Use Standard Hardening Configuration Templates for Application Infrastructure
Description
Use standard, industry-recommended hardening configuration templates for application infrastructure components. This includes underlying servers, databases, and web servers, and applies to cloud containers, Platform as a Service (PaaS) components, and SaaS components. Do not allow in-house developed software to weaken configuration hardening.
Implementation Checklist
Tool Recommendations
Automated CIS Benchmark assessment tool for configuration compliance scanning across OS, applications, and cloud
Center for Internet Security · CIS SecureSuite membership
Cloud-based configuration assessment and compliance platform with CIS Benchmark support and continuous monitoring
Qualys · Per-asset subscription
Security configuration management and file integrity monitoring platform with policy compliance and drift detection
Fortra (Tripwire) · Per-node subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Default Credentials on Application Infrastructure Components
ConfidentialityAn attacker gains access to a database server or web application platform using default credentials that were never changed because no hardening configuration templates were applied during deployment.
Exploitation of Unnecessary Services on Application Server
IntegrityAn attacker exploits a vulnerability in an unnecessary service running on a web server that was deployed with a default configuration rather than a hardened template.
Cloud Container Running with Excessive Privileges
ConfidentialityA container deployed without a hardening template runs as root with all capabilities enabled, and an attacker exploits a container escape vulnerability to access the underlying host.
Vulnerabilities (When Safeguard Absent)
Application Infrastructure Deployed with Default Configurations
Without hardening templates, application infrastructure including servers, databases, and containers is deployed with default settings that include unnecessary services, default credentials, and excessive permissions.
No Standardized Security Baseline for Application Components
Absence of industry-recommended hardening templates means each deployment may have a different and often insufficient security configuration, creating inconsistent and unpredictable attack surfaces.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Technical | Configuration compliance scan results against approved baseline | Scanned monthly |
| Document | Approved baseline configuration documentation | Reviewed quarterly |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |