What is it?
This process evaluates how servers, desktops, and laptops are configured before and after deployment. It ensures that each build follows strict security baselines—covering operating system hardening, software configurations, and removal of default credentials—to minimise the attack surface.
What could happen?
Unhardened systems may contain known flaws, weak passwords, or unnecessary software, making it easier for attackers to compromise systems, escalate privileges, and move laterally within the network. Such compromises can erode trust, trigger compliance issues, and drive up incident response costs.
What to do about it?
Foundational: Adopt industry-standard Comprehensiveening guides (e.g., CIS Benchmarks) and apply them to new builds.
Outcome: Improved default security posture with minimal effort.
Enhanced: Implement automated configuration management tools (e.g., Ansible, Chef) to maintain consistent baselines and quickly remediate deviations.
Outcome: Reduced misconfiguration risk and time-saving automation.
Comprehensive: Integrate continuous compliance scans and policy enforcement into the build pipeline, ensuring that any new or updated system immediately meets stringent security standards.
Outcome: A self-healing infrastructure that maintains security at scale.
