Question

If you are applying CIS benchmarks to a server, what is the specific action taken regarding unnecessary services to reduce the attack surface?

Accepted Answer

When applying CIS benchmarks to a server, the specific action taken regarding unnecessary services is to disable them. A service is a background program that performs a specific function for the operating system or applications, such as print spooling or web hosting. An attack surface consists of all the points or entry ways where an unauthorized user or malicious software can attempt to enter or extract data from a system. By disabling an unnecessary service, you stop the background process from running and close the associated network ports or system access points that the service might have opened. This reduces the attack surface because it eliminates potential vulnerabilities within that specific software that an attacker could otherwise exploit to gain control or access the system. To implement this, administrators consult the CIS benchmark guidelines to identify which services are not required for the specific function of the server and then use operating system commands, such as systemctl disable in Linux, to stop the service from starting automatically when the system boots.

Home → All Courses → Engineering and Technology Courses → Cybersecurity Engineering → Flashcard

If you are applying CIS benchmarks to a server, what is the specific action taken regarding unnecessary services to reduce the attack surface?