Operating System Hardening Review

Flow chart of the Operating System Hardening Review engagement, 6 phases in order, each one selectable. Phase 1, Scoping and Baseline Selection. We choose representative hosts by role and operating system, then select the matching CIS Benchmark and STIG profile for each build. Activities: Inventory host roles, OS versions and golden image lineage; Pick representative hosts per build and role; Select the CIS Benchmark level and STIG profile per build; Agree scan windows with the platform team. Hands over Host Sample and Baseline Selection. Phase 2, Evidence and Config Collection. We gather configuration with agent-based and agentless checks, capturing policy, services, accounts, logging and file permissions as evidence. Activities: Export local and domain security policy from Windows hosts; Capture running services, open ports and installed packages; Collect local account, sudoers and password policy settings; Record file permissions on system and application directories. Hands over Per-Host Configuration Evidence Set. Phase 3, Benchmark Comparison. We run CIS-CAT Pro, Lynis and OpenSCAP against each host and map results to the relevant CIS and STIG controls. Activities: Run CIS-CAT Pro against Windows and Linux samples; Run Lynis and OpenSCAP for supplementary Linux coverage; Map each failed check to its CIS and STIG control ID; Score each build against its benchmark level. Hands over Benchmark Scorecard Per Build. Phase 4, Manual Review of Risky Settings. We review the settings that carry real weight, checking for weak authentication, unnecessary services, and gaps in audit logging that scanners can misjudge. Activities: Check password, lockout and Kerberos policy against the baseline; Identify unnecessary services and legacy protocols still enabled; Review auditd and Sysmon coverage against the events you need; Test whether local administrator passwords are unique per host. Hands over Validated High-Impact Settings Review. Phase 5, Prioritised Findings. Findings are ranked by exposure and grouped by build, so your team can harden the golden image once rather than patching hosts one by one. Activities: Rank each failed control by exploitability and reach; Group findings by golden image rather than by host; Flag settings likely to break applications if changed; Sequence fixes into image changes and runtime changes. Hands over OS Configuration Findings Report. Phase 6, Remediation and Re-Check. We supply hardening guidance and sample Ansible or Group Policy, then re-scan to confirm the scorecard has improved. Activities: Write hardening steps with the setting name and safe value; Provide sample Ansible roles and Group Policy objects; Advise on staged rollout and rollback for risky settings; Re-scan the hardened image and reissue the scorecard. Hands over Hardening Runbook and Re-Check Report. Each phase begins from the artefact the phase before it produced.