Skip to content

Commit 44c3ba8

Browse files
rachaelshawnoahtalerman
rachaelshaw
and
noahtalerman
authored
Reduce CIS benchmark documentation page contents (#17108)
+ Move specific CIS benchmark details into READMEs + Reduce content in Using Fleet > CIS Benchmarks --------- Co-authored-by: Noah Talerman <[email protected]>
1 parent 1bb81c9 commit 44c3ba8

File tree

5 files changed

+116
-67
lines changed

5 files changed

+116
-67
lines changed

‎docs/Using Fleet/CIS-Benchmarks.md

+12-67
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,21 @@
11
# CIS Benchmarks
22

3-
> Available in Fleet Premium
3+
_Available in Fleet Premium_.
44

55
## Overview
6+
67
CIS Benchmarks represent the consensus-based effort of cybersecurity experts globally to help you protect your systems against threats more confidently.
78
For more information about CIS Benchmarks check out [Center for Internet Security](https://www.cisecurity.org/cis-benchmarks)'s website.
89

910
Fleet has implemented native support for CIS Benchmarks for the following platforms:
10-
- macOS 13.0 Ventura (96 checks)
11-
- Windows 10 Enterprise (496 checks)
12-
- Windows 11 Enterprise (521 checks)
11+
- macOS 13.0 Ventura
12+
- macOS 14.0 Sonoma
13+
- Windows 10 Enterprise
14+
- Windows 11 Enterprise
1315

1416
[Where possible](#limitations), each CIS Benchmark is implemented with a [policy query](./REST-API.md#policies) in Fleet.
1517

16-
These benchmarks are intended to gauge your organization's security posture, rather than the current state of a given host. A host may fail a CIS Benchmark policy despite having the correct settings enabled if there is not a specific policy in place to enforce that setting. For example, this is the query for **CIS - Ensure FileVault Is Enabled (MDM Required)**:
18+
These benchmarks are intended to gauge your organization's security posture, rather than the current state of a given host. A host may fail a CIS Benchmark policy despite having the correct settings enabled if there is no configuration profile or Group Policy Object (GPO) in place to enforce the setting. For example, this is the query for **CIS - Ensure FileVault Is Enabled (MDM Required)**:
1719

1820
```sql
1921
SELECT 1 WHERE
@@ -88,14 +90,13 @@ fleetctl apply --policies-team "Workstations" -f cis-policy-queries.yml
8890
```
8991

9092
## Limitations
91-
Fleet's current set of benchmarks only implements benchmark *auditing* steps that can be *automated*.
9293

93-
In practice, Fleet is able to cover a large majority of benchmarks:
94-
* macOS 13 Ventura - 96 of 104
95-
* Windows 10 Enterprise - All CIS items (496)
96-
* Windows 11 Enterprise - All CIS items (521)
94+
Certain benchmarks require human action to audit, and cannot be automated by a policy in Fleet. For a list of specific benchmarks which are not covered, please visit the README for each benchmark:
9795

98-
For a list of specific checks which are not covered by Fleet, please visit the section devoted to each benchmark.
96+
- [macOS 13.0 Ventura](https://github.com/fleetdm/fleet/blob/main/ee/cis/macos-13/README.md)
97+
- [macOS 14.0 Sonoma](https://github.com/fleetdm/fleet/blob/main/ee/cis/macos-14/README.md)
98+
- [Windows 10 Enterprise](https://github.com/fleetdm/fleet/blob/main/ee/cis/win-10/README.md)
99+
- [Windows 11 Enterprise](https://github.com/fleetdm/fleet/blob/main/ee/cis/win-11/README.md)
99100

100101
### Audit vs. remediation
101102
Each benchmark has two elements:
@@ -106,18 +107,6 @@ Since Fleetd is currently read-only without the ability to execute actions on th
106107

107108
To implement automated remediation, you can install a separate agent such as Munki, Chef, Puppet, etc. which has write functionality.
108109

109-
### Manual vs. automated
110-
111-
For both the audit and remediation elements of a CIS Benchmark, there are two types:
112-
1. Automated - the element can be audited or remediated without human intervention
113-
2. Manual - the element requires human intervention to be audited or remediated
114-
115-
Fleet only implements automated audit checks. Manual checks require administrators to implement other processes to conduct the check.
116-
117-
* macOS 13 Ventura - 96 of 104 are automated
118-
* Windows 10 Enterprise - All CIS items (496) are automated
119-
* Windows 11 Enterprise - All CIS items (521) are automated
120-
121110

122111
## Levels 1 and 2
123112
CIS designates various benchmarks as Level 1 or Level 2 to describe the level of thoroughness and burden that each benchmark represents.
@@ -137,50 +126,6 @@ This profile extends the "Level 1" profile. Items in this profile exhibit one or
137126
- are intended for environments or use cases where security is paramount or acts as defense in depth measure
138127
- may negatively inhibit the utility or performance of the technology.
139128

