Hardenings Overview

Security is a core pillar of Klarity ImageFactory. To ensure that every image produced meets the highest security standards, ImageFactory integrates automated hardening based on the Center for Internet Security (CIS) Benchmarks. These benchmarks are industry-standard configuration guidelines developed by a global community of cybersecurity experts.

The Hardening Process

Hardening is applied during the BUILD phase of the image lifecycle. It is implemented through two primary system components: Hardening Level 1 and Hardening Level 2.

1. Hardening Level 1: This level focuses on essential security configurations that have a minimal impact on system functionality. It is recommended for all production images as it provides a strong security baseline without breaking common application workflows.
2. Hardening Level 2: This level provides defense-in-depth security measures. While it significantly increases the security posture, it may restrict some functionality or require additional configuration for certain applications. It is intended for environments with high security requirements.

Platform Implementations

ImageFactory provides separate, optimized implementations for Linux and Windows hardening:

Linux Hardening

Linux hardening is implemented using Ansible playbooks. These playbooks are organized by distribution and version, with specific task files for each supported OS (e.g., Ubuntu, RHEL, Amazon Linux). The playbooks are stored in the hardenings/linux/ directory of the ImageFactory backend and are regularly updated to reflect the latest CIS guidelines.

Windows Hardening

Windows hardening is also managed via Ansible playbooks, but it leverages PowerShell-based tasks to interact with the Windows Registry, Group Policy, and system services. These playbooks are located in hardenings/windows/ and include specialized scripts for initial system preparation and configuration.

System Preparation (Syspreps)

Before hardening scripts are executed, ImageFactory runs a series of system preparation steps, known as syspreps. These steps ensure that the environment is ready for the hardening process:

• Configuring OS-specific preparation (e.g., updating package managers, setting up temporary users).
• Ensuring that the necessary agents and tools are installed for the hardening scripts to run successfully.

Automated Testing and Validation

To maintain the quality and reliability of the hardening scripts, ImageFactory employs an automated testing framework. Every change to a hardening playbook is validated by building a test image, applying the hardening, and then running a series of verification tests to ensure that the rules were applied correctly and that the system remains functional.

Compliance Scoring

A unique feature of Klarity ImageFactory is the automated compliance scoring. After an image build is completed, ImageFactory automatically runs a CIS benchmark scan against the resulting image.

This scan produces a compliance score, which is expressed as a percentage of passed checks for both Level 1 and Level 2. This score provides immediate visibility into the security posture of the image and allows organizations to track compliance over time.

Metric	Description
Level 1 Score	Percentage of passed CIS Level 1 checks.
Level 2 Score	Percentage of passed CIS Level 2 checks (optional).

The results of these scans are available as detailed reports in both JSON and PDF formats, which can be used for auditing and regulatory compliance purposes.