CIS Microsoft Windows Server 2016 Benchmark - Level 2
Center for Internet Security | 2.0.0.10Windows, Windows Server 2016 Base 10.0.14393 - 64-bit Amazon Machine Image (AMI)
Not the "homerun" I was hoping for.
Organization is wanting to use Inspector to validate that launched EC2s are adequately hardened. Further, they wanted to evaluate against Inspector's CIS benchmarks. Figured, "if I start from an official AMI, it ought to be a homerun to get a clean output from Inspector". Launch an EC2 from the AMI. Discover that the AMI is missing the AWS agent. Correct this gap. Run Inspector. Wait for report. Report comes back with nearly 40 "High" findings (nearly 30 if you ignore the DC-only and NG-only findings).
Notice, "oh, *this* AMI is built using the 1.3.0.2 benchmarks and Inspector is using the 1.1.0 benchmarks. Go back to AWSMP and click on the "view older versions" link under the AMI. Am simply taken back to the AMI's normal information page with no indication of availability of back-rev AMIs that I might need.
Report back issues to my organization. They note, "but those findings are all HIGH findings".
Not the "homerun" I was hoping for.
- Leave a Comment |
- 1 comment |
- Mark review as helpful