CIS Compliance

CIS® (Center for Internet Security, Inc.) is a forward-thinking, non-profit entity that harnesses the power of a global IT community to safeguard private and public organizations against cyber threats.

The CIS Controls™ and CIS Benchmarks™ are the global standard and recognized best practices for securing IT systems and data against the most pervasive attacks. These proven guidelines are continuously refined and verified by a volunteer, global community of experienced IT professionals.

Over time we have seen more and more customers asking for CIS hardening details on the Snare v8 install. This had a baseline applied around STIG, This is not going far enough and customers are asking for CIS template which has additional controls. The cisecurity.org site provides a multitude of security review and hardening build standards for many operating systems.

The CIS Benchmark for Ubuntu Linux provides prescriptive guidance for establishing a secure configuration posture for Ubuntu Linux 18.04 LTS systems running on x86 and x64 platforms. Many lists are included including filesystem types, services, clients, and network protocols. Not all items in these lists are guaranteed to exist on all distributions and additional similar items may exist which should be considered in addition to those explicitly mentioned. The full document can be reviewed here:

Note

CIS requires auditd to be enabled in the system for it to be compliant. Snare Central enables the auditing system only when STIG compliance is enabled, hence it is required that STIG be enabled for the Snare Central to be fully CIS compliant.

We used Nessus vulnerability scanner for a CIS compliance assessment on Snare Central. The following table lists all Nessus benchmark items that are assessed:


chapter	section	index	title	v8.x.x enabled
1			Initial Setup
	1.1		Filesystem Configuration
		1.1.1.1	Ensure mounting of cramfs filesystems is disabled	always
		1.1.1.2	Ensure mounting of freevxfs filesystems is disabled	always
		1.1.1.3	Ensure mounting of jffs2 filesystems is disabled	always
		1.1.1.4	Ensure mounting of hfs filesystems is disabled	always
		1.1.1.5	Ensure mounting of hfsplus filesystems is disabled	always
		1.1.1.6	Ensure mounting of udf filesystems is disabled	always
		1.1.2	Ensure separate partition exists for /tmp	always
		1.1.3	Ensure nodev option set on /tmp partition	always
		1.1.4	Ensure nosuid option set on /tmp partition	always
		1.1.5	Ensure separate partition exists for /var	always
		1.1.6	Ensure separate partition exists for /var/tmp	always
		1.1.7	Ensure nodev option set on /var/tmp partition	always
		1.1.8	Ensure nosuid option set on /var/tmp partition	always
		1.1.9	Ensure noexec option set on /var/tmp partition	always
		1.1.10	Ensure separate partition exists for /var/log	always
		1.1.11	Ensure separate partition exists for /var/log/audit	always
		1.1.12	Ensure separate partition exists for /home	always
		1.1.13	Ensure nodev option set on /home partition	always
		1.1.14	Ensure nodev option set on /dev/shm partition (/run)	always
		1.1.15	Ensure nosuid option set on /dev/shm partition (/run)	always
		1.1.16	Ensure noexec option set on /dev/shm partition (/run)	always
		1.1.17	Ensure nodev option set on removable media partitions	always
		1.1.18	Ensure nosuid option set on removable media partitions	always
		1.1.19	Ensure noexec option set on removable media partitions	always
		1.1.20	Ensure sticky bit is set on all world-writable directories	always
		1.1.21	Disable Automounting	always
	1.2		Configure Software Updates
		1.2.1	Ensure package manager repositories are configured	always
		1.2.2	Ensure GPG keys are configured	always
	1.3		Filesystem Integrity Checking
		1.3.1	Ensure AIDE is installed	always
		1.3.2	Ensure filesystem integrity is regularly checked	always
	1.4		Secure Boot Settings
		1.4.1	Ensure permissions on bootloader config are configured	always
		1.4.2	Ensure bootloader password is set	always
		1.4.3	Ensure authentication required for single user mode	always
	1.5		Additional Process Hardening
		1.5.1	Ensure core dumps are restricted	always
		1.5.2	Ensure XD/NX support is enabled	always
		1.5.3	Ensure address space layout randomization (ASLR) is enabled	always
		1.5.4	Ensure prelink is disabled	always
	1.6		Mandatory Access Control
		1.6.1.1	Ensure SELinux is not disabled in bootloader configuration	always
		1.6.1.2	Ensure the SELinux state is enforcing	always
		1.6.1.3	Ensure SELinux policy is configured	always
		1.6.1.4	Ensure no unconfined daemons exist	always
		1.6.2.1	Ensure AppArmor is not disabled in bootloader configuration	always
		1.6.2.2	Ensure all AppArmor Profiles are enforcing	always
		1.6.3	Ensure SELinux or AppArmor are installed	always
	1.7		Warning Banners
		1.7.1.1	Ensure message of the day is configured properly	always
		1.7.1.2	Ensure local login warning banner is configured properly	always
		1.7.1.3	Ensure remote login warning banner is configured properly	always
		1.7.1.4	Ensure permissions on /etc/motd are configured	always
		1.7.1.5	Ensure permissions on /etc/issue are configured	always
		1.7.1.6	Ensure permissions on /etc/issue.net are configured	always
		1.7.2	Ensure GDM login banner is configured	always
	1.8		Ensure updates patches and additional security software are installed