140-
## macOS 13.0 Ventura benchmark
141-
142-
Fleet's policies have been written against v1.0 of the benchmark. Please refer to the "CIS Apple macOS 13.0 Ventura Benchmark v1.0.0 - 11-14-2022" PDF from the CIS website for full details.
143-
144-
### Checks that require customer decision
145-
146-
CIS has left the parameters of the following checks up to the benchmark implementer. CIS recommends that an organization make a conscious decision for these benchmarks, but does not make a specific recommendation.
147-
148-
Fleet has provided both an "enabled" and "disabled" version of these benchmarks. When both policies are added, at least one will fail. Once your organization has made a decision, you can delete one or the other policy query.
149-
The policy will be appended with a `-enabled` or `-disabled` label, such as `2.1.1.1-enabled`.
150-
151-
- 2.1.1.1 Audit iCloud Keychain
152-
- 2.1.1.2 Audit iCloud Drive
153-
- 2.5.1 Audit Siri
154-
- 2.8.1 Audit Universal Control
155-
156-
Furthermore, CIS has decided to not require the following password complexity settings:
157-
- 5.2.3 Ensure Complex Password Must Contain Alphabetic Characters Is Configured
158-
- 5.2.4 Ensure Complex Password Must Contain Numeric Character Is Configured
159-
- 5.2.5 Ensure Complex Password Must Contain Special Character Is Configured
160-
- 5.2.6 Ensure Complex Password Must Contain Uppercase and Lowercase Characters Is Configured
161-
162-
However, Fleet has provided these as policies. If your organization declines to implement these, simply delete the corresponding policy.
163-
164-
### macOS 13.0 Ventura manual checks
165-
166-
The following CIS benchmark checks cannot be automated and must be addressed manually:
167-
- 2.1.2 Audit App Store Password Settings
168-
- 2.3.3.12 Ensure Computer Name Does Not Contain PII or Protected Organizational Information
169-
- 2.6.6 Audit Lockdown Mode
170-
- 2.11.2 Audit Touch ID and Wallet & Apple Pay Settings
171-
- 2.13.1 Audit Passwords System Preference Setting
172-
- 2.14.1 Audit Notification & Focus Settings
173-
- 3.7 Audit Software Inventory
174-
- 6.2.1 Ensure Protect Mail Activity in Mail Is Enabled
175-
176-
## Windows 10 & 11 Enterprise benchmarks
177-
178-
Fleet's policies have been written against v2.0.0 of the benchmarks. You can refer to the [CIS website](https://www.cisecurity.org/cis-benchmarks) for full details about this version.
179-
180-
### Checks that require a Group Policy template
181-
182-
Several items require Group Policy templates in place in order to audit them.
183-
These items are tagged with the label `CIS_group_policy_template_required` in the YAML file, and details about the required Group Policy templates can be found in each item's `resolution`.
184129

185130
## Performance testing
186131
In August 2023, we completed scale testing on 10k Windows hosts and 70k macOS hosts. Ultimately, we validated both server and host performance at that scale.

‎ee/cis/macos-13/README.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# macOS 13.0 Ventura benchmark
2+
3+
Fleet's policies have been written against v1.0 of the benchmark. You can refer to the [CIS website](https://www.cisecurity.org/cis-benchmarks) for full details about this version.
4+
5+
For requirements and usage details, see the [CIS Benchmarks](https://fleetdm.com/docs/using-fleet/cis-benchmarks) documentation.
6+
7+
### Limitations
8+
9+
The following CIS benchmarks cannot be checked with a policy in Fleet:
10+
1. 2.1.2 Audit App Store Password Settings
11+
2. 2.3.3.12 Ensure Computer Name Does Not Contain PII or Protected Organizational Information
12+
3. 2.6.6 Audit Lockdown Mode
13+
4. 2.11.2 Audit Touch ID and Wallet & Apple Pay Settings
14+
5. 2.13.1 Audit Passwords System Preference Setting
15+
6. 2.14.1 Audit Notification & Focus Settings
16+
7. 3.7 Audit Software Inventory
17+
8. 6.2.1 Ensure Protect Mail Activity in Mail Is Enabled
18+
19+
### Checks that require decision
20+
21+
CIS has left the parameters of the following checks up to the benchmark implementer. CIS recommends that an organization make a conscious decision for these benchmarks, but does not make a specific recommendation.
22+
23+
Fleet has provided both an "enabled" and "disabled" version of these benchmarks. When both policies are added, at least one will fail. Once your organization has made a decision, you can delete one or the other policy query.
24+
The policy will be appended with a `-enabled` or `-disabled` label, such as `2.1.1.1-enabled`.
25+
26+
- 2.1.1.1 Audit iCloud Keychain
27+
- 2.1.1.2 Audit iCloud Drive
28+
- 2.5.1 Audit Siri
29+
- 2.8.1 Audit Universal Control
30+
31+
Furthermore, CIS has decided to not require the following password complexity settings:
32+
- 5.2.3 Ensure Complex Password Must Contain Alphabetic Characters Is Configured
33+
- 5.2.4 Ensure Complex Password Must Contain Numeric Character Is Configured
34+
- 5.2.5 Ensure Complex Password Must Contain Special Character Is Configured
35+
- 5.2.6 Ensure Complex Password Must Contain Uppercase and Lowercase Characters Is Configured
36+
37+
However, Fleet has provided these as policies. If your organization declines to implement these, simply delete the corresponding policies.

