CHS Server Hardening Automation

The CHS learning mode capability:

• Indicates the reason why an object can’t be hardened, marks the object, and saves it as an exception.
• Compares different policies for a single server, thus, allowing you to choose the strictest possible hardening policy that won’t affect operations at all.
• Enables a Sys Admin to learn one server and apply the policy to a group of identical servers.
• Aids in the management of conflicts with Group Policy Objects (GPO).

CHS performs an automated impact analysis on actual production systems. This essentially means zero server outage and zero investment of your engineer’s time in testing.

1. Discovers the object’s current status – shows its “actual values”.
2. Displays the desired policy value.

Further, it indicates the impact of hardening as the following:

• True: The expected values and actual values are identical.
• False (red): The object is used by the production system and the actual value is valid – therefore, hardening the desired value will cause damage to servers in production.
• False (yellow): The value will be changed while enforcing the policy – with no impact on the server’s operation.
• Creates a “ready-to-go” policy in accordance with the gap analysis report.

CHS automates Hardening of windows server baseline policies for the OS and the application layers. All the policies are created according to the known standards and/or the best custom made Organizational Hardening practices. The CHS hardening management platform enables a drill down to a single server so that a dedicated policy can easily be created for different servers, based on the role and applications installed.

Server Roles Hardening:

Domain Controller, Hyper-V, Member server, Print server, File server, Application server, Web Server, Mail server, Database server, Terminal server, DNS/DHCP/Wins server, Remote access/VPN server.

Internal Applications Hardening:

Due to the advanced cyber threats  faced by the enterprises these days, special attention is given to the security controls of critical applications.  CHS also provides dedicated rules and policies for hardening management of internal applications, such as:

Active directory, SQL, IIS

Windows Operating System Hardening:

Windows 2000, Windows 2000 Datacenter, Windows server 2003 (32/64 bit), Windows server 2008 (32/64 bit), Windows server 2008 R2(64bit), Windows server 2012(64bit), Windows server 2012 R2(64bit), Windows server 2016, Nano server, Windows server 2019, Windows server 2022

CHS provides continuous hardening, monitoring and prevention. The monitoring mode prevents user errors and combats malicious activities. It provides access control rules that permit only authorized users to change the hardened baseline. CHS prevents policy object changes and issues configurable warnings and alerts, in real-time.

The CHS monitoring mode capability:

• Hardens security policies for the OS and applications.
• Uses organizational policies for the hardening of dynamic processes.
• Performs verification and reports on any changes and errors that occur during the hardening process.
• Cross-platform change management: One-click rollback to the previous policies. The rollback action can be reviewed in the system-generated reports as well.
• Easy policy modification from one centralized dashboard.
• Provides real-time prevention of unauthorized changes to the hardened servers.
• Issues real-time policy violation alerts.
• Generates policy violation reports.
• Controls access to data and system objects – including files, directories and shares.