2			Services
	2.1		inetd Services
		2.1.1	Ensure chargen services are not enabled	always
		2.1.2	Ensure daytime services are not enabled	always
		2.1.3	Ensure discard services are not enabled	always
		2.1.4	Ensure echo services are not enabled	always
		2.1.5	Ensure time services are not enabled	always
		2.1.6	Ensure rsh server is not enabled	always
		2.1.7	Ensure talk server is not enabled	always
		2.1.8	Ensure telnet server is not enabled	always
		2.1.9	Ensure tftp server is not enabled	always
		2.1.10	Ensure xinetd is not enabled	always
		2.1.11	Ensure openbsd-inetd is not installed	always
	2.2		Special Purpose Services
		2.2.1.1	Ensure time synchronization is in use	always
		2.2.1.2	Ensure ntp is configured	always
		2.2.1.3	Ensure chrony is configured	always
		2.2.2	Ensure X Window System is not installed	always
		2.2.3	Ensure Avahi Server is not enabled	always
		2.2.4	Ensure CUPS is not enabled	always
		2.2.5	Ensure DHCP Server is not enabled	always
		2.2.6	Ensure LDAP server is not enabled	always
		2.2.7	Ensure NFS and RPC are not enabled	always
		2.2.8	Ensure DNS Server is not enabled	always
		2.2.9	Ensure FTP Server is not enabled	always
		2.2.10	Ensure HTTP server is not enabled	always
		2.2.11	Ensure IMAP and POP3 server is not enabled	always
		2.2.12	Ensure Samba is not enabled	always
		2.2.13	Ensure HTTP Proxy Server is not enabled	always
		2.2.14	Ensure SNMP Server is not enabled	always
		2.2.15	Ensure mail transfer agent is configured for local-only mode	always
		2.2.16	Ensure rsync service is not enabled	always
		2.2.17	Ensure NIS Server is not enabled	always
	2.3		Service Clients
		2.3.1	Ensure NIS Client is not installed	always
		2.3.2	Ensure rsh client is not installed	always
		2.3.3	Ensure talk client is not installed	always
		2.3.4	Ensure telnet client is not installed	always
		2.3.5	Ensure LDAP client is not installed	always

3			Network Configuration
	3.1		Network Parameters (Host Only)
		3.1.1	Ensure IP forwarding is disabled	always
		3.1.2	Ensure packet redirect sending is disabled	always
	3.2		Network Parameters (Host and Router)
		3.2.1	Ensure source routed packets are not accepted	always
		3.2.2	Ensure ICMP redirects are not accepted	always
		3.2.3	Ensure secure ICMP redirects are not accepted	always
		3.2.4	Ensure suspicious packets are logged	always
		3.2.5	Ensure broadcast ICMP requests are ignored	always
		3.2.6	Ensure bogus ICMP responses are ignored	always
		3.2.7	Ensure Reverse Path Filtering is enabled	always
		3.2.8	Ensure TCP SYN Cookies is enabled	always
	3.3		Ipv6
		3.3.1	Ensure IPv6 router advertisements are not accepted	always
		3.3.2	Ensure IPv6 redirects are not accepted	always
		3.3.3	Ensure IPv6 is disabled	always
	3.4		TCP Wrappers
		3.4.1	Ensure TCP Wrappers is installed	always
		3.4.2	Ensure /etc/hosts.allow is configured	always
		3.4.3	Ensure /etc/hosts.deny is configured	always
		3.4.4	Ensure permissions on /etc/hosts.allow are configured	always
		3.4.5	Ensure permissions on /etc/hosts.deny are configured	always
	3.5		Uncommon Network Protocols
		3.5.1	Ensure DCCP is disabled	always
		3.5.2	Ensure SCTP is disabled	always
		3.5.3	Ensure RDS is disabled	always
		3.5.4	Ensure TIPC is disabled	always
	3.6		Firewall Configuration
		3.6.1	Ensure iptables is installed	always
		3.6.2	Ensure default deny firewall policy	always
		3.6.3	Ensure loopback traffic is configured	always
		3.6.4	Ensure outbound and established connections are configured	always
		3.6.5	Ensure firewall rules exist for all open ports	always
	3.7		Ensure wireless interfaces are disabled	always

