombinator.com