Secure Baselines
Establishing standard secure configurations for systems through configuration benchmarks, baseline creation, and ongoing maintenance. Understanding CIS benchmarks, STIGs, and configuration drift management.
Understanding Secure Baselines
Secure baselines define the standard security configuration for systems before deployment. Without baselines, every system is configured differently, creating inconsistent security and management challenges.
Key baseline concepts: • Baseline definition — Standard secure configuration • Configuration benchmarks — Industry standards (CIS, STIG) • Baseline enforcement — Ensuring compliance • Drift detection — Identifying configuration changes
The 2017 Equifax breach exploited an unpatched Apache Struts server. A proper baseline management program would have identified the system as non-compliant with patch requirements, potentially preventing the breach that exposed 147 million records.
Secure baselines provide consistent, repeatable, auditable security configurations.
Why This Matters for the Exam
Secure baselines are heavily tested on SY0-701 because they're fundamental to enterprise security. Questions cover baseline sources, implementation, and drift management.
Understanding baselines helps with compliance, vulnerability management, and incident response. Consistent configurations make security manageable at scale.
The exam tests recognition of baseline standards and practical implementation approaches.
Deep Dive
What Is a Secure Baseline?
A secure baseline is a documented, tested, standard configuration that meets security requirements.
Baseline Components:
| Component | Description |
|---|---|
| OS settings | Services, permissions, registry |
| Application config | Default settings, features |
| Security controls | Firewall rules, AV settings |
| Network settings | Protocols, ports, services |
| User settings | Policies, restrictions |
Baseline Example:
Windows Server 2022 Baseline: - Disable SMBv1 - Enable Windows Firewall - Configure audit logging - Disable unused services - Set password policy - Enable BitLocker - Configure Windows Update - Remove default accounts
What Are CIS Benchmarks?
Center for Internet Security (CIS) Benchmarks are consensus-based security configuration guides.
CIS Benchmark Characteristics:
| Aspect | Detail |
|---|---|
| Source | Non-profit, community-developed |
| Coverage | 100+ technology platforms |
| Levels | Level 1 (basic), Level 2 (strict) |
| Format | PDF guides, automated tools |
| Cost | Free for basic, paid for tools |
CIS Benchmark Levels:
Level 1: - Basic security - Minimal performance impact - Broad applicability - Starting point for most organizations Level 2: - Defense in depth - May impact functionality - Higher security environments - May require testing
CIS Benchmark Categories:
| Category | Examples |
|---|---|
| Operating Systems | Windows, Linux, macOS |
| Cloud | AWS, Azure, GCP |
| Network | Cisco, Palo Alto, Juniper |
| Applications | Microsoft 365, Kubernetes |
| Mobile | iOS, Android |
What Are STIGs?
Security Technical Implementation Guides (STIGs) are DoD security configuration standards.
STIG Characteristics:
| Aspect | Detail |
|---|---|
| Source | DISA (Defense Information Systems Agency) |
| Requirement | Mandatory for DoD systems |
| Severity | CAT I (High), CAT II (Medium), CAT III (Low) |
| Updates | Quarterly releases |
| Scope | Very detailed, specific settings |
STIG Categories:
CAT I - High Severity: - Direct path to exploitation - Must be addressed immediately - System cannot deploy with CAT I open CAT II - Medium Severity: - Potential for exploitation - Should be addressed promptly - May require mitigation plan CAT III - Low Severity: - Minimal direct risk - Best practice items - Address when feasible
How Do You Create a Baseline?
Baseline Creation Process:
| Step | Activity |
|---|---|
| 1. Select standard | CIS, STIG, vendor guide |
| 2. Customize | Adjust for environment |
| 3. Document | Record all settings |
| 4. Test | Validate in lab |
| 5. Approve | Get management sign-off |
| 6. Deploy | Roll out to systems |
| 7. Monitor | Check for drift |
Baseline Documentation:
For each setting: - Setting name and location - Configured value - Justification - Exception process - Testing results - Responsible owner
What Is Configuration Drift?
Configuration drift occurs when systems deviate from their baseline over time.
