Elective: Configuration & Compliance Review Against Benchmarks

Prerequisites

• STE-K001: What STE Is
• STE-K007: Cloud Security Posture Evaluation (recommended)

Why This Lesson Matters

Many STE engagements are not free-form tests — they are evaluations of compliance with a specific benchmark: CIS Controls, NIST 800-53, ISO 27001 Annex A, or a client-specific security standard. This elective teaches the structured configuration review process used to produce compliance evidence for auditors and accreditation bodies.

1. Benchmark-Driven Evaluation

Benchmark evaluation flow:
  1. Obtain the benchmark document (CIS Controls v8, NIST 800-53, etc.)
  2. Map controls in scope → identify which apply to the system under evaluation
  3. For each in-scope control: write a test procedure
  4. Execute: collect pass/fail evidence
  5. Calculate compliance percentage and risk exposure
  6. Produce a compliance report

2. CIS Benchmarks for OS Hardening

CIS publishes detailed hardening benchmarks for every major OS. Each recommendation has a level (L1 = essential, L2 = defence-in-depth) and an audit procedure.

# CIS Ubuntu 20.04 L1 — selected checks

# 1.1.1: Ensure separate partition for /tmp
findmnt --target /tmp | grep -v "TARGET"
# PASS: shows /tmp on its own partition
# FAIL: empty output

# 3.1.1: Ensure packet redirect sending is disabled
sysctl net.ipv4.conf.all.send_redirects
# PASS: net.ipv4.conf.all.send_redirects = 0
# FAIL: value = 1

# 5.2.1: Ensure permissions on /etc/ssh/sshd_config are configured
stat /etc/ssh/sshd_config | grep "Access:"
# PASS: 0600 or 0640
# FAIL: world-readable

# 5.4.2: Ensure no empty passwords
awk -F: '($2 == "") {print $1}' /etc/shadow
# PASS: no output
# FAIL: any username printed

2.1 Automating CIS Checks with Lynis

# Lynis: open-source security auditing tool
sudo lynis audit system --quiet 2>/dev/null | tee /tmp/lynis_report.txt

# Extract failing tests
grep "\[ WARNING \]" /tmp/lynis_report.txt | head -20

# Generate HTML report
sudo lynis audit system --report-file /tmp/lynis_report.dat

3. Compliance Scoring

Scoring model (CIS Level 1 — 100 controls):
  Controls evaluated:  85
  Controls passed:     71
  Controls failed:     14
  Not applicable:      15

  L1 compliance score: 71/85 = 83.5%
  Organisation target: ≥ 90% for certification

  Risk-weighted score:
  Critical failures: 2 (weighted × 5) = 10 points
  High failures:     5 (weighted × 3) = 15 points
  Medium failures:   7 (weighted × 1) = 7 points
  Total risk points: 32 / maximum 425 = 7.5% risk exposure

4. Producing a Compliance Evidence Package

For formal accreditation, evidence must be packaged systematically:

Evidence Package Structure:
  /evaluation-results/
    ├── summary.xlsx         (control ID, description, result, evidence ref)
    ├── /evidence/
    │   ├── EX-001_sshd_permissions.png
    │   ├── EX-002_empty_password_check.txt
    │   ├── EX-003_partition_check.txt
    │   └── ...
    └── /tool-output/
        ├── lynis_report.txt
        ├── nessus_scan.nessus
        └── zap_alerts.json

5. Practice Exercises

1. CIS Control 5.2.6 states: "Ensure SSH MaxAuthTries is set to 4 or less." Write the audit command, the expected output for PASS, and the STE test case.

2. An evaluation produces: 60 L1 controls passed, 20 failed, 20 N/A. The target is 85% compliance. Has the system passed? What score must the failed controls achieve to meet the target?

3. A client wants evidence that their AWS environment meets CIS AWS Foundations Benchmark Level 1. Which tool would you use, and what output format would you provide to their auditor?

6. Lab

Assessment mode: quiz

You are given a Lynis report output with 12 warnings. For each warning: identify the CIS control reference, write the manual verification command, and classify as Critical/High/Medium based on the control level and potential impact.

7. Framework Alignment

8. Further Reading

• CIS Benchmarks — https://www.cisecurity.org/cis-benchmarks — Free download with account
• Lynis — https://cisofy.com/lynis — Open-source; the go-to Linux hardening audit tool
• OpenSCAP — https://www.open-scap.org — SCAP-compliant benchmark evaluation for enterprise environments

["Apply five CIS Ubuntu 20.04 Level 1 audit procedures using shell commands and produce pass/fail results with the actual command output as evidence", "Calculate a compliance score from a provided list of evaluated, passed, failed, and N/A controls, and determine whether the system meets a stated compliance target", "Produce a structured compliance evidence package with a summary spreadsheet, per-control evidence files, and tool output, following the folder structure from this lesson"]

Prerequisites → Why this matters → Benchmark-driven evaluation flow → CIS benchmarks for OS hardening (selected checks with shell commands) → Automating with Lynis → Compliance scoring model → Evidence package structure → Practice exercises → Quiz lab → Framework alignment → Further reading