Building a Baseline

Question 1

Define “security baselining”

Answer 1

The practice of implementing a minimum set of standards and configuration within your environment.

Question 2

What is the purpose of a security baseline?

Answer 2

Provides a minimum defined standard to ensure a more secure and consistent environment; Helps businesses align with compliance or governance regulations

Question 3

What current products help to create baselines at an enterprise level?

Answer 3

Group Policy Objects (GPOs) and Mobile
Device Management (MDM).

Question 4

What are the different types of devices/systems that can benefit from baselining?

Answer 4

• Network devices (switches, routers, firewalls, and so on)
• Windows systems: servers and clients
• Linux/Unix systems
• Storage/file servers
• Database servers
• Web servers
• Application servers
• Operational Technology (OT)
• Internet of Things (IoT)

Question 5

Before baselines are created, what must be implemented to set the stage for baselines?

Answer 5

Polices, standards, and procedures signed off and enforced by leadership; Without this support, it becomes more difficult to enforce and collectively get behind
security at an organizational level

Question 6

What is the role of polices in a security program?

Answer 6

A security policy is the first level of formalized documentation for your organization’s security program and is mandatory.

Question 7

How do policies differ from standards and procedures?

Answer 7

Policies are very broad and general with no direct tie to the technology or solutions within the organization.

Question 8

What are basic procedures that every business that uses windows devices hvae?

Answer 8

• Security updates
• Encryption
• Firewall
• Password policy, Multi-Factor Authentication (MFA), and biometrics
• Local administrative access strategy
• Security protection tools and antivirus
• Compliance and protection policies
• Data loss prevention and information protection

Question 9

Define a “standard”

Answer 9

Standards define the specifics of a policy and are mandatory; They provide the direction needed to support the policies and specifics on the technology to
be deployed.

Question 10

What are examples of standards used in windows envrionments?

Answer 10

• All Windows servers and end user workstations will be encrypted using BitLocker and/or Azure Disk Encryption.
• A Windows firewall will be enabled and configured on all Windows end-user
  devices and servers. Connection rules will be documented.
• MFA will be required for all users accessing the corporate environment
  and resources.
• There will be no standard user accounts assigned with local admin access on
  any Windows device.

Question 11

Define a “procedure”

Answer 11

Procedures are the step-by-step instructions used to accomplish a repeatable task or process; Intended to achieve a specific goal and assist with
implementing the defined policies and standards.

Question 12

Define a “guideline”

Answer 12

Guidelines provide recommendations or best practices and are not mandatory
requirements.

Question 13

How does a guideline differ from a procedure?

Answer 13

They are complementary controls that
provide guidance where a standard may not apply

Question 14

What is the purpose of a guideline?

Answer 14

Although not mandatory, guidelines provide a lot of value to users to help them to be
more productive with technology.

Question 15

What is best practice for communicating policies, standards, and procedures?

Answer 15

• Insert a section on guidelines in the company newsletters and/or communications.
• Link your guidelines back to a central repository for users to come back and
  access it.
• Keep your guidelines short and to the point.
• Make your guidelines relevant to both professional and personal usage.

Question 16

What is a standard change management flow process?

Answer 16

Submit request -> Review with CAB -> Receive Approval -> Test change -> validate change -> close request

Question 17

Should policies, procedures, standards, and baselines go through a change management flow process?

Answer 17

Yes

Question 18

Define a “security framework”

Answer 18

A security framework is a set of documented standards, policies, procedures, and best practices designed to build a well-defined basis for your
organization’s security program.

Question 19

What is the purpose of a security framework?

Answer 19

To provide a structured approach to architecting security solutions, implementing security controls, and characterizing threats, vulnerabilities, and mitigation tactics intended to enhance an organization’s security and reduce risk.

Question 20

What are common security frameworks?

Answer 20

• International Standards Organization 27000 Family (ISO)
• National Institute of Standards and Technology (NIST)
  
  • NIST SP 800-53: Security and Privacy Controls for Federal Information Systems
    and Organizations
  • NIST SP 800-171: Protecting Controlled Unclassified Information in Nonfederal
    Systems and Organizations
• Health Information Trust Alliance Common Security Framework (HITRUST
  CSF)
• Center for Internet Security (CIS)

Question 21

What are the 5 pillars of National Institute of Standards and Technology (NIST)?

Answer 21

1. Identify
2. Protect
3. Detect
4. Respond
5. Recover

Question 22

Describe Center for Internet Security (CIS) controls framework

Answer 22

CIS Controls are a broader set of 18 foundational and advanced controls that provide a more comprehensive approach to overall security protection.

Question 23

Describe Center for Internet Security (CIS) benchmarch framework

Answer 23

CIS Benchmarks are focused more on the specific hardening of your systems, software, networks, and more.

Question 24

Does Microsoft offer security basslines?

Answer 24

Yes; Windows security baselines from the Microsoft Security Compliance Toolkit (SCT), which provides recommended configurations to harden your Windows systems.
https://www.microsoft.com/en-us/download/details.aspx?id=55319

Question 25

What baselines are apart of the Microsoft Security Compliance Toolkit (SCT)?

Answer 25

* Windows 11 security baselines * Windows 10 security baselines * Windows Server security baselines * Microsoft Office security baselines * Microsoft Edge security baselines * Policy Analyzer and Local Group Policy Object (LGPO) tools

Question 26

Does Intune have built-in baselines?

Answer 26

Yes

Question 27

What are best practices for building baselines?

Answer 27

1. Select and deploy a framework to build a foundation; the NIST Cybersecurity Framework is a great place to start. 2. Select a baseline foundation; we covered CIS, Windows security baselines, and Intune's security baselines. 3. For your Windows devices, use Policy Analyzer from the Microsoft SCT to review your baselines, or use the CIS-CAT Pro tools to review your system configurations against the CIS Benchmarks. 4. Create or use (and re-use) a Golden Image template for each use case and always keep up with the latest updates. CIS has pre-defined hardened images that can be used. 5. Build well-documented and easy-to-follow procedures that others can use and follow. 6. Use automation of controls and tools to reinforce the baseline; MDM with Intune or Active Directory Group Policy as an example. 7. Use compliance policies to validate controls are in place. This will also help with auditing devices that are non-compliant. 8. Implement a quarantine or risk access policy with non-compliant devices.