Drift Causes:
| Cause | Example |
|---|---|
| Manual changes | Admin troubleshooting |
| Software updates | Patches change settings |
| Malware | Malicious modification |
| Failed deployments | Partial updates |
| Shadow IT | Unauthorized software |
Drift Detection:
Continuous monitoring approach: 1. Capture current state 2. Compare to baseline 3. Report differences 4. Alert on critical changes 5. Remediate or document exception Tools: SCCM, Ansible, Puppet, Chef, SCAP
Drift Response:
| Finding | Action |
|---|---|
| Unauthorized change | Investigate, remediate |
| Approved exception | Document, monitor |
| Baseline update needed | Change management |
| Security issue | Incident response |
How Do You Maintain Baselines?
Baseline Lifecycle:
Create → Deploy → Monitor → Update → Repeat Triggers for baseline updates: - New vulnerabilities - Vendor patches - Compliance changes - Technology updates - Security incidents
Baseline Maintenance Tasks:
| Task | Frequency |
|---|---|
| Drift monitoring | Continuous |
| Compliance scanning | Weekly |
| Baseline review | Quarterly |
| Major updates | As needed |
| Audit validation | Annually |
How CompTIA Tests This
Example Analysis
Scenario: A company is deploying 500 new Windows workstations. Design a baseline implementation approach that ensures consistent security while allowing for departmental variations.
Analysis - Baseline Implementation Strategy:
Baseline Source Selection:
| Option | Pros | Cons |
|---|---|---|
| CIS Level 1 | Industry standard, tested | May need customization |
| CIS Level 2 | Higher security | May impact usability |
| Custom | Tailored to needs | More effort to maintain |
Recommendation: CIS Level 1 + Custom Additions
Baseline Structure:
Core Baseline (All 500 systems):
├── Windows Security Settings
│ ├── Password policy (CIS)
│ ├── Account lockout (CIS)
│ ├── Audit logging (CIS + custom)
│ └── User rights (CIS)
├── Network Settings
│ ├── Firewall enabled (CIS)
│ ├── SMBv1 disabled (CIS)
│ └── Corporate DNS (custom)
├── Software Controls
│ ├── AppLocker policies (custom)
│ ├── Approved software list (custom)
│ └── Browser security (CIS)
└── Endpoint Protection
├── AV/EDR configured (custom)
├── Windows Defender (CIS)
└── BitLocker enabled (custom)Departmental Variations:
| Department | Variation | Justification |
|---|---|---|
| Development | Allow PowerShell scripts | Development needs |
| Finance | Stricter USB controls | Data sensitivity |
| Executives | Allow mobile sync | Business requirement |
| General | Standard baseline | Default |
Implementation:
Phase 1: Create and test baseline - Build golden image - Test in lab environment - Document all settings - Get security approval Phase 2: Deploy - Use imaging/deployment tools - Apply via Group Policy - Verify compliance post-deployment Phase 3: Monitor - SCCM compliance scanning - Weekly drift reports - Automated remediation - Exception tracking
Drift Management:
Detection: - Automated scanning daily - Compare to baseline - Alert on critical changes Response: - Critical: Auto-remediate - Medium: Ticket + 48-hour fix - Low: Quarterly cleanup - Exception: Document + approve
Key insight: Baselines should be 90% standard across the organization with documented, approved exceptions for specific needs. This balance ensures consistent security while accommodating legitimate business requirements.
Key Terms
Common Mistakes
Exam Tips
Memory Trick
CIS Levels: "Level 1 = 1st step, basic security" "Level 2 = 2wice as strict, defense in depth"
STIG Categories: "CAT I = Critical, Act Immediately" "CAT II = Could Affect Things, fix soon" "CAT III = Consider when Able, lower priority"
- •Baseline Process - "SCTDAM":
- •Select standard
- •Customize for environment
- •Test thoroughly
- •Deploy to systems
- •Audit compliance
- •Monitor for drift
- •Drift Causes - "MUMFS":
- •Manual changes
- •Updates (software)
- •Malware
- •Failed deployments
- •Shadow IT
Golden Image Rule: "Gold = Good starting point" Every system starts from same secure image
Test Your Knowledge
Q1.Which organization publishes security configuration benchmarks with Level 1 and Level 2 recommendations?
Q2.A security scan reveals a Windows server has different settings than the approved baseline. What is this called?
Q3.In STIG terminology, which category represents the HIGHEST severity findings?
Want more practice with instant AI feedback?
Continue Learning
Ready for the Exam?
See exactly where you stand on this concept and 182 others.
99% pass rate · Pass guarantee