Reply to thread

Message

<blockquote data-quote="bazang" data-source="post: 1120842" data-attributes="member: 114717">It is a tool that scans systems and provides recommendations for configuration (system hardening). It is used mostly in regulated industries and government, where all participants must meet mandated configuration management (CM) requirements. The hardening recommendations are based upon Microsoft Security Baselines, NIST 800-53 revisions 4 and 5, NIST 800-160 volumes 1 &amp; 2, NIST 800-171 revision 2, about another 20 NIST frameworks, U.S. DoD Security Technical Implementation Guides (STIGs), Security Classification Guides (SCG), recommendations from the U.S. NSA, UK GCHQ, Australian Signals Directorate, and a bunch of other &quot;Guidelines and Frameworks&quot; from the corpus of IT security best practices.To do configuration management correctly, you must document everything that you do - meticulously. Otherwise when it comes time to troubleshoot, without that configuration map, you will not be able to figure out what you did.If you are not aligned with that requirement, then just play with the tool in a VM to satisfy your curiousity.</blockquote>

[QUOTE="bazang, post: 1120842, member: 114717"] It is a tool that scans systems and provides recommendations for configuration (system hardening). It is used mostly in regulated industries and government, where all participants must meet mandated configuration management (CM) requirements. The hardening recommendations are based upon Microsoft Security Baselines, NIST 800-53 revisions 4 and 5, NIST 800-160 volumes 1 & 2, NIST 800-171 revision 2, about another 20 NIST frameworks, U.S. DoD Security Technical Implementation Guides (STIGs), Security Classification Guides (SCG), recommendations from the U.S. NSA, UK GCHQ, Australian Signals Directorate, and a bunch of other "Guidelines and Frameworks" from the corpus of IT security best practices. To do configuration management correctly, you must document everything that you do - meticulously. Otherwise when it comes time to troubleshoot, without that configuration map, you will not be able to figure out what you did. If you are not aligned with that requirement, then just play with the tool in a VM to satisfy your curiousity. [/QUOTE]

Verification