CIS Benchmark Hardening/Vulnerability Checklists

PCI DSS Requirements

Sample PCI DSS reports

Windows Desktop

Windows Desktop

• Windows 10

• Windows 10

Windows 10

NNT PCI DSS Windows 10 Enterprise 1709 v1217

Windows Server

Windows Server

• 2016 NEW
• 2012R2
• 2008R2

• 2016 NEW
• 2012R2
• 2008R2

2016 NEW

NNT PCI DSS Microsoft Member Server 2016 v1217

2012R2

NNT PCI DSS Compliance Report 2012R2 Member Server

2008R2

NNT PCI DSS Microsoft Windows Server 2008 R2 Benchmark

Linux Server

Linux Server

• RHEL 6

• RHEL 6

RHEL 6

NNT PCI DSS RHEL 6 Sample Report

2.2 Develop configuration standards for all system components. Assure that these standards address all known security vulnerabilities and are consistent with industry-accepted system hardening standards.

Sources of industry-accepted system hardening standards may include, but are not limited to:

• Center for Internet Security (CIS)
• International Organization for Standardization (ISO)
• SysAdmin Audit Network Security (SANS) Institute
• National Institute of Standards Technology (NIST).

Testing Procedures

2.2.a Examine the organization's system configuration standards for all types of system components and verify the system configuration standards are consistent with industry-accepted hardening standards.

2.2.b Examine policies and interview personnel to verify that system configuration standards are updated as new vulnerability issues are identified, as defined in Requirement 6.1.

2.2.c Examine policies and interview personnel to verify that system configuration standards are applied when new systems are configured and verified as being in place before a system is installed on the network.

2.2.d Verify that system configuration standards include the following procedures for all types of system components:

• Changing of all vendor-supplied defaults and elimination of unnecessary default accounts
• Implementing only one primary function per server to prevent functions that require different security levels from co-existing on the same server
• Enabling only necessary services, protocols, daemons, etc., as required for the function of the system
• Implementing additional security features for any required services, protocols or daemons that are considered to be insecure
• Configuring system security parameters to prevent misuse
• Removing all unnecessary functionality, such as scripts, drivers, features, subsystems, file systems, and unnecessary web servers.

Guidance

There are known weaknesses with many operating systems, databases, and enterprise applications, and there are also known ways to configure these systems to fix security vulnerabilities. To help those that are not security experts, a number of security organizations have established system-hardening guidelines and recommendations, which advise how to correct these weaknesses.

Examples of sources for guidance on configuration standards include, but are not limited to: www.nist.gov, www.sans.org, and www.cisecurity.org, www.iso.org, and product vendors.

System configuration standards must be kept up to date to ensure that newly identified weaknesses are corrected prior to a system being installed on the network.

Find out more about NNT's PCI DSS compliance solutions »

For a free automated system compliance audit:

Request a free trial of NNT Change Tracker

NIST 800-53

Sample NIST 800-53 reports

• 2012R2

• 2012R2

2012R2

	Sample Full Report NNT NIST 800-53 Microsoft Windows Server 2012 R2 Benchmark GEN7
	Sample Summary NNT NIST 800-53 Microsoft Windows Server 2012 R2Benchmark

Much emphasis is placed on the need to use an SCAP scanning solution powered by content from the National Checklist Repository https://web.nvd.nist.gov/view/ncp/repository

However, many auditors now direct organizations to use CIS Benchmark Checklists directly, because the NCP is either

• Incomplete/Out of date (for example, the latest VMWare ESX content is for 5.1, with no content for later versions)
• Refers to the CIS Benchmark anyway (for example, see RHEL 7 – the prose version (ie manual, non-automated content) of the CIS Benchmark is referenced)

NNT Change Tracker Gen 7 is one of a few CIS Certified Vendor solutions, but any other SCAP, xccdf, OVAL or STIG content can be used too.

Find out more about NNT's NIST 800-53 SP compliance solutions »

For a free automated system compliance audit:

Request a free trial of NNT Change Tracker

NIST 800-171

Sample NIST 800-171 reports

• Windows Server
• Linux Server
• VMWARE ESX

• Windows Server
• Linux Server
• VMWARE ESX

Windows Server

	NNT NIST 800-171 Microsoft Windows Server 2016 Benchmark IP232 WIN2016
	NNT NIST 800-171 Microsoft Windows Server 2012-R2 Benchmark IP227 WIN2012R2
	NNT NIST 800-171 Microsoft Windows Server 2012 Benchmark IP230 WIN2012
	NNT NIST 800-171 Microsoft Windows Server 2008-R2 Benchmark IP225 WIN2008R2
	NNT NIST 800-171 Microsoft Windows Server 2008 Benchmark IP224 WIN2008

 

Linux Server

	NNT NIST 800-171 Oracle Linux 7 Server IP223 OracleLinux7
	NNT NIST 800-171 Oracle Linux 6 Server IP222 OracleLinux6

 

VMWARE ESX

NNT NIST 800-171 VMware ESXi 5.5 Benchmark IP253 ESXi

DISA STIGs

DISA STIG Reports

Windows Server

Windows Server

• 2016
• 2012R2
• 2008R2

• 2016
• 2012R2
• 2008R2

2016

Windows Server 2016 Security Technical Implementation Guide

2012R2

	Windows 2012 and 2012 R2 MS V2R6 Manual STIG
	Windows Server 2012 R2 Member Server Security Technical Implementation Guide
	Windows 2012 and 2012 R2 MS V2R6 STIG Viewer Export
	NNT Windows Server 2008 R2 Member Server STIG V1R20 Report Output
	NNT Windows Server 2012R2 Member Server Security Technical Implementation Guide

