CIS Compliance
CIS® (Center for Internet Security, Inc.) is a forward-thinking, non-profit entity that harnesses the power of a global IT community to safeguard private and public organizations against cyber threats.
The CIS Controls™ and CIS Benchmarks™ are the global standard and recognized best practices for securing IT systems and data against the most pervasive attacks. These proven guidelines are continuously refined and verified by a volunteer, global community of experienced IT professionals.
Over time we have seen more and more customers asking for CIS hardening details on the Snare v8 install. The v7 of Snare Central used STIG and some CIS technical controls. For v8 of Snare Central it now has full coverage of the CIS controls which extended the STIG technical controls. The cisecurity.org site provides a multitude of security review and hardening build standards for many operating systems. The STIG hardening controls for Snare Central v8 are based on https://www.stigviewer.com/stig/canonical_ubuntu_18.04_lts/
The CIS Benchmark for Ubuntu Linux provides prescriptive guidance for establishing a secure configuration posture for Ubuntu Linux 18.04 LTS systems running on x86 and x64 platforms. Many lists include filesystem types, services, clients, and network protocols. Not all items in these lists are guaranteed to exist on all distributions and additional similar items may exist which should be considered in addition to those explicitly mentioned. The full document can be reviewed on the cisecurity.org site.
Note
CIS requires auditd to be enabled in the system for it to be compliant. Snare Central enables the auditing system only when STIG compliance is enabled, hence it is required that STIG be enabled for the Snare Central to be fully CIS compliant.
We used Nessus vulnerability scanner for a CIS compliance assessment on Snare Central. The following table lists all Nessus benchmark items that are assessed:
|
|
|
|
|
chapter | section | index | title | v8.x.x enabled |
1 |
|
| Initial Setup |
|
| 1.1 |
| Filesystem Configuration |
|
|
| 1.1.1.1 | Ensure mounting of cramfs filesystems is disabled | always |
|
| 1.1.1.2 | Ensure mounting of freevxfs filesystems is disabled | always |
|
| 1.1.1.3 | Ensure mounting of jffs2 filesystems is disabled | always |
|
| 1.1.1.4 | Ensure mounting of hfs filesystems is disabled | always |
|
| 1.1.1.5 | Ensure mounting of hfsplus filesystems is disabled | always |
|
| 1.1.1.6 | Ensure mounting of udf filesystems is disabled | always |
|
| 1.1.2 | Ensure separate partition exists for /tmp | always |
|
| 1.1.3 | Ensure nodev option set on /tmp partition | always |
|
| 1.1.4 | Ensure nosuid option set on /tmp partition | always |
|
| 1.1.5 | Ensure separate partition exists for /var | always |
|
| 1.1.6 | Ensure separate partition exists for /var/tmp | always |
|
| 1.1.7 | Ensure nodev option set on /var/tmp partition | always |
|
| 1.1.8 | Ensure nosuid option set on /var/tmp partition | always |
|
| 1.1.9 | Ensure noexec option set on /var/tmp partition | always |
|
| 1.1.10 | Ensure separate partition exists for /var/log | always |
|
| 1.1.11 | Ensure separate partition exists for /var/log/audit | always |
|
| 1.1.12 | Ensure separate partition exists for /home | always |
|
| 1.1.13 | Ensure nodev option set on /home partition | always |
|
| 1.1.14 | Ensure nodev option set on /dev/shm partition (/run) | always |
|
| 1.1.15 | Ensure nosuid option set on /dev/shm partition (/run) | always |
|
| 1.1.16 | Ensure noexec option set on /dev/shm partition (/run) | always |
|
| 1.1.17 | Ensure nodev option set on removable media partitions | always |
|
| 1.1.18 | Ensure nosuid option set on removable media partitions | always |
|
| 1.1.19 | Ensure noexec option set on removable media partitions | always |
|
| 1.1.20 | Ensure sticky bit is set on all world-writable directories | always |
|
| 1.1.21 | Disable Automounting | always |
| 1.2 |
| Configure Software Updates |
|
|
| 1.2.1 | Ensure package manager repositories are configured | always |
|
| 1.2.2 | Ensure GPG keys are configured | always |
| 1.3 |
| Filesystem Integrity Checking |
|
|
| 1.3.1 | Ensure AIDE is installed | always |
|
| 1.3.2 | Ensure filesystem integrity is regularly checked | always |
| 1.4 |
| Secure Boot Settings |
|
|
| 1.4.1 | Ensure permissions on bootloader config are configured | always |
|
| 1.4.2 | Ensure bootloader password is set | Customer to set see below notes |
|
| 1.4.3 | Ensure authentication required for single user mode | always |
| 1.5 |
| Additional Process Hardening |
|
|
| 1.5.1 | Ensure core dumps are restricted | always |
|
| 1.5.2 | Ensure XD/NX support is enabled | always |
|
| 1.5.3 | Ensure address space layout randomization (ASLR) is enabled | always |
|
| 1.5.4 | Ensure prelink is disabled | always |
| 1.6 |
| Mandatory Access Control |
|
|
| 1.6.1.1 | Ensure SELinux is not disabled in bootloader configuration | always |
|
| 1.6.1.2 | Ensure the SELinux state is enforcing | always |
|
| 1.6.1.3 | Ensure SELinux policy is configured | always |
|
| 1.6.1.4 | Ensure no unconfined daemons exist | always |
|
| 1.6.2.1 | Ensure AppArmor is not disabled in bootloader configuration | always |
|
| 1.6.2.2 | Ensure all AppArmor Profiles are enforcing | always |
|
| 1.6.3 | Ensure SELinux or AppArmor are installed | always |
| 1.7 |
| Warning Banners |
|
|
| 1.7.1.1 | Ensure message of the day is configured properly | always |
|
| 1.7.1.2 | Ensure local login warning banner is configured properly | always |
|
| 1.7.1.3 | Ensure remote login warning banner is configured properly | always |
|
| 1.7.1.4 | Ensure permissions on /etc/motd are configured | always |
|
| 1.7.1.5 | Ensure permissions on /etc/issue are configured | always |
|
| 1.7.1.6 | Ensure permissions on /etc/issue.net are configured | always |
|
| 1.7.2 | Ensure GDM login banner is configured | always |
| 1.8 |
| Ensure updates patches and additional security software are installed | Snare Central patches the system with OS and security updates with each new release. |
| ||||
2 |
|
| Services |
|
| 2.1 |
| inetd Services |
|
|
| 2.1.1 | Ensure chargen services are not enabled | always |
|
| 2.1.2 | Ensure daytime services are not enabled | always |
|
| 2.1.3 | Ensure discard services are not enabled | always |
|
| 2.1.4 | Ensure echo services are not enabled | always |
|
| 2.1.5 | Ensure time services are not enabled | always |
|
| 2.1.6 | Ensure rsh server is not enabled | always |
|
| |||