Operating System Security Hardening Checker

Purpose & When-To-Use

Trigger conditions:

• Operating system hardening validation before production deployment
• CIS benchmark compliance requirement
• OS patch management audit
• Post-incident OS security review
• Host security configuration assessment

Not for:

• Real-time OS threat detection (use EDR/host IDS tools)
• OS performance optimization (use performance monitoring tools)
• Cloud infrastructure security (use security-cloud-analyzer)
• Container security (use security-container-validator)

Pre-Checks

Time normalization:

• Compute NOW_ET using NIST/time.gov semantics (America/New_York, ISO-8601): 2025-10-26T01:33:55-04:00
• Use NOW_ET for all citation access dates

Input validation:

• os_platform must be one of: [linux, windows, both]
• os_distribution must be one of: [ubuntu, rhel, centos, debian, windows-server] or omitted
• cis_level must be one of: [1, 2] (Level 1=basic, Level 2=comprehensive)

Source freshness:

• CIS Benchmarks (Linux, Windows) (accessed 2025-10-26T01:33:55-04:00): https://www.cisecurity.org/cis-benchmarks
• NIST SP 800-53 Rev 5 (CM, SI families) (accessed 2025-10-26T01:33:55-04:00): https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final

Procedure

Step 1: Critical OS Hardening Controls Check

Patch Management:

1. OS patches current (within 30 days of release)
2. Security patches prioritized over feature updates
3. Patch management process documented
4. Critical vulnerabilities patched within 7 days

Kernel Hardening (Linux):

1. SELinux or AppArmor enabled and enforcing
2. Kernel modules restricted (no unnecessary modules loaded)
3. Core dumps disabled for security
4. Address Space Layout Randomization (ASLR) enabled

Host-Based Firewall:

1. Firewall active (iptables, nftables, Windows Firewall)
2. Default-deny policy
3. Only necessary ports open
4. Firewall rules documented

Services and Processes:

1. Unnecessary services disabled (per CIS Benchmark, accessed 2025-10-26T01:33:55-04:00)
2. No legacy protocols enabled (Telnet, FTP, rsh)
3. Secure SSH configuration (no root login, key-based auth)

File Integrity Monitoring:

1. File integrity monitoring tool installed (AIDE, Tripwire, Samhain)
2. Critical system files monitored
3. Regular integrity checks scheduled

Step 2: CIS Benchmark Compliance Scoring

For each CIS control assessed:

• Calculate compliance score: (passed controls / total controls) * 100
• Prioritize Level 1 controls (basic hardening)
• Include Level 2 controls if cis_level=2 (defense-in-depth)

Token budgets:

• T1: ≤2k tokens (critical OS hardening controls)
• T2: ≤6k tokens (full CIS benchmark audit)
• T3: Not applicable for this skill (use security-auditor agent for comprehensive assessments)

Decision Rules

Ambiguity thresholds:

• If OS distribution unknown → use generic Linux or Windows CIS baseline
• If patch date unavailable → flag as unknown risk

Abort conditions:

• No OS platform specified → cannot proceed
• No OS access or configuration files → limited to documentation review

Severity classification:

• Critical: Unpatched critical CVEs, SELinux/AppArmor disabled (CVSS 9.0-10.0)
• High: Patches >30 days old, firewall disabled (CVSS 7.0-8.9)
• Medium: Unnecessary services, weak SSH config (CVSS 4.0-6.9)
• Low: Documentation gaps, CIS Level 2 deviations (CVSS 0.1-3.9)

Output Contract

Required fields:

{
  "os_platform": "linux|windows|both",
  "os_distribution": "ubuntu|rhel|centos|debian|windows-server or null",
  "cis_level": "1|2",
  "timestamp": "ISO-8601 with timezone",
  "findings": [
    {
      "id": "unique identifier",
      "category": "patching|kernel|firewall|services|fim",
      "severity": "critical|high|medium|low",
      "cvss_score": 0.0,
      "title": "brief description",
      "description": "detailed finding",
      "cis_control": "CIS Benchmark control ID",
      "nist_control": "SP 800-53 control (e.g., CM-7, SI-2)",
      "remediation": "specific fix steps",
      "remediation_command": "shell command or script"
    }
  ],
  "cis_compliance_score": 0.0,
  "summary": {
    "total_findings": 0,
    "critical_count": 0,
    "high_count": 0,
    "overall_risk": "critical|high|medium|low"
  }
}

Examples

Example: Linux Hardening Check

# Input
os_platform: "linux"
os_distribution: "ubuntu"
cis_level: "1"

# Output (abbreviated)
{
  "os_platform": "linux",
  "os_distribution": "ubuntu",
  "findings": [
    {
      "id": "OS-001",
      "category": "kernel",
      "severity": "high",
      "cvss_score": 7.8,
      "title": "AppArmor not enabled",
      "cis_control": "CIS Ubuntu 1.6.1",
      "remediation_command": "systemctl enable apparmor && systemctl start apparmor"
    }
  ],
  "cis_compliance_score": 72.5,
  "summary": {"high_count": 1, "overall_risk": "high"}
}

Quality Gates

Token budgets:

• T1 ≤2k tokens (critical OS hardening controls)
• T2 ≤6k tokens (full CIS benchmark audit)

Safety:

• No system credentials in remediation commands
• No actual hostnames in examples

Auditability:

• Findings cite CIS Benchmark and NIST SP 800-53 controls
• Patch recommendations align with vendor advisories

Determinism:

• Same OS state + inputs = consistent findings

Resources

CIS Benchmarks:

• CIS Benchmarks (all OS): https://www.cisecurity.org/cis-benchmarks (accessed 2025-10-26T01:33:55-04:00)
• CIS Ubuntu Benchmark: https://www.cisecurity.org/benchmark/ubuntu_linux (accessed 2025-10-26T01:33:55-04:00)
• CIS RHEL Benchmark: https://www.cisecurity.org/benchmark/red_hat_linux (accessed 2025-10-26T01:33:55-04:00)
• CIS Windows Server Benchmark: https://www.cisecurity.org/benchmark/microsoft_windows_server (accessed 2025-10-26T01:33:55-04:00)

NIST Standards:

• NIST SP 800-53 Rev 5 (CM, SI families): https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final (accessed 2025-10-26T01:33:55-04:00)

Hardening Guides:

• SELinux Documentation: https://www.redhat.com/en/topics/linux/what-is-selinux (accessed 2025-10-26T01:33:55-04:00)
• AppArmor Documentation: https://ubuntu.com/server/docs/security-apparmor (accessed 2025-10-26T01:33:55-04:00)