Hardening (CIS benchmarks and DISA STIGs)

The Hardening tab in Infra Vulnerabilities shows how each host’s configuration compares to benchmarks aligned to the CIS Benchmarks and to the DISA STIGs. A host is judged against every benchmark that applies to its platform and edition, and each is stored and scored on its own. A Windows Server 2022 domain controller, for example, has a CIS result set and a STIG result set, and a STIG result never replaces a CIS result. The checks run in TigerGate against configuration facts the agent reports, so no agent release is needed when a check is added or corrected, unless the check reads a setting the agent does not collect yet. The CIS controls are TigerGate’s own, written against the CIS recommendations. They are not an official CIS-certified benchmark. The STIG rules are DISA’s: their identifiers, titles and categories are taken from the STIG release named in the DISA STIGs section. Which benchmarks apply to a host follows the host itself:

• A Windows host is a server or a client by its product type, and a domain controller is told from a member server by it. A client is never judged by the server benchmark, and a server never by the client benchmark. A Windows host whose product type and installation type could not be read is not assessed against either, and keeps its previous results.
• The Windows Server 2022 STIG applies to Windows Server 2022 only and the Windows 11 STIG to Windows 11 only, both told apart by the OS build number.
• The Red Hat STIGs apply to Red Hat Enterprise Linux 8 and 9, and the Ubuntu STIG to Ubuntu 22.04, by the operating system and version the agent reads from os-release.
• When a host stops being a benchmark’s target (a Windows client once judged by the server benchmark, a host upgraded from RHEL 8 to RHEL 9), that benchmark’s stored results are removed.

​

Requirements

• A host running the agent with the server profile, on Linux, Windows or macOS.
• An agent release that includes the host_config collector. See Update an existing agent. On Windows, the controls that read registry policy values (most of the STIG rules and the Level 2 and client controls) need a release that reports them. With an older agent they show Not assessed, never Fail, until the agent is updated.
• For the controls marked Needs elevation below, the agent installed in privileged mode. Without it they show Not assessed.

​

Results

Each control on each server has one of four results: The benchmark score is passed controls divided by passed plus failed controls, across every server. Not applicable and not assessed controls are left out of the score, so they neither raise nor lower it. The Not assessed tile shows how many checks could not be read. A configuration that is absent is judged by the setting that applies when it is absent. An sshd_config with no PermitRootLogin line is judged by OpenSSH’s default, and a missing password policy fails rather than being skipped.

​

Controls that need elevated rights

By default the agent runs as the account that installed it, never as root or SYSTEM. Some configuration can only be read with elevated rights, and the controls that need it report Not assessed until the agent is installed in privileged mode: On macOS a few controls (screen saver and sharing services) are assessed only when a configuration profile or the system launchd settings answer them, so they can show Not assessed even in privileged mode. On Linux, these files are readable by root only on a typical server: File permission checks still run on these files. Reading a file’s owner and mode does not need access to its contents. The agent never reads a secret from these files. See What the agent collects.

​

Using the Hardening tab

• Benchmark selects one of the benchmarks above. Each has its own score, and a host appears under every benchmark that applies to it.
• Chapters summarize pass and fail counts per benchmark chapter. Select one to filter the controls.
• Controls can be filtered by chapter, severity and level (Level 1 and 2 or Level 1 only), and searched. For the Windows Server benchmark, a Host role filter keeps the controls written for member servers or for domain controllers. A STIG is filtered by category (CAT I, CAT II, CAT III) instead of severity, has no level filter, and shows each rule’s Vuln ID, rule ID and STIG ID.
• Select a control to see the servers that fail it, with the evidence from each. A control that shares its check with the other benchmark names the CIS control it is the same as.
• On the Hosts tab, a server’s detail panel has a Hardening tab with that host’s results, one section and one score per benchmark.

Results update with each scan. Fix the setting on the server, and the control passes after the next scan.

​

Controls

​

CIS Linux

On Linux, the controls that need elevation are those reading the root-only files in the table above.

​

CIS Microsoft Windows Server 2022

Level 1 and Level 2, for member servers and domain controllers. The Role column shows the host role a control is written for. A control for one role is Not applicable on the other, and a host that did not report its role shows those controls as Not assessed. The benchmark is applied to every Windows Server release the agent reports, not only 2022. Levels are TigerGate’s assignment: Level 1 is the baseline that rarely costs function, and Level 2 is defence in depth that removes a feature or a Microsoft service connection. Where a policy lives under HKLM\SOFTWARE\Policies and was never written, a control that wants the policy set fails. The controls that need elevation read the local security policy, user rights or audit policy and are marked in the table.

​

CIS Microsoft Windows 10/11 Enterprise

Level 1 and Level 2 for Windows 11 and Windows 10 clients, under its own benchmark. A client is never judged by the Windows Server benchmark, and a server is never judged by this one. The agent reports the Windows product type and installation type, and the benchmark follows them. A Windows host that reports neither is not assessed against either, and keeps its previous results. Most of a client’s recommendations are the same setting as a server’s, so those controls are the server’s: the same control id and the same check, listed here again. Controls that exist only on a client are TG-WINC-*. Settings that only Windows 11 has (widgets, Recall) apply from the OS build that introduced them and are Not applicable on Windows 10.

​

CIS Apple macOS

​

DISA STIGs

The Security Technical Implementation Guides are published by the Defense Information Systems Agency as public works. A host is judged by the STIG for its operating system in addition to the CIS benchmark for its platform, and each is stored and scored separately: a STIG result never replaces or closes a CIS result, and the reverse. Rule identifiers, titles and categories come from DISA’s XCCDF files, not from TigerGate. Each result carries the rule’s Vuln ID (V-xxxxxx), rule ID (SV-xxxxxx...) and STIG ID, so it can be found in a STIG Viewer or in an eMASS export. The severity is the STIG category: CAT I is high, CAT II is medium and CAT III is low. A STIG has no levels. Only the rules the agent’s configuration facts can decide are evaluated. The rest need a person or a source the agent does not read, and are not listed or scored. They include the membership of local groups, installed Windows features, certificates, documentation and approvals, per-user settings, domain policy, audit rules, PAM and password settings, FIPS mode and file permissions on Linux. The Linux STIGs cover packages, kernel parameters (the running value), SSH daemon keywords and separate file systems for the moment, so their coverage is much smaller than the Windows STIGs’. A STIG rule is selected by the host’s operating system and release. The Red Hat STIGs apply to Red Hat Enterprise Linux itself, not to its rebuilds. A host whose operating system or edition cannot be read is not assessed against a STIG, and keeps its previous results. When a STIG and a CIS benchmark ask for exactly the same setting, they share one check, and the result shows the CIS control it is the same as. Several rules allow an exception documented with the information system security officer. TigerGate cannot see the documentation, so such a rule fails until the setting is changed or the finding is triaged.

​

DISA STIG Microsoft Windows Server 2022 (Release 11)

​

DISA STIG Microsoft Windows 11 (Release 11)

​

DISA STIG Red Hat Enterprise Linux 9 (Release 10)

​

DISA STIG Red Hat Enterprise Linux 8 (Release 9)

​

DISA STIG Canonical Ubuntu 22.04 LTS (Release 10)