What is our primary use case?
My main use case for CIS Hardened Image Level 1 on Amazon Linux 2023 is to implement OS level hardening and mitigate vulnerabilities.
A specific example of how I use CIS Hardened Image Level 1 on Amazon Linux 2023 for OS hardening or vulnerability mitigation is the creation of a golden image, which requires a CIS hardened image where some of the services need to be blocked, or default ports need to be blocked. Some of the non-essential services which are open and can be exploited can be blocked, and some file-level access disabling needs to be done. I enable all these things using CIS Hardened Image Level 1 on Amazon Linux 2023.
We are using a Packer template where we create an image, a golden image, and then on top of it, we add the additional software required for that golden image. We then run it through a pipeline that integrates hardening steps by pulling hardening controls from a repository and implementing them on that image to create and generate a new image which is security hardened as per CIS Level 1.
How has it helped my organization?
CIS Hardened Image Level 1 on Amazon Linux 2023 has positively impacted my organization by allowing us to conduct vulnerability assessments using security tools, ensuring the images are hardened and do not bypass security vulnerabilities. Only images that meet the security guidelines given by the security team are rolled out into a live environment. We enforce controls at the OS level while having other controls at the network level outside the OS.
The specific outcomes or metrics we have seen from using these hardened images include a reduction in vulnerabilities. Implementing CIS hardening mitigated many of the vulnerabilities showing up as open CVEs in the vulnerability assessment report, leading to a definite reduction in vulnerabilities.
What is most valuable?
The best features CIS Hardened Image Level 1 on Amazon Linux 2023 offers are that it guardrails the image from being exploited, enables Security-Enhanced Linux, disables firewalls and firewall services, and covers many other things, including disabling root-level access.
Out of those features, I find everything essential for hardening an image, particularly SELinux, which is used to have file-level access control so we can regulate who can access a particular file. This allows controlling access within an operating system. Disabling and sometimes enabling firewall services, such as IP tables, can protect certain things.
What needs improvement?
CIS Hardened Image Level 1 on Amazon Linux 2023 can be improved by enforcing more controls at the granular level, and not only at the file level. For example, implementing certain restrictions at the storage level is an area that needs improvement apart from what we enforce at the file level.
Regarding CIS Hardened Image Level 1 on Amazon Linux 2023's AI capabilities, it has good features and a broad coverage in terms of governance and security. However, it should be closely monitored against open vulnerabilities and threats at the OS level, and the CIS hardening controls should be updated periodically to mitigate open vulnerabilities in an on-demand and prompt manner.
For how long have I used the solution?
I have been using CIS Hardened Image Level 1 on Amazon Linux 2023 for more than 10 years.
What do I think about the stability of the solution?
CIS Hardened Image Level 1 on Amazon Linux 2023 is very stable.
What do I think about the scalability of the solution?
So far, the scalability of CIS Hardened Image Level 1 on Amazon Linux 2023 is good, and I have not encountered any issues.
How are customer service and support?
I should mention that we do not have any customer support from CIS. The items we purchased are basically given to us by our security team, which we are rolling out in the images.
What was our ROI?
I have not seen a return on investment in terms of money saved, time saved, or fewer employees needed. However, I note that we are more secure now, which indicates a good return on investment.
What's my experience with pricing, setup cost, and licensing?
My experience with pricing, setup cost, and licensing is that pricing is legitimate. It is not overpriced, but it is reasonable.
What other advice do I have?
On a scale of 1 to 10, I would rate CIS Hardened Image Level 1 on Amazon Linux 2023 an eight.
I chose 8 out of 10 because, concerning our images, I see that most vulnerabilities and open issues reported in the vulnerability assessment report got mitigated, making it beneficial to have images hardened before using them in the production environment.
Regarding the accuracy and reliability of output from CIS Hardened Image Level 1 on Amazon Linux 2023, I find it good and close to accurate.
CIS Hardened Image Level 1 on Amazon Linux 2023 is deployed in my organization in both public cloud and on-premises environments, where we roll out individual environment-specific images that are embedded with hardening controls before any golden images are rolled out to ensure they are already hardened upon deployment.
In our public cloud deployments, we primarily use Amazon, but we also have Azure.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
