Activity 1.3: CIS Benchmark and STIG Review

This activity gives you practice with two widely recognized resources for system hardening: CIS benchmarks and STIGs. These documents provide detailed guidelines for securing systems by implementing industry best practices and government standards. By reviewing and comparing them, you’ll gain hands-on experience of analyzing security settings, assessing their organizational impact, and understanding how different frameworks present and enforce security controls.

Follow these steps to explore key security settings, analyze their applicability, and compare the presentation of information in CIS benchmarks and STIGs:

1. Visit https://www.cisecurity.org/cis-benchmarks and navigate to Operating Systems | Microsoft Windows Server | DOWNLOAD THE BENCHMARK. You will have to register to be able to complete the download.
2. Access your email and you will receive a link to download the applicable benchmark. Choose the Windows Server 2022 benchmark to use in the following steps. You can use any benchmark you want to explore on your own, but the rest of the steps here are specific to the Windows Server 2022 benchmark. Explore the settings for section 1.1 Password Policy on pages 29–44 in the document. Note that the PDF pages may not exactly match the document pages. While reviewing these settings consider these questions:
   • Do these settings fit within your environment?
   • If these settings were to be turned on enterprise-wide, would there be any concern of adverse impact?
   • If there is a concern for impact, what steps would be best to follow for those specific settings?

   Another specific setting to explore is 2.3.7.3 Interactive logon: Machine inactivity limit on page 188. Bearing in mind where this benchmark would be applied, answer the same questions.

   Continue to practice reviewing this benchmark and others of interest and see what kind of common items you see. Remember, it may not always be best for every organization to implement every item exactly as written.

3. STIGs provided by the DoD can also provide this type of system hardening guidance but require some additional steps. They must be opened via a STIG Viewer tool as they are in an XCCDF format. Navigate to https://public.cyber.mil/stigs/srg-stig-tools/ and download the STIG Viewer compatible with your system and install it. If you get the MSI package, select More Info and Run Anyway to get the installation to work.
4. Navigate to https://public.cyber.mil/stigs/downloads/ on the right-hand filter, choose operating systems, then select the plus sign to choose Windows. Find Windows Server 2022 STIG and download it.
5. These files are typically found in compressed format, so you will have to unzip them first. You will see a .xml file and many other files. These other files help explain some details about STIG itself. Open the STIG Viewer you installed. Click to open STIG and navigate to the .xml file and open it.
6. Take some time to explore the interface. In the top left, next to STIG Rules, you will see a gear icon and a filter icon. Click on the filter icon, which will allow ways to search through the STIG, and input interactive login. Choose V-254456 from the filtered list. Explore these details and compare what you saw in step 4 from the CIS benchmark.

Continue practicing looking through a STIG and notice the differences in how information is presented when compared to CIS benchmarks.