CHS for Linux

The CHS learning mode capability:

• Indicates the reason why an object can’t be hardened, marks the object, and saves it as an exception.
• Compares different policies for a single host, allowing you to choose the strictest possible hardening policy that won’t affect operations at all.
• Enables a Sys Admin to learn one host and apply the policy to a group of identical hosts.
• Aids in the management of the integration between configuration management tools (PUPET, CHEF, ANSIBLE).

CHS performs automated impact analysis on production. This essentially means zero server outage and zero investment of your engineer’s time in testing.

• Discovers the object’s current status – shows its “actual values”.
• Displays the desired policy value.

Further, it indicates the impact of hardening as the following:

• True: The expected values and actual values are identical.
• False (red): The object is used by the production system and the actual value is valid – therefore, hardening the desired value will cause damage to the host in production.
• False (yellow): The value will be changed while enforcing the policy – with no impact on the host’s operation.
• Creates a “ready-to-go” policy in accordance with the gap analysis report.

CHS for DevOps is centralizing the enforcement of the desired policy on production:

• Reduces privileged authorized people required for enforcement to a minimum.
• Easier to manage than traditional enforcement methods, therefore minimizing unwanted configuration drifts.
• Offers cross-platform change management: One-click rollback to the previous policies. The rollback action can be reviewed in the system-generated reports as well.
• Allows easy policy modification from one centralized dashboard.

The CHS change control capability:

• Performs gap analysis in a fixed interval.
• Issues policy violation alerts when values discovered to be changed.
• Enforces the desired values if any unwanted change was executed.