2008R2

	Windows 2008 R2 MS V1R14 STIG Benchmark NNT
	Windows Server 2008 R2 Member Server Security Technical Implementation Guide
	Windows 2008 R2 MS V1R20 STIG Viewer Export
	NNT Windows Server 2008 R2 Member Server STIG V1R20 Report Output

Request a free trial of NNT Change Tracker

Solaris

Solaris

	Solaris 10 V1R16 STIG Viewer Output
	NNT Solaris 10 V1R16 Report Output

Request a free trial of NNT Change Tracker

Red Hat

Red Hat

	RedHat 6 V1R13 STIG Viewer Export
	NNT RHEL 6 STIG V1R13 Report Output

Request a free trial of NNT Change Tracker

In addition to support for CIS Benchmarks, NNT Change Tracker Gen 7 can utilize STIG SCAP content to validate compliance with STIG hardened configuration requirements.

STIG configuration guidance is intended to provide DoD systems with a level of confidentiality, integrity, authentication, non-repudiation, and availability in line with the relative risk of cyber attack to the system balanced against the sensitivity and importance of the information asset.

The NNT STIG solution is superior to any provided by a standard SCAP scanner in that, in addition to delivering a snapshot STIG scan, a non-stop monitoring template can be created from the STIG compliance report checklist. This approach provides continuous, real-time monitoring of STIG compliance, reporting any drift within seconds of changes occurring. System-wide file integrity monitoring can also be operated continuously with changes reported in real-time to maximize breach detection awareness.

Example NNT Change Tracker Gen 7 report for NNT DISA STIG Compliance

Find out more about NNT's DISA STIG compliance solutions »

For a free automated system compliance audit:

Request a free trial of NNT Change Tracker

SOX Sarbanes Oxley 404

• 2012R2

• 2012R2

2012R2

Sarbanes Oxley Security Audit Microsoft Windows Server 2012R2 Benchmark GEN7 IP18

In common with many Security Controls Frameworks and Corporate Governance mandates, SOX is non-prescriptive when it comes to defining exactly what is needed to prove 'SOX Compliance'.

Your auditor will want to see evidence that sound security controls are in place, for example, to head-off fraud. However, the risk and opportunity for fraud depends on your organizations individual circumstances, systems and processes – its never a 'one size fits all' assessment.

In the absence of any prescriptive guidance you should therefore be going for the most comprehensive and up to date security vulnerability assessment and secure configuration guidance, which is where the CIS Benchmark assessments come to the fore.

NNT Change Tracker Gen 7 is one of a few CIS Certified Vendor solutions that has been used successfully on a global basis for Sarbanes-Oxley 404 audits

Find out more about NNT's Sarbanes-Oxley (SOX) compliance solutions »

For a free automated system compliance audit:

Request a free trial of NNT Change Tracker

NERC CIP

When reviewing NERC CIP-005 R4 and CIP-007 R8, your auditor will want to see evidence of controls relating to secure configuration practices. How do you ensure Default accounts have been changed/removed for all systems? Have you disabled any ports and services or daemons that are not necessary for regular operation of systems? Do you have a Gold Standard build for all systems and a Baseline report for each device?

Crucially, how do you initially assess whether systems are vulnerable to begin with, and how do you then continue to prove that the latest advice on vulnerabilities is being assimilated into your build standard?

The CIS Benchmarks are the primary reference for any NERC CIP Auditor – by showing that this is your source for secure configuration guidance, presentation of evidence becomes much straightforward. Change Tracker Gen 7 combines real-time system integrity monitoring with automated open port scanning and the baselining/tracking of all firmware/software versions and patches.

Example NNT Change Tracker Gen 7 reports for NERC CIP Compliance

Find out more about NNT's NERC CIP compliance solutions »

For a free automated system compliance audit:

Request a free trial of NNT Change Tracker

ISO 27K

Report Downloads

• 2012R2

• 2012R2

2012R2

NNT ISO27K Microsoft Windows Server 2012 R2 Benchmark GEN7 IP18

As with other GRC mandates discussed here, the value of ISO 27K is often seen by its practitioners as being undermined for its non-prescriptive guidance. High-level objectives for security best practice adoption are comprehensively covered by the standard but for detailed guidance for sections such as

it is necessary to seek advice beyond the standard itself. ISO 27K auditors will typically recommend basing any Corporate Hardened Build-Standard on CIS Benchmark secure configuration guidance, and NNT Change Tracker Gen 7 provides a range of ISO 27K reports alongside the wide-range of CIS Benchmark reports.

Sample ISO 27 K report from NNT Change Tracker Gen 7

Find out more about NNT's ISO 27001/27K compliance solutions »

For a free automated system compliance audit:

Request a free trial of NNT Change Tracker

State of California Data Security Breach Reporting

California Attorney General Kamala D. Harris recently released a Data Breach Report, delving into the 657 data breaches that have been reported to her office since 2012- the same year that the state of California began requiring businesses and government agencies alike to notify the office of breaches affecting more than 500 California residents.

Find out how NNT can help with State of California Data Security Breach Reporting »

For a free automated system compliance audit:

Request a free trial of NNT Change Tracker