Control 3 – Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers

Control 3 builds on the previous two controls, Inventory of Authorized and Unauthorized Devices
and Inventory of Authorized and Unauthorized Software.

The intent of this control is to develop secure configurations for your systems and montior for any deviation from this standard. To implement this control, you must invest in some manual work in making configuration standards and then regular and automated comparison to these standards using readily available tools.

The real work in this control starts by reviewing configuration guides from several expert sources. These resources have detailed guides that explain the security considerations of each setting. It is a considerable amount of effort to review these documents in detail, however going through this process will help you better understand your system settings. It will also undoubtedly make you more aware of the importance better protecting your systems from attackers.

Guides that will help:

• The Center for Internet Security has hardening guides.
• Apple Mac OS X Security configuration guides.
• NSA security configuration guides.

Tools that will help:

• Microsoft Baseline Security Analyzer (MBSA).
• MBSA Scripting Samples.
• Tenable Nessus config baseline scans are an excellent way to know if changes to the standard configuration are made.
• Windows Server Update Services (WSUS) with daily status reports
• Microsoft Security Compliance Manager.