Configuration assessment: misconfigurations, CIS Benchmarks and hardening

Why configuration matters

Software can be fully patched and still be unsafe. A server with a default admin password, a remote access tool someone installed for convenience or a forgotten test website is a misconfiguration, not a missing patch. Attackers look for these because they are common and easy to use. Configuration assessment, sometimes called security configuration management, finds these weaknesses in a structured way.

Secure baselines and the CIS Benchmarks

A baseline is the agreed list of secure settings for a type of system. Rather than inventing your own, most organisations start from a published one. The CIS Benchmarks from the Center for Internet Security are free, consensus-based guides for operating systems, cloud platforms, browsers, databases and network devices. Microsoft, Apple and many network vendors also publish security baselines. Benchmarks usually have levels: Level 1 settings are safe almost everywhere, while Level 2 settings give stronger protection but may affect some functions.

You will not apply every recommendation. Some break business applications, so record each exception, its reason and any compensating control.

What an assessment looks for

• Accounts: default or shared credentials, unused accounts, too many administrators.
• Services and ports: listening services nobody can explain, old protocols such as SMBv1 and Telnet, management pages exposed widely.
• Encryption: outdated TLS versions, weak ciphers, unencrypted disks on laptops.
• Software: end-of-life products, unapproved remote access or file-sharing tools, browser extensions with excessive rights.
• Web servers: directory listing, sample pages, verbose error messages and missing security headers.
• Logging: audit logs turned off or kept too briefly to help an investigation.

Many vulnerability management products include configuration checks, and operating systems provide their own tools. For hands-on practice see Windows hardening and Linux hardening.

Network devices and cloud

Switches, routers, firewalls and cloud accounts need the same attention as servers. Typical findings on network devices are Telnet or HTTP management left on, SNMP with default community strings and no logging to a central server. In cloud accounts they are public storage, missing MFA on admin users and logging turned off. Many CIS Benchmarks and vendor guides cover these too, and cloud providers offer built-in tools that score accounts against them.

Stopping drift

A system that passes today may fail next month after an urgent change or a new software install. This is configuration drift. Prevent it by building new systems from hardened templates, enforcing settings with Group Policy, Intune, configuration management tools or infrastructure as code, and rescanning regularly. Treat any new open port or new admin account as something to explain, not ignore.

Real-world example: a chain of pharmacies

A fictional chain of ten pharmacies runs its first configuration assessment against the CIS Benchmark for its Windows PCs. The results show SMBv1 enabled on every till PC, local admin rights for all staff and a free remote support tool installed in three shops by a former contractor. Working with the till software vendor, the IT team confirms SMBv1 is not needed and turns it off by policy, removes local admin rights, uninstalls the remote tool and blocks it through application control. The next monthly scan shows one shop has drifted back after a PC was replaced, so the team adds the hardened image to the replacement process.