This blog post is a follow-up on our Windows Compliance with InSpec webinar by Joe Gardiner, Senior Solutions Architect and Christoph Hartmann, InSpec Creator that was presented live on April 11, 2017. In that webinar, we describe what Continuous Compliance is and we cover assessment with InSpec and remediation with Chef. This post provides additional material to help you learn more.
In case you missed the webinar, “continuous compliance” is a methodology for automating assessment and remediation of compliance policy with separation of duties for each part of that management cycle. Configuration management tools–like Chef, Puppet, or Ansible–can automate the remediation of compliance violations and InSpec allows you to automate the assessment. What makes this automation “continuous” is moving beyond ad-hoc manually driven periodic assessments and remediation events. To that end, the audit cookbook integrates both assessment and remediation into the same automatic event (a chef-client run) while maintaining the separation of duties critical to most information security standards.
The webinar dives into further detail. Here are some additional materials to help you get started with continuous compliance for Windows systems.
The InSpec development team regularly contributes to DevSec, an open-source project that provides compliance baselines anyone can use. The DevSec hardening framework provides two Windows benchmarks that will help you get started:
If you have a subscription to Chef Automate, that includes access to Chef-maintained and supported profiles that track the CIS industry standard.
The same technology powering the baselines above, InSpec, also allows you to create and implement your own assessments to automate compliance solutions specific to your needs. InSpec allows you to write your own profiles from scratch, import existing profiles as dependencies, and gives you constructs to pick and choose content from those dependencies so that you can quickly model overlay solutions when (for example) your company’s adopted information security policies deviate from industry standards.
InSpec contains a large set of built-in resources to automate assessments as well as the ability to create new custom resources. For some additional tips on creating custom profiles for Windows, check out this blog post from December.
That covers the assessment cycle in-depth, but what about remediation? Chef integrates wonderfully with Windows systems. But when considering remediation options it is important to be aware of existing tools in the Microsoft eco-system and defer to the proper one depending on your use case. Should you use Group Policy or Powershell DSC?
Group Policy is best suited to managing policy on workstations and for controlling patching policy via the WSUS client. It’s not suitable for non-domain joined machines or for programmatic control of devices.
DSC is most suited to server baseline builds, automation (DevOps), and applying Compliance remediation policy. It is important to note that existing DSC resources can be mapped into the Chef DSL very easily following the same resource structure as in the example below:
dsc_resource 'NAME' do resource :service property :name, 'NAME' property :startuptype, 'Disabled' property :path, 'D:\\Sites\\Site_name\file_to_run.exe' property :ensure, 'Present' property :state, 'Stopped' end
A more in-depth guide to help you choose is available in this TechNet blog post.
Between the webinar, InSpec tutorials, and the content above you should have enough to get started down the path of Continuous Compliance for Windows. Once you’re ready for more, these links may provide some additional useful places to dig in.