Table 1 — Security Baseline Elements
| Element | What It Covers | Example Deviation Risk |
|---|---|---|
| Firewall rules | Which ports are open or blocked on the system | Attacker exploits an open port that should have been closed |
| Patch levels | Which OS and application updates must be installed | Missing patch leaves a known CVE exploitable on the system |
| OS file versions | Correct system files in place with expected versions | Replaced or outdated system file introduces instability or backdoor |
| Authentication settings | Password complexity, lockout thresholds, MFA requirements | Weak password policy allows brute-force or credential spray |
| Access controls | Privilege boundaries, least privilege enforcement | Over-privileged account compromised, leading to lateral movement |
| Service configuration | Which services and processes are permitted to run | Unnecessary service provides additional attack surface |
Table 2 — Manufacturer Baseline Sources
| Source | What They Provide | Example |
|---|---|---|
| Application developer | File permissions, configuration settings for their application | Database vendor's hardening guide for default port changes, service account privileges |
| Operating system manufacturer | Security settings for the OS; group policy recommendations | Microsoft Security Compliance Toolkit (SCT) for Windows 10/11/Server |
| Appliance manufacturer | Hardware-specific hardening; default credential changes; service disabling | Firewall vendor's secure deployment guide for their specific device model |
| Third-party frameworks | Cross-platform benchmarks validated by security community | CIS Benchmarks covering dozens of OS and application types |
Table 3 — Baseline Deployment Mechanisms
| Mechanism | Best For | Key Characteristic |
|---|---|---|
| Active Directory Group Policy | Windows workstations and servers in a domain | Centrally defined; reapplied at intervals; overwrites local changes |
| Mobile Device Management (MDM) | Smartphones, tablets, remote laptops | Device must be enrolled; works regardless of physical location |
| Configuration management tools (Ansible, Puppet, Chef) | Servers — Windows and Linux; cloud and on-premises | Desired state defined in code; continuously enforced |
| Cloud policy platforms (AWS Config, Azure Policy) | Cloud resources (VMs, storage, network configurations) | Native to the cloud platform; real-time compliance monitoring |
| Security Compliance Toolkit (SCT) | Windows environments; applying Microsoft-published baselines | Pre-packaged baseline files that can be imported and deployed directly |
Table 4 — Stable vs. Dynamic Baseline Settings
| Category | Characteristics | Examples | Maintenance Needed? |
|---|---|---|---|
| Stable settings | Long-established best practices; rarely change | Minimum password length, firewall blocking unused ports, least privilege, disable guest accounts | Rarely — deploy and monitor |
| Vulnerability-driven updates | New CVE discovered requiring configuration change | Disable a protocol version exploited by a new attack (e.g., TLS 1.0 retirement) | Yes — update baseline as vulnerabilities emerge |
| Application-update-driven | Updated app introduces new settings or removes old ones | New application version adds a security setting not in the previous release | Yes — review baseline with each major update |
| OS-migration-driven | New OS has different policy structure or options | Migrating from Windows Server 2016 to 2022 requires baseline review | Yes — full baseline review for each OS version change |
Table 5 — Configuration Drift: Causes and Risks
| Cause of Drift | How It Happens | Risk |
|---|---|---|
| Temporary manual changes | Admin opens port for troubleshooting; never closes it | Persistent attack surface on a system believed to be secure |
| Unauthorized software installation | User installs unapproved application that changes settings | New services running; potential malware introduced |
| Inconsistent updates | Patch applied to some systems but not all | Unpatched systems exploitable by known CVEs |
| Emergency changes not reversed | Setting relaxed during incident; never restored post-incident | Security posture permanently weakened without intention |
| Attacker modification | Compromised system has settings changed to maintain persistence | Weakened defenses; persistent foothold for attacker |
Table 6 — The Baseline Lifecycle: Establish → Deploy → Maintain → Audit
| Phase | Activities | Key Tools/Sources |
|---|---|---|
| Establish | Gather manufacturer recommendations; adapt to organizational needs; define approved settings; get formal approval | SCT, CIS Benchmarks, vendor hardening guides, organizational security policy |
| Deploy | Push baseline to all applicable systems via automated tooling; confirm deployment succeeded on all targets | Group Policy, MDM, Ansible/Puppet/Chef, cloud policy platforms |
| Maintain | Monitor for drift via continuous integrity checks; update baseline when vulnerabilities, app updates, or OS changes require it; test updates before broad rollout | SIEM, endpoint detection tools, configuration assessment platforms |
| Audit | Periodic formal comparison of actual configurations against baseline; produce compliance evidence; feed gaps back into remediation | Compliance assessment tools, change management records, audit reports |