We've been implementing CIS hardening standards across our heterogeneous fleet of VMs for the last two years (Thank the maker for Ansible). When it came to eval

We've been implementing CIS hardening standards across our heterogeneous fleet of VMs for the last two years (Thank the maker for Ansible). When it came to evaluating the controls we would implement for L1, my team and our Security team negotiated which controls were appropriate for our environment. The first that I whacked was SELinux, and the Security guys couldn't understand why. In a greenfield environment where I had the time to run it in permissive mode and hopefully catch all the odd permissions it would require, maybe. A small maybe. But our environment has been around for decades, with apps that have transitioned across multiple teams, each time losing institutional knowledge. Trying to implement SELinux on theses servers would be hugely disruptive, for minimal gain. Once I was able to explain the risk/reward calculation to the Security guys, they understood. Besides, we have so many compensating controls, I have no worries about expanding the attack surface slightly.