Skip to main content

CIS Benchmarks

The Center for Internet Security (CIS) Benchmarks are the global standard and recognized best practices for securing IT systems and data against today's evolving cyber threats. Klarity ImageFactory uses these benchmarks as the foundation for its automated hardening process.

Understanding CIS Benchmarks​

CIS Benchmarks are developed through a unique consensus-based process involving a global community of cybersecurity professionals. They provide highly detailed, step-by-step configuration guidance for various operating systems, cloud providers, and software applications.

Level 1 vs. Level 2​

CIS Benchmarks are typically divided into two profiles:

  • Level 1 (L1): Intended to be practical and prudent, providing a clear security benefit without inhibiting the utility of the technology beyond acceptable means.
  • Level 2 (L2): Intended for environments where security is paramount. It includes all Level 1 controls plus additional, more restrictive settings that may have an impact on system performance or functionality.

Benchmark Categories​

A typical CIS Benchmark covers a wide range of system configuration areas. In ImageFactory, our hardening scripts address the following categories:

  1. Filesystem Configuration: Securing mount points, disabling unused filesystems, and setting proper permissions on system files.
  2. Software Updates: Ensuring that the system is configured to receive regular security updates and that package manager integrity is maintained.
  3. Filesystem Integrity Checking: Implementing tools like AIDE to monitor changes to critical system files.
  4. Boot Settings: Securing the bootloader (GRUB/LILO) and restricting access to single-user mode.
  5. Process Hardening: Enabling features like ASLR and restricting core dumps.
  6. Mandatory Access Control: Configuring and enforcing SELinux or AppArmor policies.
  7. Network Configuration: Disabling unused network protocols (e.g., IPv6 if not needed), securing the TCP/IP stack, and configuring firewall rules.
  8. Logging and Auditing: Setting up comprehensive system logging (rsyslog/journald) and audit rules (auditd) to track security-relevant events.
  9. System Access, Authentication, and Authorization: Securing SSH, configuring PAM, and enforcing strong password policies.
  10. User Environment: Setting secure default umasks and restricting access to system accounts.
  11. System Maintenance: Removing legacy services and ensuring that system file permissions are regularly audited.

Implementation Details​

ImageFactory maintains a library of hardening scripts tailored to each supported distribution.

Linux Implementation​

Linux hardening is built using Ansible roles. Each role is structured with distribution-specific tasks, templates for configuration files, variables for tuning, and handlers for restarting services. This modular approach allows us to maintain a high degree of consistency while accounting for the nuances of different Linux families (e.g., Debian vs. RedHat).

Windows Implementation​

Windows hardening utilizes Ansible playbooks that execute PowerShell tasks. These tasks interact with the Windows Registry and Group Policy Objects (GPOs) to apply the benchmark settings. For initial setup, ImageFactory uses userdata scripts to ensure the environment is correctly prepared for the Ansible provisioner.

Benchmark Storage and Mapping​

The specific rules for each benchmark are stored as JSON files within the ImageFactory backend. These files (e.g., ubuntu20.json, rhel8.json, win2022.json) contain the mapping between CIS rule IDs and the corresponding implementation tasks.

Compliance Scoring and Reporting​

After an image build, ImageFactory performs an automated scan to verify compliance with the selected CIS profile.

  1. Scan Execution: A specialized scanning tool runs against the finalized image, checking every rule defined in the benchmark.
  2. Data Collection: The results are collected and processed to calculate the percentage of passed checks.
  3. Report Generation: ImageFactory generates a comprehensive JSON report for machine consumption and a formatted PDF report for human review.
  4. Score Storage: The final compliance scores (Level 1 and Level 2) are stored with the image metadata and can be viewed in the ImageFactory UI or retrieved via the API.