Config Comedy: Baseline Scans Gone Wild

The talk opens with a common frustration: compliance scans against CIS benchmarks often report weak pass rates. Default platform settings are rarely hardened, and the benchmarks are long, change IDs between versions, and are hard to tailor. The speaker illustrates this with a Windows impersonation privilege example, where an IIS-specific group setting can make a scan pass even on a compromised host. Scanner customization and the CIS-CAT workbench are also covered as poor fits for enterprise scale.

The middle of the session presents a practical method. Settings are compared across versions of the same platform, since most overlap, so one abstract baseline can be maintained and adapted per release. Each line item is sorted as matching the default, accepted as-is, a documented deviation, or deferred with a plan. Tagging these outcomes in the scan template lets reports explain results instead of only listing failures, and a failing accepted setting then signals drift rather than a policy question.

The closing advice is to start by knowing your assets, prioritising crown-jewel systems or the most common platform, and getting leadership agreement on the baseline. Version-controlled infrastructure as code is favoured over golden images or spreadsheets for keeping that baseline current. When tooling falls short, sampling and manual verification can still satisfy auditors.