A Hardening Checklist for Every OS (CIS Benchmarks)

Why this matters

CIS Benchmarks are consensus configuration baselines for every common OS, app, and cloud service. Level 1 is the practical baseline (most things on, low operational cost); Level 2 is the hardened baseline (some features off, higher operational cost). They're the closest thing to 'do this and you've covered 80% of host hardening'.

Demo

Pick the CIS Ubuntu 22.04 benchmark. ~250 controls. Examples: 'ensure password expiration is 365 days or less', 'ensure /tmp is mounted with nodev,nosuid', 'ensure auditd is enabled'. Each has a rationale, audit command, and remediation.

Try it yourself

1. Download the relevant CIS Benchmark PDF for your OS. Skim chapter 1.
2. Run a CIS scanner (Lynis, OpenSCAP) against a host. Read the report.
3. Pick three findings under Level 1 your fleet doesn't comply with. Document why (accepted risk?) or fix.

References

• CIS Benchmarks
• OpenSCAP