Security Baseline Hardening: CIS Controls Implementation

┌─────────────────────────────────────────────────────────────────────┐
│                    IG1 Implementation Roadmap                        │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  Month 1                Month 2                Month 3              │
│  ┌─────────────┐        ┌─────────────┐        ┌─────────────┐     │
│  │ Control 1   │        │ Control 5   │        │ Control 11  │     │
│  │ Hardware    │        │ Account     │        │ Data        │     │
│  │ Inventory   │        │ Management  │        │ Recovery    │     │
│  ├─────────────┤        ├─────────────┤        ├─────────────┤     │
│  │ Control 2   │        │ Control 6   │        │ Control 14  │     │
│  │ Software    │        │ Access      │        │ Security    │     │
│  │ Inventory   │        │ Management  │        │ Awareness   │     │
│  ├─────────────┤        ├─────────────┤        └─────────────┘     │
│  │ Control 3   │        │ Control 7   │                             │
│  │ Data        │        │ Continuous  │                             │
│  │ Protection  │        │ Vuln Mgmt   │                             │
│  ├─────────────┤        └─────────────┘                             │
│  │ Control 4   │                                                    │
│  │ Secure      │                                                    │
│  │ Config      │                                                    │
│  └─────────────┘                                                    │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘

# Windows - Query local network for active hosts
$subnet = "192.168.1"
1..254 | ForEach-Object -Parallel {
    $ip = "$using:subnet.$_"
    if (Test-Connection -ComputerName $ip -Count 1 -Quiet) {
        [PSCustomObject]@{
            IP = $ip
            Hostname = (Resolve-DnsName $ip -ErrorAction SilentlyContinue).NameHost
            MAC = (Get-NetNeighbor -IPAddress $ip -ErrorAction SilentlyContinue).LinkLayerAddress
        }
    }
} -ThrottleLimit 50 | Export-Csv ".\asset-discovery.csv" -NoTypeInformation

Asset Categories:
├── Endpoints
│   ├── Workstations (Windows, macOS)
│   ├── Mobile (iOS, Android)
│   └── Virtual Desktops
├── Servers
│   ├── Physical
│   ├── Virtual (VMware, Hyper-V)
│   └── Cloud (Azure VMs, AWS EC2)
├── Network
│   ├── Routers/Switches
│   ├── Firewalls
│   └── Wireless APs
└── IoT/OT
    ├── Printers
    ├── Cameras
    └── Industrial devices

# Windows - Get installed software
$software = Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
    HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
    Where-Object { $_.DisplayName } |
    Select-Object DisplayName, DisplayVersion, Publisher, InstallDate
 
$software | Export-Csv ".\software-inventory.csv" -NoTypeInformation
 
# Get running processes (may indicate uninstalled software)
Get-Process | Select-Object Name, Path, Company |
Where-Object { $_.Path } |
Sort-Object Name -Unique |
Export-Csv ".\running-software.csv" -NoTypeInformation

# Windows Defender Application Control (WDAC)
# Create policy from golden image
$policyPath = "C:\Policies\BasePolicy.xml"
New-CIPolicy -FilePath $policyPath -Level Publisher -UserPEs -MultiplePolicyFormat
 
# Audit mode first
Set-RuleOption -FilePath $policyPath -Option 3  # Enable Audit Mode
 
# Convert to binary
ConvertFrom-CIPolicy -XmlFilePath $policyPath -BinaryFilePath "C:\Policies\BasePolicy.cip"

# Compare current inventory to approved list
$approved = Import-Csv ".\approved-software.csv"
$current = Import-Csv ".\software-inventory.csv"
 
$unauthorized = $current | Where-Object {
    $_.DisplayName -notin $approved.DisplayName
}
 
$unauthorized | Export-Csv ".\unauthorized-software.csv" -NoTypeInformation
 
if ($unauthorized) {
    Write-Warning "Unauthorized software found: $($unauthorized.Count) items"
}

Classification Levels:
┌────────────────────────────────────────────────────────────┐
│ Level 4: RESTRICTED                                        │
│ - PII, PHI, PCI data                                       │
│ - Trade secrets                                            │
│ - Encryption required at rest and transit                  │
├────────────────────────────────────────────────────────────┤
│ Level 3: CONFIDENTIAL                                      │
│ - Internal business data                                   │
│ - Employee information                                     │
│ - Encryption required at rest                              │
├────────────────────────────────────────────────────────────┤
│ Level 2: INTERNAL                                          │
│ - Day-to-day business operations                           │
│ - Not for public release                                   │
│ - Standard access controls                                 │
├────────────────────────────────────────────────────────────┤
│ Level 1: PUBLIC                                            │
│ - Marketing materials                                      │
│ - Public website content                                   │
│ - No special handling required                             │
└────────────────────────────────────────────────────────────┘

# Check BitLocker status
Get-BitLockerVolume
 
# Enable BitLocker with TPM
Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -TpmProtector
 
# Add recovery password
Add-BitLockerKeyProtector -MountPoint "C:" -RecoveryPasswordProtector
 
# Backup to Azure AD (Intune managed)
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId (
    (Get-BitLockerVolume -MountPoint "C:").KeyProtector |
    Where-Object { $_.KeyProtectorType -eq 'RecoveryPassword' }
).KeyProtectorId

