<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: configuring-endpoint-hardening-baselines
description: >-
  Apply and validate CIS benchmarks, DISA STIGs, and attack surface reduction
  rules on endpoints. Covers OS hardening, service minimization, registry
  hardening, filesystem permissions, and compliance validation using automated
  audit tools.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - hardening
  - cis-benchmarks
  - stig
  - attack-surface-reduction
  - gpo
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
    - T1562
    - T1112
    - T1222
---

# Configuring Endpoint Hardening Baselines

## Overview

Endpoint hardening reduces the attack surface by disabling unnecessary services,
enforcing secure configurations, and applying principle of least privilege at the
OS level. CIS benchmarks and DISA STIGs provide prescriptive guidance. Automation
via GPO, Ansible, or DSC ensures consistent enforcement across the fleet.

## Prerequisites

| Requirement | Purpose |
|---|---|
| CIS-CAT Pro | Automated CIS benchmark assessment tool |
| Ansible + CIS role | Automated hardening playbooks for Linux |
| Group Policy Management | GPO editor for Windows domain hardening |
| PowerShell DSC | Desired State Configuration for Windows compliance |

## Workflow

1. **Select baseline** — Choose CIS Level 1/2 or DISA STIG for the target OS
2. **Baseline audit** — Run CIS-CAT or Ansible `--check` to assess current state
3. **Identify gaps** — Review failed controls and prioritize by risk
4. **Build remediation** — Create GPO/Ansible/DSC configurations for failed controls
5. **Test in staging** — Apply to test endpoints and validate no service disruption
6. **Deploy to production** — Roll out via GPO/Ansible in staged waves
7. **Validate compliance** — Re-run audit to confirm pass rate improvement
8. **Schedule recurring audits** — Monthly compliance scans with drift alerting

## Key Commands

```powershell
# Windows — Attack Surface Reduction rules
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule_guid> -AttackSurfaceReductionRules_Actions Enabled

# Windows — Audit policy configuration
auditpol /set /subcategory:"Logon" /success:enable /failure:enable

# Windows — Disable SMBv1
Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart

# Windows — Registry hardening (disable LLMNR)
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" /v EnableMulticast /t REG_DWORD /d 0 /f

# Linux — SSH hardening
sed -i 's/#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config

# Linux — Kernel hardening
sysctl -w net.ipv4.conf.all.rp_filter=1
sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1
sysctl -w kernel.randomize_va_space=2

# CIS-CAT assessment
./Assessor-CLI.sh -b benchmarks/CIS_Ubuntu_22.04_LTS_Benchmark_v1.0.0.xml
```

## Verification

| Check | Method |
|---|---|
| CIS score improved | CIS-CAT pass rate ≥ 90% for Level 1 |
| ASR rules active | `Get-MpPreference | Select ASR*` shows enabled rules |
| SMBv1 disabled | `Get-SmbServerConfiguration | Select EnableSMB1Protocol` is False |
| SSH hardened | `sshd -T | grep -i permitrootlogin` returns no |
| Kernel hardened | `sysctl net.ipv4.conf.all.rp_filter` returns 1 |

## References

- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks)
- [DISA STIGs](https://public.cyber.mil/stigs/)
- [Microsoft ASR Rules](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference)

---
v1.0 | Validated: 2026-03-18
