Taming the Twin Red Hat Beasts: A Compliance Gladiator's Epic Tale

The talk covers building a secure configuration baseline for Red Hat Enterprise Linux 8 and 9 in an environment where most administrators work with Windows tooling. The speaker frames the problem: CIS benchmarks contain hundreds of line items, vendors ship default builds that favor getting things to work, and a documented baseline is often treated as a box to tick. He argues that the baseline should be a policy-level document, with each item marked as accepted, defined differently, or rejected, backed by a justification and a plan of action for the remaining gaps.

The middle of the talk turns to scanning. Commercial scanner output was described as hard to act on, with results passing or failing in different forms across a server population. The approach shown was to pull raw results from every host, group them by benchmark ID and by identical output, and load the groups into a spreadsheet. Servers that share a result cluster together, which makes outliers and inconsistent configurations visible quickly. The speaker also described parsing messy CSV and XML exports with custom code, and comparing benchmark versions where numbering and wording had changed between releases.

For practitioners, the takeaways are to start in non-production, change one thing at a time, record legacy exceptions as documented deviations, and validate that settings are actually applied on every system. AI tools can help triage generic guidance, but business context and application needs still drive the final decisions. The method is presented as a practical path rather than a finished product, with formal audit validation still pending when the talk was given.