# Find files with potential sensitive data
$patterns = @(
    '\b\d{3}-\d{2}-\d{4}\b',      # SSN
    '\b\d{16}\b',                  # Credit card
    '\b[A-Z]{2}\d{6}[A-Z]\b'       # Passport
)
 
$sensitiveFiles = Get-ChildItem -Path "C:\Users" -Recurse -Include "*.xlsx", "*.csv", "*.docx" -ErrorAction SilentlyContinue |
ForEach-Object {
    $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
    foreach ($pattern in $patterns) {
        if ($content -match $pattern) {
            [PSCustomObject]@{
                File = $_.FullName
                Pattern = $pattern
                Modified = $_.LastWriteTime
            }
        }
    }
}
 
$sensitiveFiles | Export-Csv ".\sensitive-data-scan.csv" -NoTypeInformation

# Key Security Baseline Settings
Password Policy:
  - Minimum Length: 14 characters
  - Complexity: Required
  - History: 24 passwords
  - Maximum Age: 90 days
 
Account Lockout:
  - Threshold: 5 invalid attempts
  - Duration: 30 minutes
  - Reset Counter: 30 minutes
 
User Rights:
  - Deny log on locally: Guests
  - Deny access from network: Guests, Anonymous
 
Security Options:
  - UAC: Enabled (Prompt for consent)
  - Guest account: Disabled
  - Rename administrator account: Yes
  - Blank passwords: Disabled

# Example CIS hardening script excerpts
 
# 2.3.1.1 - Accounts: Administrator account status
Disable-LocalUser -Name "Administrator"
 
# 2.3.1.3 - Rename administrator account
Rename-LocalUser -Name "Administrator" -NewName "IT-Admin-$((Get-Random -Maximum 9999))"
 
# 2.3.7.3 - Interactive logon: Machine inactivity limit
Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "InactivityTimeoutSecs" -Value 900
 
# 18.4.3 - MSS: Enable ICMP redirects
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "EnableICMPRedirect" -Value 0
 
# 18.5.4.1 - Turn off multicast name resolution (LLMNR)
New-Item -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Force
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient" -Name "EnableMulticast" -Value 0
 
# 18.9.102.1 - Configure Windows Defender SmartScreen
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "EnableSmartScreen" -Value 1

# Disable unused services
config system global
    set admin-https-redirect enable
    set admin-telnet disable
    set admin-ssh-port 22
    set admin-ssh-grace-time 60
    set admin-ssh-password enable
    set admintimeout 10
    set timezone 12
end
 
# Configure admin password policy
config system password-policy
    set status enable
    set min-length 14
    set min-lower-case-letter 1
    set min-upper-case-letter 1
    set min-number 1
    set min-non-alphanumeric 1
    set expire-status enable
    set expire-day 90
end
 
# Restrict admin access by IP
config system admin
    edit "admin"
        set trusthost1 10.0.0.0 255.0.0.0
        set trusthost2 192.168.1.0 255.255.255.0
    next
end

# Active Directory - Get all user accounts
Get-ADUser -Filter * -Properties LastLogonDate, Enabled, PasswordLastSet, MemberOf |
Select-Object SamAccountName, DisplayName, Enabled, LastLogonDate, PasswordLastSet,
    @{N='Groups'; E={($_.MemberOf | ForEach-Object { (Get-ADGroup $_).Name }) -join '; '}} |
Export-Csv ".\ad-user-inventory.csv" -NoTypeInformation
 
# Find stale accounts (no logon in 45 days)
$staleDate = (Get-Date).AddDays(-45)
Get-ADUser -Filter { LastLogonDate -lt $staleDate -and Enabled -eq $true } -Properties LastLogonDate |
Select-Object SamAccountName, LastLogonDate |
Export-Csv ".\stale-accounts.csv" -NoTypeInformation

# Automatically disable accounts inactive for 45 days
$staleDate = (Get-Date).AddDays(-45)
$staleUsers = Get-ADUser -Filter { LastLogonDate -lt $staleDate -and Enabled -eq $true } -Properties LastLogonDate
 
foreach ($user in $staleUsers) {
    Disable-ADAccount -Identity $user.SamAccountName
    Set-ADUser -Identity $user.SamAccountName -Description "Disabled by automation - Inactive since $($user.LastLogonDate)"
    Write-Output "Disabled: $($user.SamAccountName) - Last logon: $($user.LastLogonDate)"
}

# Find all privileged group members
$privGroups = @("Domain Admins", "Enterprise Admins", "Schema Admins", "Administrators", "Account Operators", "Backup Operators")
 
$privAccounts = foreach ($group in $privGroups) {
    Get-ADGroupMember -Identity $group -Recursive | ForEach-Object {
        [PSCustomObject]@{
            Group = $group
            SamAccountName = $_.SamAccountName
            ObjectClass = $_.objectClass
        }
    }
}
 