‎ee/cis/macos-14/README.md

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# macOS 14.0 Sonoma benchmark
2+
3+
Fleet's policies have been written against v1.0 of the benchmark. You can refer to the [CIS website](https://www.cisecurity.org/cis-benchmarks) for full details about this version.
4+
5+
For requirements and usage details, see the [CIS Benchmarks](https://fleetdm.com/docs/using-fleet/cis-benchmarks) documentation.
6+
7+
### Limitations
8+
9+
The following CIS benchmarks cannot be checked with a policy in Fleet:
10+
1. 2.1.2 Audit App Store Password Settings
11+
2. 2.3.3.12 Ensure Computer Name Does Not Contain PII or Protected Organizational Information
12+
3. 2.6.6 Audit Lockdown Mode
13+
4. 2.11.2 Audit Touch ID and Wallet & Apple Pay Settings
14+
5. 2.13.1 Audit Passwords System Preference Setting
15+
6. 2.14.1 Audit Notification & Focus Settings
16+
7. 3.7 Audit Software Inventory
17+
8. 6.2.1 Ensure Protect Mail Activity in Mail Is Enabled
18+
19+
### Checks that require decision
20+
21+
CIS has left the parameters of the following checks up to the benchmark implementer. CIS recommends that an organization make a conscious decision for these benchmarks, but does not make a specific recommendation.
22+
23+
Fleet has provided both an "enabled" and "disabled" version of these benchmarks. When both policies are added, at least one will fail. Once your organization has made a decision, you can delete one or the other policy query.
24+
The policy will be appended with a `-enabled` or `-disabled` label, such as `2.1.1.1-enabled`.
25+
26+
- 2.1.1.1 Audit iCloud Keychain
27+
- 2.1.1.2 Audit iCloud Drive
28+
- 2.5.1 Audit Siri
29+
- 2.8.1 Audit Universal Control
30+
31+
Furthermore, CIS has decided to not require the following password complexity settings:
32+
- 5.2.3 Ensure Complex Password Must Contain Alphabetic Characters Is Configured
33+
- 5.2.4 Ensure Complex Password Must Contain Numeric Character Is Configured
34+
- 5.2.5 Ensure Complex Password Must Contain Special Character Is Configured
35+
- 5.2.6 Ensure Complex Password Must Contain Uppercase and Lowercase Characters Is Configured
36+
37+
However, Fleet has provided these as policies. If your organization declines to implement these, simply delete the corresponding policies.

‎ee/cis/win-10/README.md

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Windows 10 Enterprise benchmarks
2+
3+
Fleet's policies have been written against v2.0.0 of the benchmark. You can refer to the [CIS website](https://www.cisecurity.org/cis-benchmarks) for full details about this version.
4+
5+
For requirements and usage details, see the [CIS Benchmarks](https://fleetdm.com/docs/using-fleet/cis-benchmarks) documentation.
6+
7+
### Limitations
8+
9+
> None. All items in this version of the benchmark are able to be automated.
10+
11+
12+
### Checks that require a Group Policy template
13+
14+
Several items require Group Policy templates in place in order to audit them.
15+
These items are tagged with the label `CIS_group_policy_template_required` in the YAML file, and details about the required Group Policy templates can be found in each item's `resolution`.

‎ee/cis/win-11/README.md

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Windows 11 Enterprise benchmarks
2+
3+
Fleet's policies have been written against v2.0.0 of the benchmark. You can refer to the [CIS website](https://www.cisecurity.org/cis-benchmarks) for full details about this version.
4+
5+
For requirements and usage details, see the [CIS Benchmarks](https://fleetdm.com/docs/using-fleet/cis-benchmarks) documentation.
6+
7+
### Limitations
8+
9+
> None. All items in this version of the benchmark are able to be automated.
10+
11+
12+
### Checks that require a Group Policy template
13+
14+
Several items require Group Policy templates in place in order to audit them.
15+
These items are tagged with the label `CIS_group_policy_template_required` in the YAML file, and details about the required Group Policy templates can be found in each item's `resolution`.

0 commit comments

Comments
 (0)