Secure baselines: establish, deploy, maintain

3.5 Security techniques for computing resources

📘CompTIA Security+ (SY0-701)

---

What Is a Secure Baseline?

A secure baseline is a standard configuration that defines the minimum level of security a system, device, or application must have before being put into use.

It acts as a starting point for building and maintaining secure systems. Once established, the baseline ensures that all systems are configured consistently and meet organizational security requirements.

Think of it as a template that defines:

• What security settings should be applied
• What software or services should be installed or disabled
• What access controls, patches, and configurations are required

Secure baselines help prevent security drift — which happens when systems gradually change from their approved configuration, creating vulnerabilities.

---

Why Secure Baselines Are Important

Secure baselines are essential because they:

• Ensure consistency: Every system follows the same security standards.
• Reduce vulnerabilities: Known insecure settings are disabled or corrected.
• Support compliance: Organizations can meet regulations and audit requirements.
• Simplify maintenance: Easier to detect unauthorized changes or misconfigurations.
• Improve recovery: If a system is compromised, it can be restored to a known good state.

---

Phases of Secure Baseline Management

There are three key phases in secure baseline management:

1. Establish
2. Deploy
3. Maintain

Let’s go through each one in detail.

---

1. Establish the Secure Baseline

This phase involves defining and creating the baseline configuration for each system type (for example, servers, workstations, network devices, or cloud instances).

Steps to Establish a Baseline:

1. Identify the System Type and Purpose
   • Understand what the system will do (e.g., web server, database, endpoint).
   • Determine what security requirements apply (e.g., data sensitivity, compliance standards).
2. Research Security Best Practices
   • Use trusted sources like:
     • CIS Benchmarks (Center for Internet Security)
     • NIST Security Configuration Checklists
     • Vendor Security Guides (e.g., Microsoft, Cisco, AWS)
3. Define Configuration Settings
   • Decide which settings and controls will be included in the baseline. For example:
     • Disable unused ports and services.
     • Set strong password policies.
     • Configure firewalls and antivirus.
     • Apply encryption for data at rest and in transit.
     • Set up secure logging and monitoring.
4. Test the Baseline
   • Apply the configuration to a test system to ensure:
     • It meets security standards.
     • It does not break system functionality.
5. Document the Baseline
   • Record every configuration and setting clearly.
   • Documentation helps ensure repeatability and supports audits.

---

2. Deploy the Secure Baseline

Once the secure baseline is created, it needs to be implemented across all systems that fall under that category.

Steps to Deploy a Baseline:

1. Use Automated Tools
   • Use automation to apply configurations quickly and consistently. Common tools:
     • Group Policy Objects (GPOs) in Windows environments
     • Configuration management tools such as:
       • Ansible
       • Puppet
       • Chef
       • Microsoft Intune
     • Cloud management services (AWS Config, Azure Policy, Google Cloud Security Command Center)
2. Verify Deployment
   • Confirm that the configuration was successfully applied on all systems.
   • Run vulnerability scans or configuration compliance checks to verify correctness.
3. Record the Deployed State
   • Keep records of what systems received the baseline and when.
   • Helps track compliance and detect systems that are out of date.

---

3. Maintain the Secure Baseline

Security is not static — systems change, new threats appear, and software updates are released.
So, the secure baseline must be regularly maintained and updated to stay effective.

Steps to Maintain a Baseline:

1. Monitor for Configuration Drift
   • Use tools to detect if systems deviate from their baseline.
   • Examples:
     • Security Information and Event Management (SIEM) systems
     • Endpoint detection and response (EDR) platforms
     • Configuration monitoring tools (Tripwire, Qualys, Nessus)
2. Apply Updates and Patches
   • Update the baseline when:
     • New patches are released.
     • New security threats are discovered.
     • Software or system requirements change.
3. Reassess and Revalidate
   • Review baselines regularly (e.g., quarterly or after major changes).
   • Retest them in a controlled environment before deploying updates.
4. Audit and Report
   • Conduct periodic security audits.
   • Compare current configurations against the baseline to identify noncompliance.
   • Document any exceptions and reasons for deviation.

---

Secure Baseline Example in an IT Environment

Here’s what a secure baseline might look like for an organization’s Windows server:

• All operating system patches applied.
• Only necessary roles and features installed (e.g., IIS for web servers).
• Remote Desktop restricted to admins only.
• Firewall enabled with specific rules.
• Local Administrator account renamed and password policy enforced.
• Logging enabled and forwarded to a central log server.
• Antivirus and endpoint protection configured.

Every similar Windows server deployed later will follow this same baseline to ensure consistency and compliance.

---

Common Exam Focus Areas

In the Security+ (SY0-701) exam, you may encounter questions that test:

• The purpose of secure baselines.
  → To ensure consistent, hardened configurations across systems.
• The phases of baseline management: establish, deploy, maintain.
• The tools used for applying and verifying baselines.
• The importance of monitoring configuration drift and updating baselines.
• The connection between baselines and compliance frameworks (like CIS, NIST, ISO 27001).

---

Summary Table

Phase	Goal	Key Activities
Establish	Create a secure configuration standard	Identify requirements, define settings, test, document
Deploy	Apply the baseline to systems	Automate configuration, verify deployment, record changes
Maintain	Keep baseline up to date and consistent	Monitor drift, patch systems, audit compliance

---

✅ Key Takeaways

• A secure baseline defines the minimum security configuration for systems.
• It ensures uniform, compliant, and secure environments across an organization.
• Security baselines must be established, deployed, and continuously maintained.
• Use automated tools and auditing processes to enforce and verify compliance.
• Regular reviews keep the baseline relevant to new threats and technologies.