SEK SystemsDocs Open console

Dashboard guide

Hardening and benchmarks

Besides vulnerabilities, SEK Systems checks the configuration of your hosts: weak SSH settings, unused services, missing kernel protections, old kernels left behind, and so on. These checks appear on three places:

  • Recommendations (sidebar): all recommendations of the environment, with the hardening score.
  • Agents → host → Hardening: the checks and benchmarks of one host, with Fix all.
  • Findings, with the filter Config (hardening) only.

Hardening score

The hardening score measures configuration only, not vulnerabilities. The Recommendations page shows it for the environment, By area and Per group. Per recommendation you can Create plan or Accept risk.

Benchmarks

On a host's Hardening tab, the Benchmarks panel shows the benchmarks your environment follows (for example CIS, DISA STIG, the Microsoft security baseline or ANSSI): per benchmark, the share of the assessed items that pass, and the coverage, how much of the benchmark SEK Systems assesses at all.

Note

SEK Systems is aligned with these benchmarks. It does not certify compliance with them.

Choose the benchmarks under Settings → Hardening policy, for the environment or per group.

Modes

Per check, the hardening policy sets a mode:

Mode Means
monitor Only reported; SEK Systems never fixes it.
on approval Fixed through a plan that two people approve.
enforced An enforcement rule (approved by two people) keeps the hardened setting in place, within the maintenance window.

Fix all

Fix all (on a host's Hardening tab) and Fix all on N host(s) (on Recommendations, optionally limited to one benchmark) create the fixes in one go:

  1. A preview shows N fix(es) included, N high risk or restart, and N left out.
  2. Fixes with a high risk or that need a restart are not included unless you tick Include fixes with a high risk or a restart.
  3. Left out lists what is not included and why, for example "Could cut the agent off" (a change that could break the agent's own connection), an exception, a check in monitor mode, a fix that is already pending, or a manual-only fix.
  4. Request N fix(es) creates one plan per host with one job that applies all fixes for that host. Agents from version 0.3.56 support this.
  5. A second person approves under Approvals, all at once with Approve all (N) with one confirmation.
  6. The plans run in the maintenance window, with health checks and rollback. The first failure stops the rest.

Requesting fixes needs the operator, admin or owner role.