Chapter 2 — Writing a hardening standard | Professional Systems, endpoints and hardware security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 2 — Writing a hardening standard

Lesson map

Lesson 02 published. Map, example, EX006.

flowchart TD
  N0["Learning outcomes"]
  N1["2.1 Choosing references"]
  N2["2.2 Tailoring"]
  N3["2.3 Structure"]
  N4["2.4 Approval"]
  N5["Versioning the standard"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX006"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["2.1 Choosing references"]
  N2["2.2 Tailoring"]
  N3["2.3 Structure"]
  N4["2.4 Approval"]
  N5["Versioning the standard"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX006"]

[Learning outcomes]
    |
    v
[2.1 Choosing references]
    |
    v
[2.2 Tailoring]
    |
    v
[2.3 Structure]
    |
    v
[2.4 Approval]
    |
    v
[Versioning the standard]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX006]

Learning outcomes

You will (1) choose reference baselines; (2) tailor them; (3) get approval.

2.1 Choosing references

Seun bases the standard on the CIS Benchmarks for each operating system, the Microsoft security baselines for Windows and the DISA STIGs as a reference for servers where stricter settings are justified. Using recognised references saves time and gives auditors confidence, because the settings have been reviewed widely. References also speed tailoring discussions: when a team objects to a setting, Seun can show the benchmark's reason before deciding. The standard names the benchmark version used for each operating system, so later reviews know which edition the settings came from and can compare it with newer releases.

2.2 Tailoring

Not every benchmark item suits Marlowe. Warehouse PCs are shared by shift workers and must stay signed in to the warehouse system during a shift; a short screen lock would stop work. The standard sets a longer timeout for those PCs, with compensating controls: a kiosk-style restricted desktop and physical placement in supervised areas. Every tailored item records its reason. Tailoring stops staff working around the standard, which is a common way baselines fail in practice. Seun agrees each tailored item with the warehouse managers, and the reason is reviewed when the standard is.

2.3 Structure

The standard has a short policy section, then one appendix per device group listing required settings, the reference item and any tailoring. CIS Controls v8 Safeguard 4.1 asks for a documented secure configuration process; the standard includes how settings are changed and reviewed. One appendix per device group lets each team find its own settings without reading the whole standard. The change process says who may propose a change, who reviews it against the references, and who approves it, so the standard can evolve without becoming a list of undocumented exceptions. Every approved change is recorded with its date and reason.

2.4 Approval

The operations director approves the standard after a thirty-minute walkthrough. Approval matters because it makes the standard the company's decision, not IT's preference. Seun uses the walkthrough to explain what the standard requires of each device group, which settings were tailored and why, and how compliance will be measured each month. The director's questions focus on the warehouse: whether the longer screen lock is safe and whether shift changes will slow down. The signed approval becomes the first document in the evidence pack, and the standard's next review date is set at the same meeting, a year after approval.

Versioning the standard

A hardening standard is not written once. CIS Benchmarks are revised, Windows and Linux versions change, and Marlowe's own needs shift. The standard therefore carries a version number and a change history listing what changed, why and who approved it. When a benchmark is updated or a new operating system version arrives, Seun reviews the differences, decides which matter for Marlowe and issues a new version after approval. Devices are measured against the current version, and every monthly report states which version it used. Without this, a fall in compliance could simply mean the standard changed, not that devices got worse.

Worked example

The laptop appendix lists 42 settings: 38 taken directly from the CIS Benchmark level one, four tailored with reasons, such as allowing a specific USB barcode printer driver.

Synthetic case. The standard is synthetic.

Errors and limits

Copying a benchmark wholesale without tailoring produces a standard nobody can meet, which becomes a second audit finding.

Exercises

EX006 — Reference choice. Why base a standard on recognised references? Rubric: 3 = reviewed widely, auditor confidence, saves time;; 2 = saves time;; 1 = vague;; 0 = none.
EX007 — Tailoring record. What must each tailored item record? Rubric: 3 = reason and compensating control;; 2 = reason;; 1 = vague;; 0 = none.
EX008 — Warehouse tailoring. Describe the warehouse PC screen-lock tailoring and its compensations. Rubric: 3 = longer timeout, kiosk desktop, supervised location;; 2 = longer timeout;; 1 = vague;; 0 = none.
EX009 — CIS safeguard. Which CIS safeguard asks for a secure configuration process? Rubric: 3 = 4.1;; 2 = Control 4;; 1 = wrong;; 0 = none.
EX010 — Approval value. Why should the operations director approve the standard? Rubric: 3 = business ownership;; 2 = authority;; 1 = vague;; 0 = none.

Synthesis

A tailored, approved standard based on recognised references is the core evidence auditors look for.

Continue studying — chapter 02 of 12

← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →