Hardening with Scapolite: a DevOps-based Approach for Improved Authoring and Testing of Security-Configuration Guides in Large-Scale Organizations

TL;DR

This paper presents a DevOps-inspired approach for creating, maintaining, and testing security-configuration guides in large organizations, enhancing security hardening processes through automation and continuous validation.

Contribution

It introduces a systematic DevOps-based methodology for security guide authoring, maintenance, and testing, demonstrated through Siemens' implementation.

Findings

Automated pipelines generate implementation and validation artifacts.

Guides are maintained within git repositories for version control.

Testing is performed on AWS images to ensure correctness.

Abstract

Security Hardening is the process of configuring IT systems to ensure the security of the systems' components and data they process or store. In many cases, so-called security-configuration guides are used as a basis for security hardening. These guides describe secure configuration settings for components such as operating systems and standard applications. Rigorous testing of security-configuration guides and automated mechanisms for their implementation and validation are necessary since erroneous implementations or checks of hardening guides may severely impact systems' security and functionality. At Siemens, centrally maintained security-configuration guides carry machine-readable information specifying both the implementation and validation of each required configuration step. The guides are maintained within git repositories; automated pipelines generate the artifacts for implementation and checking, e.g., PowerShell scripts for Windows, and carry out testing of these artifacts on AWS images. This paper describes our experiences with our DevOps-inspired approach for authoring, maintaining, and testing security-configuration guides. We want to share these experiences to help other organizations with their security hardening and, thus, increase their systems' security.