$privAccounts | Export-Csv ".\privileged-accounts.csv" -NoTypeInformation
Write-Output "Found $($privAccounts.Count) privileged account memberships"

MFA Rollout Order:
┌────────────────────────────────────────────────────────────┐
│ Phase 1 (Immediate): Privileged Accounts                   │
│ - Domain Admins, Global Admins                             │
│ - Service desk with elevated privileges                    │
│ - Cloud admin accounts                                     │
├────────────────────────────────────────────────────────────┤
│ Phase 2 (Week 2): Remote Access                            │
│ - VPN users                                                │
│ - Remote desktop users                                     │
│ - Cloud application access                                 │
├────────────────────────────────────────────────────────────┤
│ Phase 3 (Week 4): All External Applications                │
│ - Microsoft 365                                            │
│ - SaaS applications                                        │
│ - Customer-facing portals                                  │
├────────────────────────────────────────────────────────────┤
│ Phase 4 (Month 2): All Users                               │
│ - Complete MFA rollout                                     │
│ - Phishing-resistant MFA for sensitive roles               │
└────────────────────────────────────────────────────────────┘

# Configure Windows Update via PowerShell
$WUSettings = @{
    'AcceptTrustedPublisherCerts' = 1
    'DisableWindowsUpdateAccess' = 0
    'ElevateNonAdmins' = 0
    'AUOptions' = 4  # Auto download and schedule install
    'ScheduledInstallDay' = 0  # Every day
    'ScheduledInstallTime' = 3  # 3 AM
    'NoAutoRebootWithLoggedOnUsers' = 0
}
 
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
if (-not (Test-Path $regPath)) {
    New-Item -Path $regPath -Force
}
 
foreach ($setting in $WUSettings.GetEnumerator()) {
    Set-ItemProperty -Path $regPath -Name $setting.Key -Value $setting.Value
}

3-2-1 Backup Rule:
┌─────────────────────────────────────────────────────────────┐
│                                                             │
│  3 Copies of Data                                           │
│  ├── Production (Original)                                  │
│  ├── On-site backup (NAS, SAN, local server)               │
│  └── Off-site backup (Cloud, remote DC, tape)               │
│                                                             │
│  2 Different Media Types                                    │
│  ├── Disk-based (fast recovery)                            │
│  └── Cloud/Tape (ransomware protection)                    │
│                                                             │
│  1 Off-site Copy                                            │
│  └── Geographically separated (disaster recovery)          │
│                                                             │
│  BONUS: 1 Immutable/Air-gapped Copy                         │
│  └── Cannot be modified or deleted by ransomware           │
│                                                             │
└─────────────────────────────────────────────────────────────┘

# Test backup integrity
function Test-BackupIntegrity {
    param(
        [string]$BackupPath,
        [string]$TestRestorePath = "C:\BackupTest"
    )
 
    # Create test restore directory
    New-Item -ItemType Directory -Path $TestRestorePath -Force
 
    # Attempt to restore sample files
    try {
        # Example: Veeam restore
        # Start-VBRRestoreSession -BackupSession $session
 
        # Verify file integrity
        $testFile = Get-ChildItem $TestRestorePath -Recurse | Select-Object -First 1
        if ($testFile -and (Test-Path $testFile.FullName)) {
            Write-Output "Backup verification: SUCCESS"
            return $true
        }
    } catch {
        Write-Error "Backup verification: FAILED - $_"
        return $false
    } finally {
        # Cleanup
        Remove-Item -Path $TestRestorePath -Recurse -Force -ErrorAction SilentlyContinue
    }
}

Phishing Campaign Schedule:
┌────────────────────────────────────────────────────────────┐
│ Quarter 1: Basic Phishing                                   │
│ - Generic phishing email (obvious)                         │
│ - Training for all who click                               │
├────────────────────────────────────────────────────────────┤
│ Quarter 2: Credential Harvesting                            │
│ - Fake login page (Microsoft branded)                      │
│ - Focus on those who clicked in Q1                         │
├────────────────────────────────────────────────────────────┤
│ Quarter 3: Business Email Compromise                        │
│ - CEO fraud / invoice scam                                 │
│ - Target finance and executives                            │
├────────────────────────────────────────────────────────────┤
│ Quarter 4: Spear Phishing                                   │
│ - Personalized attacks                                     │
│ - Based on OSINT                                           │
└────────────────────────────────────────────────────────────┘

Control Assessment Scoring:
┌────────────────────────────────────────────────────────────────────┐
│ Score │ Description                                                │
├────────────────────────────────────────────────────────────────────┤
│   0   │ Not Implemented - No safeguards in place                   │
│   1   │ Initial - Ad-hoc implementation, not documented            │
│   2   │ Developing - Partially implemented, some documentation     │
│   3   │ Defined - Fully implemented, documented, not validated     │
│   4   │ Managed - Implemented, documented, measured, reviewed      │
│   5   │ Optimized - Continuous improvement, automated, audited     │
└────────────────────────────────────────────────────────────────────┘