Chapter 28 — Information security: implementation I
Lesson map
Lesson 28 published. Map, example, EX082.
flowchart TD
N0["Learning outcomes"]
N1["28.1 Baselines"]
N2["28.2 The baseline lab"]
N3["Lab — Checking 300 synthetic server configurations a"]
N4["28.3 Prioritising remediation"]
N5["28.4 Keeping compliance"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX082"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["28.1 Baselines"]
N2["28.2 The baseline lab"]
N3["Lab — Checking 300 synthetic server configurations a"]
N4["28.3 Prioritising remediation"]
N5["28.4 Keeping compliance"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX082"]
[Learning outcomes]
|
v
[28.1 Baselines]
|
v
[28.2 The baseline lab]
|
v
[Lab — Checking 300 synthetic server configurations a]
|
v
[28.3 Prioritising remediation]
|
v
[28.4 Keeping compliance]
|
v
[Worked example] --> [Exercise EX082]
Learning outcomes
You will (1) implement configuration baselines; (2) measure compliance automatically; (3) prioritise remediation from results.
28.1 Baselines
Lindiwe turns the hardening checklist from earlier into a baseline that can be checked automatically. She chooses three rules for the first version: remote root login disabled, security patches no older than thirty days and disks encrypted. Each rule is written so a script can read the configuration and return pass or fail. Prof. Hale advises starting with a few rules that matter rather than hundreds that overwhelm the teams receiving the results. The server teams review the three rules before the first run.
28.2 The baseline lab
The lab checks a synthetic set of 300 servers. Remote root login is disabled on 278 servers, 92.7 percent. Patches are no older than thirty days on 253, 84.3 percent. Disks are encrypted on 277, 92.3 percent. Only 216 servers, 72.0 percent, pass all three rules. Lindiwe notes that each rule alone looks fairly good, but the combined figure shows that more than a quarter of servers fail at least one requirement. She shares the results with each server team, along with the list of its failing servers, so the teams can begin work immediately rather than waiting for a formal report.
Lab — Checking 300 synthetic server configurations against three baseline rules
"""Check synthetic server configurations against three hardening baseline rules (stdlib only)."""
import random
random.seed(29)
servers = []
for i in range(300):
servers.append({
"ssh_root_login": random.random() < 0.06, # True = permitted (fail)
"patch_age_days": int(random.expovariate(1/18)),
"disk_encrypted": random.random() < 0.93,
})
r1 = sum(not s["ssh_root_login"] for s in servers)
r2 = sum(s["patch_age_days"] <= 30 for s in servers)
r3 = sum(s["disk_encrypted"] for s in servers)
allp = sum((not s["ssh_root_login"]) and s["patch_age_days"] <= 30 and s["disk_encrypted"] for s in servers)
n = len(servers)
print(f"root login disabled {r1}/{n} ({r1/n:.1%}); patched within 30 days {r2}/{n} ({r2/n:.1%}); disk encrypted {r3}/{n} ({r3/n:.1%})")
print(f"all three rules {allp}/{n} ({allp/n:.1%})")
Run with python3 lab_baseline.py. Verified output:
root login disabled 278/300 (92.7%); patched within 30 days 253/300 (84.3%); disk encrypted 277/300 (92.3%)
all three rules 216/300 (72.0%)
28.3 Prioritising remediation
Lindiwe sorts failures by server category. Servers in high-impact systems such as payroll come first, then those exposed to the internet. Within each group, she fixes the quickest items first: disabling root login takes minutes, while encrypting an existing disk requires downtime. Prof. Hale notes that combining impact with effort produces a plan teams can follow week by week, instead of a single large list that discourages action. The teams agree to close all root login failures within a week and to plan encryption over the next quarter.
28.4 Keeping compliance
Compliance measured once decays. Lindiwe schedules the check to run weekly and report the percentage passing all rules, broken down by team. She adds new rules gradually, each announced in advance. Teams can see their own trend. She learns that automated, repeated measurement turns a baseline from a document into an operating control, and that transparency about each team's results encourages improvement without needing a formal audit. After three months, she plans to compare each team's trend with the starting figure of 72.0 percent and report progress to the security lead.
Worked example
Lindiwe implements three baseline rules, finds 72.0 percent of 300 servers pass all three, prioritises by impact and effort and schedules weekly checks.
Synthetic case. Servers are synthetic; outputs come from lab_baseline.py.
Errors and limits
Reporting each rule alone can hide how many servers fail at least one.
Exercises
- EX082 — Root login rate. What share has remote root login disabled? Rubric: 3 = 278, 92.7 percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX083 — Patch rate. What share is patched within thirty days? Rubric: 3 = 253, 84.3 percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX084 — All three. How many servers pass all three rules? Rubric: 3 = 216, 72.0 percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
Continue studying — lesson 28 (chapter 28 of 50)
← Chapter 27 · Course chapter index · Chapter 29 →
Continue to the next authored lesson.