Apply a published benchmark and count what it changed

short · 45 min · Objective 4.1

Task

Take a published secure-configuration benchmark, measure your VM against it, apply a subset, and measure again. The number of settings that were wrong on a default install is the argument for baselines, and it is bigger than people expect.

Steps

  1. Revert to clean, so the first measurement is of a default install rather than of your previous labs.
  2. Pick a published benchmark for your distribution — a CIS Benchmark or a DISA STIG — and choose twenty checks from it spanning password policy, SSH configuration, filesystem permissions, and services.
  3. Write /tmp/bench.sh: it evaluates all twenty on this host and prints PASS or FAIL per check with the check's name.
  4. Run it and record the baseline score to /tmp/score-before.txt. Note how many failed on a default install.
  5. Apply the fixes for the failing checks, one at a time, testing the machine still works after each.
  6. Re-run and record /tmp/score-after.txt. For any check you chose NOT to fix, write the reason in /tmp/exceptions.md with an owner and a review date.

Verify

bash /tmp/bench.sh | grep -c PASS
bash /tmp/bench.sh | grep -c FAIL
python3 - <<'PY'
def score(p):
    t=open(p).read()
    return t.count('PASS'), t.count('FAIL')
pb,fb=score('/tmp/score-before.txt'); pa,fa=score('/tmp/score-after.txt')
print('before: %d pass / %d fail' % (pb,fb))
print('after : %d pass / %d fail' % (pa,fa))
assert pb+fb>=20, 'fewer than twenty checks were evaluated'
assert fa<fb, 'nothing was actually fixed'
PY
grep -oE "[0-9]{4}-[0-9]{2}-[0-9]{2}" /tmp/exceptions.md | head -1

The assertion requires the failure count to have genuinely fallen. The last command must print a date if you left any check unfixed: an exception without a review date is how a deliberate decision becomes a permanent gap, which is the same finding as the undated compensating control in Domain 1.

Notes

The number that failed on a default install is the one to remember. Operating systems ship configured for compatibility, not for security, and 'we installed it and did not change anything' is a configuration decision — just not one anybody made deliberately.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.