4			Logging and Auditing
	4.1		Configure System Accounting (auditd)
		4.1.1.1	Ensure audit log storage size is configured	always
		4.1.1.2	Ensure system is disabled when audit logs are full	always
		4.1.1.3	Ensure audit logs are not automatically deleted	always
		4.1.2	Ensure auditd service is enabled	needs STIG
		4.1.3	Ensure auditing for processes that start prior to auditd is enabled	needs STIG
		4.1.4	Ensure events that modify date and time information are collected	needs STIG
		4.1.5	Ensure events that modify user/group information are collected	needs STIG
		4.1.6	Ensure events that modify the system's network environment are collected	needs STIG
		4.1.7	Ensure events that modify the system's Mandatory Access Controls are collected	needs STIG
		4.1.8	Ensure login and logout events are collected	needs STIG
		4.1.9	Ensure session initiation information is collected	needs STIG
		4.1.10	Ensure discretionary access control permission modification events are collected	needs STIG
		4.1.11	Ensure unsuccessful unauthorized file access attempts are collected	needs STIG
		4.1.12	Ensure use of privileged commands is collected	needs STIG
		4.1.13	Ensure successful file system mounts are collected	needs STIG
		4.1.14	Ensure file deletion events by users are collected	needs STIG
		4.1.15	Ensure changes to system administration scope (sudoers) is collected	needs STIG
		4.1.16	Ensure system administrator actions (sudolog) are collected	needs STIG
		4.1.17	Ensure kernel module loading and unloading is collected	needs STIG
		4.1.18	Ensure the audit configuration is immutable	needs STIG
	4.2		Configure Logging
		4.2.1.1	Ensure rsyslog Service is enabled	always
		4.2.1.2	Ensure logging is configured	always
		4.2.1.3	Ensure rsyslog default file permissions configured	always
		4.2.1.4	Ensure rsyslog is configured to send logs to a remote log host	always
		4.2.1.5	Ensure remote rsyslog messages are only accepted on designated log hosts	always
		4.2.2.1	Ensure syslog-ng service is enabled	always
		4.2.2.2	Ensure logging is configured	always
		4.2.2.3	Ensure syslog-ng default file permissions configured	always
		4.2.2.4	Ensure syslog-ng is configured to send logs to a remote log host	always
		4.2.2.5	Ensure remote syslog-ng messages are only accepted on designated log hosts]	always
		4.2.3	Ensure rsyslog or syslog-ng is installed	always
		4.2.4	Ensure permissions on all logfiles are configured	always
	4.3		Ensure logrotate is configured	always

