<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: automating-security-configuration-management
description: >-
  Automate security baseline enforcement, configuration drift detection,
  CIS benchmark compliance scanning, and remediation across servers,
  endpoints, and cloud resources using policy-as-code and desired state.
domain: cybersecurity
subdomain: security-operations-automation
tags:
  - configuration-management
  - cis-benchmarks
  - hardening
  - drift-detection
  - compliance
  - automation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1082"]
---

# Automating Security Configuration Management

## Overview

Security configuration management ensures systems maintain hardened baselines
over time. This technique automates CIS benchmark scanning, desired-state
enforcement, configuration drift detection, and compliance reporting. It
covers both agent-based (Ansible, Chef) and agentless (SSH, API) approaches.

Mode: `[MODE: BLUE]` — Continuous hardening and compliance.

## Prerequisites

| Requirement | Details |
|---|---|
| Python 3.10+ with `subprocess`, `pyyaml` | Required |
| SSH access to target systems or cloud provider APIs | Required |
| CIS benchmark definitions (JSON/YAML) | Required |
| Configuration management tool (Ansible, Chef, or custom) | Required |

## Key Concepts

### Security Baseline Definition

```python
from dataclasses import dataclass
from typing import Any


@dataclass
class BaselineCheck:
    """A single security configuration check."""

    check_id: str
    title: str
    command: str
    expected: str
    severity: str
    benchmark: str
    remediation: str


LINUX_BASELINE: list[BaselineCheck] = [
    BaselineCheck(
        "L-1.1", "Ensure SSH root login disabled",
        "grep -i '^PermitRootLogin' /etc/ssh/sshd_config",
        "PermitRootLogin no", "high", "CIS Ubuntu 22.04 L1",
        "Set PermitRootLogin no in /etc/ssh/sshd_config",
    ),
    BaselineCheck(
        "L-1.2", "Ensure password authentication disabled",
        "grep -i '^PasswordAuthentication' /etc/ssh/sshd_config",
        "PasswordAuthentication no", "high", "CIS Ubuntu 22.04 L1",
        "Set PasswordAuthentication no in /etc/ssh/sshd_config",
    ),
    BaselineCheck(
        "L-2.1", "Ensure firewall is active",
        "ufw status | head -1",
        "Status: active", "critical", "CIS Ubuntu 22.04 L1",
        "Run: ufw enable",
    ),
    BaselineCheck(
        "L-3.1", "Ensure auditd is running",
        "systemctl is-active auditd",
        "active", "high", "CIS Ubuntu 22.04 L1",
        "Run: systemctl enable --now auditd",
    ),
    BaselineCheck(
        "L-4.1", "Ensure core dumps restricted",
        "grep -i 'hard core' /etc/security/limits.conf",
        "* hard core 0", "medium", "CIS Ubuntu 22.04 L1",
        "Add '* hard core 0' to /etc/security/limits.conf",
    ),
]
```

### Drift Detection

```python
def check_configuration(
    baseline: list[BaselineCheck],
    system_state: dict[str, str],
) -> list[dict[str, Any]]:
    """Compare system state against security baseline."""
    results: list[dict[str, Any]] = []
    for check in baseline:
        actual = system_state.get(check.check_id, "")
        status = "PASS" if actual.strip() == check.expected else "FAIL"
        results.append({
            "check_id": check.check_id,
            "title": check.title,
            "status": status,
            "expected": check.expected,
            "actual": actual,
            "severity": check.severity,
            "remediation": check.remediation if status == "FAIL" else "",
        })
    return results
```

## Workflow

### Step 1: Scan Baseline

```bash
node scripts/agent.js --action scan --target server-01
```

### Step 2: Detect Drift

```bash
node scripts/agent.js --action drift-report
```

### Step 3: Generate Remediation Plan

```bash
node scripts/agent.js --action remediation-plan
```

## Detection

```yaml
title: Automating Security Configuration Management Detection
id: 105ec2f8-b87a-4e2e-a27e-a33a894a376a
status: experimental
description: Detects suspicious activity related to automating security configuration management techniques in security operations automation context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*automating*security*"
  condition: selection
level: medium
tags:
  - attack.t1082
  - attack.discovery
falsepositives:
  - Orchestration platform executing approved automation workflows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Automating Security Configuration Management Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1082 |

## Verification

- [ ] All CIS benchmark checks execute against target systems
- [ ] Drift detected between expected and actual configuration
- [ ] Remediation commands generated for each failed check
- [ ] Compliance score calculated from pass/fail ratio

## References

- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
- [NIST SP 800-128 — Configuration Management](https://csrc.nist.gov/publications/detail/sp/800-128/final)
- [OpenSCAP Security Compliance](https://www.open-scap.org/)
