4.1 Secure Baselines

Secure Baselines

Defines the required security settings for an application environment, such as firewall rules, patch levels, and OS file versions.

• All application instances must adhere to this to ensure consistent protection.

• Since environments can change over time, regular checks are necessary to confirm compliance.

• If any instance deviates from the this, corrective action should be taken immediately to restore proper security.

Establish Baselines

You don’t need to start from scratch. Many vendors already provide foundational security that you can adapt to your organization’s needs.

• For example, application developers may offer this with recommended file permissions and configuration settings.

• Operating system vendors like Microsoft also publish security this.

• Manufacturers of purpose-built appliances often provide their own as well

Can be complex due to the number of settings involved, but using these existing resources helps streamline the process.

Security Compliance Toolkit (SCT)

The Microsoft website includes a series of security baselines for Windows operating systems and Windows Server.

• And they even include tools that you can use to help deploy it.

Deploy Baselines

Once you've compiled your list of security settings for the application, operating system, and related components, the next step is this.

• Can often be done through a central console like the Microsoft Security Compliance Toolkit.

• In some cases, additional tools or processes are needed—such as using Active Directory, Group Policy or an MDM solution for mobile devices.

• Automated deployment helps ensure that baseline settings are consistently applied across hundreds or thousands of devices efficiently.

Maintain Baselines

While most security baselines rarely change, occasional updates are necessary.

• New vulnerabilities, software updates, or the installation of a new operating system may require changes to your existing baselines

• Test and measure these changes to avoid conflicts—especially when different vendors provide overlapping or contradictory recommendation

• Evaluate and choose the most appropriate settings for your specific environment