Comparing Security Baselines
So I have done a fair share of googling on this and haven't found any good resources so I wanted to ask the greater sysadmin community here. Are there any resources for comparing the settings between various security baselines? For example showing all of the…
So I have done a fair share of googling on this and haven't found any good resources so I wanted to ask the greater sysadmin community here. Are there any resources for comparing the settings between various security baselines? For example showing all of the settings in the Microsoft Baseline from their security tool and then showing the matching and or missing settings that are in the CIS Benchmarks? I know there is definitely overlap between them but havent found a good resource to see the overlap and the deficiencies between them. Obviously ability to compare against other standards would also be good but those are the two main ones I am concerned about.
已收录讨论
I recommend you start by researching Open Vulnerability and Assessment Language (OVAL). There are several JAVA and Python scanners that leverage the OVAL XML files that CIS and Others create. The best thing about OVAL based scans is that you can customize them for almost anything you want once you get started.
For the actual settings diff, the tool built for this is Policy Analyzer, part of Microsoft's Security Compliance Toolkit (free download). It compares multiple sets of GPOs against each other, or against your current local policy, and flags where they differ and where they conflict. Add the Microsoft baseline's GPO backup folders and a CIS baseline's, and it builds the side-by-side comparison for you. The catch is getting CIS into it. Policy Analyzer ships with Microsoft's own baselines, but CIS's machine-readable content (Build Kit GPOs, SCAP/OVAL) is a CIS SecureSuite membership benefit. The free CIS Benchmark is just a PDF, so without membership you're translating the settings you care about into a GPO by hand before you can diff them. Tedious but doable for the sections that matter. The OVAL/SCAP route someone mentioned is real but answers a different question. CIS-CAT, OpenSCAP, and SCC evaluate whether a live box is compliant with a benchmark (pass/fail per setting on that machine), not how two baseline documents differ from each other. Good complement, not the crosswalk you're after. There are community writeups comparing MS vs CIS (HotCakeX's Harden-Windows-Security wiki has one), but they go stale fast since both baselines revise most Windows releases. Realistically you generate your own diff for the exact versions you're targeting. There's no clean canonical table because the two genuinely diverge: CIS is generally stricter, covers more settings, and they occasionally conflict outright, which is probably why your googling came up empty. Disclosure: I build TridentStack Control, which does continuous per-endpoint compliance checking against a chosen baseline (CIS-style), not the document-to-document diff you're after. So it's adjacent here, not an answer. For the crosswalk itself, Policy Analyzer is what I'd reach for.
May have different resources for more granular tools if your an Enterprise Admin, but love CloudCapsule.io for this in my SMB cloud environments.
There is a hardening tool called Enforce Administrator. It can harden your environment and show you differences between various orgs (msft, cis, bsi, cisa, …h