Where to get OS Hardening Scripts for CIS Hardening Standards?

Question

• CIS provides benchmarks for hardening OS on AWS
• CIS also provides images which meet their own benchmarks above
• These CIS images are available here - https://www.cisecurity.org/blog/everything-you-need-to-know-about-cis-hardened-images/

I have 2 questions:

1. The pricing of these images says its $130/year (for software + AWS usage): Does this mean running costs of EC2 are also covered in this pricing? Also, is this pricing per instance? So if we need to use 100 instances, should we pay 13K per year?
2. Are there scripts available to "perform" these hardening tasks on the OS (to meet CIS hardening standards)?

Answer 1

The pricing of these images says its $130/year (for software + AWS usage): Does this mean running costs of EC2 are also covered in this pricing?

No.

If you read the details in the AMI Subscription page, it says in the last sentence: "Charges for using Amazon EC2 and other services from AWS are separate and in addition to what you pay to purchase AWS Marketplace software products."

"Also, is this pricing per instance? So if we need to use 100 instances, should we pay 13K per year?"

Yes. In the same AMI subscription page from the first answer, it states: "You can apply one annual subscription to an AWS Marketplace software product to one Amazon EC2 instance"

To find an estimate on total pricing, you need to go to the AWS Marketplace and filter for CIS. You choose the AMI, and click the cost details link. Then choose region and the instance type and a total cost estimate for that instance is shown.

"Are there scripts available to "perform" these hardening tasks on the OS (to meet CIS hardening standards)?"

Yes with a cost. They provide build kits if you are a member of the CIS SecureSuite. But not for every operating system. See the "Leveraging Build Kits" in this article.

Answer 2

https://www.open-scap.org/getting-started/

Use OpenSCAP to scan and remediate, it has CIS level 1 and 2 server profiles. I'm applying level 1 to my server, it's internal and level 1 leaves it quite usable. I tried applying the general server profile and it broke the server.