CIS scan tool

[groovicus]

I searched around here, but was unable to find anything about this:

http://www.cisecurity.org/

For the first time ever, a large group of user organizations, information security professionals and auditors have agreed on security configuration specifications that represent a prudent level of due care, and are working together to define consensus best-practice security configurations for computers connected to the Internet.

Now you can determine how your systems measure up to these widely accepted security benchmarks.

Note to Redhat users...you need to change the config file to get it to work correctly, found here: http://oob.freeshell.org/nzwireless/tidy.html

Anybody here used it? Is it worthwhile?

There are also versions for windows.

[Maverick811]

Originally posted here by groovicus
Anybody here used it? Is it worthwhile?

There are also versions for windows.

I was using v2.1.6 (not sure what the current version is now) for Windows a while back.. I didn't get to use the tool too much, but from what I did use I found it to be a pretty good tool for scoring the security of a box... From what I am remembering you can recieve an overall score for security on your box then review the corrections, updates, etc. that need to be made to improve the overall score...

I may get this tool back out and mess around with it some more... I'll let you know if I've got more info to give ya..

[thehorse13]

When compared to the MS baseline security analyzer, this tool is much better. It comes with custom INF files so you can import them right into your MS boxes. This includes domain controllers, desktops, servers, etc.. I have used the INFs as templates for my own security policy settings and I have never had a problem. You'll be hard pressed to find a better free tool.

If there is something specific you want to know, I'd be happy to answer. Just post it here in the thread.

Hope this helps.
--TH13

[groovicus]

Thanks...I'd consider the above posts the equivalent of "two thumbs up"

There are so many tools floating around that it's hard to know which ones are worth the time investment...sometimes you stumble across a winner.

If I have any questions, I will definately ask.