3 ms·
These playbooks apply the CIS benchmarks, very very useful for compliance. I use them at $dayjob to build our base AMIs. As for whether they actually harden yo
by Spivak 9mo ago
These playbooks apply the CIS benchmarks, very very useful for compliance. I use them at $dayjob to build our base AMIs.
As for whether they actually harden your servers, that's up
for you to decide if you think that CIS actually helps. It certainly does reduce attack surface.
- wingmanjd 9mo agoAt my $DAYJOB, we have a bunch in-house saltstack states for applying the CIS benchmarks for Ubuntu, Debian, and CentOS. I never looked into it, but I always wondered if I'd be allowed to publish them publicly.
- bhattisatish 9mo agoWell there is one available for oscap at https://github.com/ComplianceAsCode/content https://github.com/ComplianceAsCode/content
- hackernudes 9mo agoContext: https://www.cisecurity.org/cis-benchmarks https://www.cisecurity.org/cis-benchmarks, https://www.cisecurity.org/about-us https://www.cisecurity.org/about-us """The CIS Benchmarks® are prescriptive configuration recommendations for more than 25+ vendor product families. They represent the consensus-based effort of cybersecurity experts globally to help you protect your systems against threats more confidently."""
- infocollector 9mo agohttps://learn.cisecurity.org/benchmarks https://learn.cisecurity.org/benchmarks - this seems broken at least right now. Are these benchmarks on github so that I can download and run it on a linux box?
- firesteelrain 9mo agoYou used to have to make an account to download them.
- viraptor 9mo ago> decide if you think that CIS actually helps. It certainly does reduce attack surface. Official Ubuntu cis docker images in AWS: - change the sysctls which do not apply to containers - install a file consistency checker, which likely makes no sense in a dedicated container - install tcpwrappers which you'll probably never use... for compliance reasons - adjust system user password policies which you're probably not using at all Unless you need to tick some compliance boxes in the quickest and most silly way, go for CIS. If you don't, schedule some time with a security person at your company to create a real threat model and change the things that will make an impact.
- Spivak 9mo agoI feel like a lot of companies need to check compliance boxes. We apply CIS benchmarks as part of getting our SOC 2. They're not required explicitly but they're easy to apply and auditors accept it without any fanfare. I haven't run into any situations where container images need to have CIS benchmarks applied, only VMs.