Haxoris Wiki

Unhardened System Baselines

How Unhardened System Baselines works

An unhardened baseline is a host built without an enforced security benchmark, so its settings are whatever the installer or a one-off clone left behind. It lives on every workstation and server that no golden image, GPO, Ansible run or Intune policy reconciles.

The attacker gains a predictable weak spot - a permissive registry key, an enabled legacy protocol, a missing audit policy - present on many hosts at once because the same flawed build was cloned. It is easy to miss because the machine passes patching and antivirus checks: nothing is broken or out of date, the state simply never matched a documented standard. Without drift detection, two hosts that should be byte-identical quietly diverge and no one is measuring the gap.

Unhardened System Baselines in practice

Scan a Windows host against a named benchmark

Establish the ground truth first: run a recognised benchmark tool so findings map to specific CIS or STIG control IDs rather than opinion.

# Microsoft Security Compliance Toolkit - PolicyAnalyzer / GPO baseline compare
# Export the host's effective policy, then diff against the baseline GPO backup.
secedit /export /cfg C:\Temp\effective.inf
# Or run the CIS-CAT Pro assessor against the Windows benchmark:
& 'C:\CIS-CAT\Assessor-CLI.bat' -b 'benchmarks\CIS_Microsoft_Windows_Server_2022.xml' `
  -rp host-effective -x -html -nts

Scan a Linux host against a named benchmark

Same idea on Linux: use an OpenSCAP profile so each failed rule carries an XCCDF ID you can cite and re-test.

# RHEL/derivative CIS profile via OpenSCAP; read-only assessment, HTML + ARF report
oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis \
  --results-arf arf.xml --report host01.lab.internal.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

Sample a fleet for variance on one pinned setting

Two hosts that should be identical are the real evidence. Pull one baseline-pinned key from a sample and show the spread.

# Fleet sample: SMBv1 client state across ten hosts that share a role and image.
for h in web0{1..5}.lab.internal db0{1..5}.lab.internal; do
  printf '%s ' "$h"
  ssh svc@"$h" 'sysctl -n net.ipv4.tcp_syncookies 2>/dev/null || echo NA'
done
# On Windows sample the same idea over WinRM:
# Invoke-Command -ComputerName $hosts { (Get-SmbServerConfiguration).EnableSMB1Protocol }

Read enforced state against the documented baseline

Prove whether the divergence is drift or design by reading what the management plane claims to enforce, then comparing to the scan.

Baseline says: EnableSMB1Protocol = False (CIS 2.3.x, enforced by GPO "SRV-Hardening")

  web01  GPO applied, key False      -> compliant
  web03  GPO applied, key True       -> drift: local override after last gpupdate
  db02   GPO not in gpresult output  -> gap: host outside the OU the policy targets
  db04   no GPO, no Ansible role      -> unmanaged: baseline never applied

Any row past the first is a finding: the image was never golden, or nothing reconciles it.

How to fix and prevent Unhardened System Baselines

  1. Adopt one named benchmark per platform
    • Pick a CIS or STIG level per OS and role and record it as the authoritative target, so compliance is measurable rather than subjective.
  2. Build every host from a versioned golden image
    • Bake the hardened state into the image and stamp it with a build version, so a host’s baseline is known from its provenance.
  3. Reconcile with configuration management on a cycle
    • Enforce the settings through GPO, DSC, Ansible or Intune on a fixed schedule so a drifted host is corrected, not just reported.
  4. Diff benchmark scans between runs
    • Store each scheduled scan and compare to the previous one; treat a newly failing control on an unchanged host as an incident.
  5. Alert on management-plane gaps
    • Flag hosts absent from the target OU or inventory so an unmanaged machine cannot sit outside every policy unnoticed.

Last updated

References