4.1a — Security Baselines (9)

Security baseline

The defined set of security configurations (firewall settings, patch levels, permissions, OS settings) applied consistently every time a system or application is deployed.

Baseline sourcing

Baselines don't have to be built from scratch; vendors (app developers, OS manufacturers, appliance makers) publish their own recommended baselines to start from.

SCT (Security Compliance Toolkit)

Microsoft's tool providing pre-built security baselines for Windows and Windows Server, plus deployment tooling.

Group Policy

Windows mechanism, via Active Directory, for centrally pushing configuration and security settings to many machines.

MDM (Mobile Device Management)

Centralized tool for pushing security settings and baselines specifically to mobile devices.

Baseline deployment automation

Using centralized tools (SCT, Group Policy, MDM) to push a baseline to hundreds or thousands of devices at once rather than manually.

Configuration drift

A system deviating over time from its originally deployed secure baseline, through manual changes, missed patches, or unmanaged updates.

Baseline maintenance triggers

Reasons a baseline needs updating: new vulnerability discovered, application update, new OS deployed, conflicting vendor baselines needing reconciliation.

Baseline auditing

Ongoing verification, after deployment, that systems still match the defined baseline.