Hardened Appliances?
We have CIS hardened Windows and Linux VM’s. How are others handling appliances from vendors? VCenter, Tenable, Cisco ISE, etc. Just scan them and go from there? TIL
Posted Jun 29, 2021, 3:06 PM UTC
31
We have CIS hardened Windows and Linux VM’s. How are others handling appliances from vendors? VCenter, Tenable, Cisco ISE, etc. Just scan them and go from there? TIL
Posted Jun 29, 2021, 3:06 PM UTC
Some general points: establish a vendor vetting process (e.g. aligned to NIST 800-171), involve procurement early on (questionnaires, baseline requirements as a pre-requirement, etc). Are you buying from a VAR or directly from the vendor? Root access on the gear?
Aside from gathering and documenting vendor information, yup - it‘s scanning time, respectively config assessment time when there‘s no suitable up-to-date CIS benchmark around. Mileage varies relative to your threat model/exposure/risk appetite.
Here‘s a nice doc with a practical twist (geared at OT/Energy, but the approach can be applied to any procurement process imho): https://www.osti.gov/servlets/purl/1661247