5			Access, Authentication and Authorization
	5.1		Configure cron
		5.1.1	Ensure cron daemon is enabled	always
		5.1.2	Ensure permissions on /etc/crontab are configured	always
		5.1.3	Ensure permissions on /etc/cron.hourly are configured	always
		5.1.4	Ensure permissions on /etc/cron.daily are configured	always
		5.1.5	Ensure permissions on /etc/cron.weekly are configured	always
		5.1.6	Ensure permissions on /etc/cron.monthly are configured	always
		5.1.7	Ensure permissions on /etc/cron.d are configured	always
		5.1.8	Ensure at/cron is restricted to authorized users	always
	5.2		SSH Server Configuration	always
		5.2.1	Ensure permissions on /etc/ssh/sshd_config are configured	always
		5.2.2	Ensure SSH Protocol is set to 2	always
		5.2.3	Ensure SSH LogLevel is set to INFO	always
		5.2.4	Ensure SSH X11 forwarding is disabled	always
		5.2.5	Ensure SSH MaxAuthTries is set to 4 or less	always
		5.2.6	Ensure SSH IgnoreRhosts is enabled	always
		5.2.7	Ensure SSH HostbasedAuthentication is disabled	always
		5.2.8	Ensure SSH root login is disabled	always
		5.2.9	Ensure SSH PermitEmptyPasswords is disabled	always
		5.2.10	Ensure SSH PermitUserEnvironment is disabled	always
		5.2.11	Ensure only approved MAC algorithms are used	always
		5.2.12	Ensure SSH Idle Timeout Interval is configured	always
		5.2.13	Ensure SSH LoginGraceTime is set to one minute or less	always
		5.2.14	Ensure SSH access is limited	always
		5.2.15	Ensure SSH warning banner is configured	always
	5.3		Configure PAM
		5.3.1	Ensure password creation requirements are configured	always
		5.3.2	Ensure lockout for failed password attempts is configured	always
		5.3.3	Ensure password reuse is limited	always
		5.3.4	Ensure password hashing algorithm is SHA-512	always
	5.4		User Accounts and Environment
		5.4.1.1	Ensure password expiration is 365 days or less	always
		5.4.1.2	Ensure minimum days between password changes is 7 or more	always
		5.4.1.3	Ensure password expiration warning days is 7 or more	always
		5.4.1.4	Ensure inactive password lock is 30 days or less	always
		5.4.1.5	Ensure all users last password change date is in the past	always
		5.4.2	Ensure system accounts are non-login	always
		5.4.3	Ensure default group for the root account is GID 0	always
		5.4.4	Ensure default user umask is 027 or more restrictive	always
		5.4.5	Ensure default user shell timeout is 900 seconds or less	always
	5.5		Ensure root login is restricted to system console	always
	5.6		Ensure access to the su command is restricted	always

6			System Maintenance
	6.1		System File Permissions
		6.1.1	Audit system file permissions	always
		6.1.2	Ensure permissions on /etc/passwd are configured	always
		6.1.3	Ensure permissions on /etc/shadow are configured	always
		6.1.4	Ensure permissions on /etc/group are configured	always
		6.1.5	Ensure permissions on /etc/gshadow are configured	always
		6.1.6	Ensure permissions on /etc/passwd- are configured	always
		6.1.7	Ensure permissions on /etc/shadow- are configured	always
		6.1.8	Ensure permissions on /etc/group- are configured	always
		6.1.9	Ensure permissions on /etc/gshadow- are configured	always
		6.1.10	Ensure no world writable files exist	always
		6.1.11	Ensure no unowned files or directories exist	always
		6.1.12	Ensure no ungrouped files or directories exist	always
		6.1.13	Audit SUID executables	always
		6.1.14	Audit SGID executables	always
	6.2		User and Group Settings
		6.2.1	Ensure password fields are not empty	always
		6.2.2	Ensure no legacy "+" entries exist in /etc/passwd	always
		6.2.3	Ensure no legacy "+" entries exist in /etc/shadow	always
		6.2.4	Ensure no legacy "+" entries exist in /etc/group	always
		6.2.5	Ensure root is the only UID 0 account	always
		6.2.6	Ensure root PATH Integrity	always
		6.2.7	Ensure all users' home directories exist	always
		6.2.8	Ensure users' home directories permissions are 750 or more restrictive	always
		6.2.9	Ensure users own their home directories	always
		6.2.10	Ensure users' dot files are not group or world writable	always
		6.2.11	Ensure no users have .forward files	always
		6.2.12	Ensure no users have .netrc files	always
		6.2.13	Ensure users' .netrc Files are not group or world accessible	always
		6.2.14	Ensure no users have .rhosts files	always
		6.2.15	Ensure all groups in /etc/passwd exist in /etc/group	always
		6.2.16	Ensure no duplicate UIDs exist	always
		6.2.17	Ensure no duplicate GIDs exist	always
		6.2.18	Ensure no duplicate user names exist	always
		6.2.19	Ensure no duplicate group names exist	always
		6.2.20	Ensure shadow group is empty	always

CIS vs STIG solved only conflict:
CIS recommendation 5.2.11 states that we need to "Ensure only approved MAC algorithms are used", however STIG V-23826 requires that the SSH daemon only uses a FIPS 140-2 validated cryptographic module (operating in FIPS mode). And after some research, this document: https://csrc.nist.gov/csrc/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp2907.pdf indicates that if we use the CIS settings for this parameter, we still satisfy the FIPS 140-2 validated cryptographic module and in consequence STIG V-23826 as well.
So the MAC parameter on sshd_conf for STIG changed from this:
MACs hmac-sha1

to this one:
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com