Anyone want to try a test CompletelyBonkers (new user here) turned me onto?

[Alec§taar]

how-e-ever, I got a 3.75 this time.....gotta try some other versions too, do report this glitch

Eventually, when I reply to that "std. form letter" above (me writing BELARC back), I will supply them my file from the browser it generates, & then each point will be addressed by myself, & WHY I KNOW SOME ARE WRONG!

(... & why I think others are as well, in the points it scored me bad on for my 5.00/10 score).

In fact, I am going to probably point their people @ this thread as well, so they can see your problems with it as well, & objections.

This is so we can get to the bottom of this, & improve this program (if possible) and also our own security (plus our scores).

I've downloaded 7.2M, and started it, and now it thinks my vista ultimate is 2000

Is that the NEWEST/LATEST GREATEST, or OLDER MODEL? I am just curious in that regard, thanks...



* Thanks for reply, no hurry... & GOOD SCORE NEVERTHELESS on your end, @ 3.75 this round on VISTA (fully patched on your end in OS updates/servicepacks/hotfixes + AntiVirus' being updated too)...

APK

 

[BXtreme]

i think it's a little old, cuz it says p3, but i have c2d at 1.93 LOL.
oh, and it's 7.2'M' confuses me a bit, latest version on download.com says 7.2k ???
i picked up the 'm' one from pcworld, while searching for old versions of belarc.
and i also don't think, belarc advisor knows what's my hardware and what sp i have installed.
BUT, it's a bit confusing that different old versions gave me different but above 3.5 results, so when it officially supports Vista, i may get a higher score
Looking forward for belarc reply with you

 

[Alec§taar]

Looking forward for belarc reply with you

As am I... I am going to finish this up, hopefully, today!

* In any event, it's been an interesting experiment... & I intend to raise that 5.00/10 score I got shown above!

APK

P.S.=> HOPEFULLY, writing them will get some amendments done to this program, OR upset some assumptions I make possibly, regarding securing a PC... apk

 

[Alec§taar]

Well, off this letter went to BELARC today... awaiting answer, & I pointed them here

Here is what I wrote the folks @ BELARC today:

==============================

The problem is NOT in the program's operation, OR, version I use, per your std. form letter reply:

It is more on issues I saw on its analysis. I like the program, & would like to better it, OR be proven wrong in my assumptions so I can secure myself further.

Also some folks on forums.techpowerup.com have noted difficulties in the program.

E.G.-> I have scored 5.00/10 possible, but feel that in some cases, the program is NOT analyzing security absolutely properly. I am using the latest build by the way.

Here was the testing & what we found for your reference (below that are my personal objections to its findings):

http://forums.techpowerup.com/showthread.php?t=25428

To wit/some examples:

------------------------------------------------------------------
Available Services and Other Requirements section BELARC ADVISOR:
------------------------------------------------------------------
* I am being scored downwards on services I do NOT have enabled here (set disabled), period, first of all. I also secondarily secured said services by lessening their logon entity from SYSTEM to LOCAL SERVICE as well. Why then, am I being 'down-scored' on services which are NOT active AND have had their logon entity 'powered down' ontop of that as a security measure?

------------------------------------------------------------------
Security Settings section of BELARC ADVISOR:
------------------------------------------------------------------
17. Interactive Logon: Smart Card Removal Behavior

* I use no smartcard here period. This was amended in secpol.msc as well.

25. Network Access: Remotely Accessible Registry Paths
26. Network Access: Remotely Accessible Registry Paths and sub-Paths

* Within the regsitry I completely BLANKED THOSE OUT & have for years... & my system runs just fine. If I have none there that are remotely accessible, why then am I being downgraded?

* Again, if your technical staff would like my output files? They're included in this mail as the attached file (.rar file)...

Sincerely,

Alexander Peter Kowalski
apk4776239@hotmail.com

P.S.=> She's a GOOD program, but I feel it makes some incorrect assumptions & yes mistakes. Perhaps I am wrong, but I think not on the counts noted above regarding security, & others if you need them the program noted as WRONG are in the attached .rar file... this will help to make the program BETTER! apk

==============================



* Well, one way or another? We SHOULD get some answers... not only to my examples above, but possibly your objections & findings too gents!

APK

 

[ktr]

If you have belarc's products/services installed, for sure you will score a 10/10...

 

[Alec§taar]

If you have belarc's products/services installed, for sure you will score a 10/10...

LOL! Good point... per the tune by Queensryche, REVOLUTION CALLING: "And, now the Holy Dollar rules everybody's live: GOTTA MAKE A MILLION, doesn't matter who DIES"



* Well, in any event, I have to 'blow past' the person who sent me the letter, & get to the folks that do the actual coding... they're WHO I want to converse with on this matter!

APK

 

[ktr]

Well i am looking at there services: http://www.belarc.com/belsecure.html

for $5000+ they will come and audit you computers and ...

BelSecure features include the following:

* Automated, daily vulnerability assessment, including all Microsoft OS and Office vulnerabilities, anti-virus status, user account status, and more.
* Web portal architecture. WAN based operation. Single Intranet server and database.
* Automatic comparison with CIS and other benchmarks.
* Automatically collects all of the configuration and vulnerability data into a central repository, or CMDB.
* Helps automate security processes such as FISMA, HIPAA and FFIEC.
* Certified to work with Cisco's NAC (Network Admission Control) system. click here for details.

5/10 = 10/10

 

[Alec§taar]

Well i am looking at there services: http://www.belarc.com/belsecure.html

for $5000+ they will come and audit you computers and ...



5/10 = 10/10

Remember what I said in this thread, early on? YOU CAN LEARN THIS YOURSELF... just by doing this & other stuff I have listed on the forums...

Learn, to EARN...

APK

 

[ktr]

Remember what I said in this thread, early on? YOU CAN LEARN THIS YOURSELF... just by doing this & other stuff I have listed on the forums...

Learn, to EARN...

APK

amen!

Funny thing is that belarc told us the steps on what it takes to achieve 10/10...if you refer the my previous post, that is what they are auditing, therefore that is what they are rating us on. But this is mostly for corp. computers rather than the home user.

 

[Alec§taar]

amen!

Funny thing is that belarc told us the steps on what it takes to achieve 10/10...if you refer the my pervious post, that i what they are auditing, therefore that is what they are rating us on.

Hence you earlier statement, that IF one puts their services offered into motion, for "5 gravities" worth of ca$h? You score 10/10...

Ah man...

"BUT NOW I SEE PAYOFFS EVERYWHERE I LOOK - who do you trust, when everyone's a crook?"

&

"Everybody's using everyone, MAKING THE SALE"

Per the band & tune I quoted above earlier...

Your viewpoint's a LOT like that tune is, & that IS MY VIEWPOINT...

APK

P.S.=> Still, my personal animosities for today's society aside? I am going to give them the 'benefit of the doubt' to discuss the issues I noted above, holding me down apparently, from a higher score & according to their program also, IMPERFECT SECURITY HERE... possible, but I DO FEEL their program errs, & too much! I would like to see it improved on several accounts is why (OR, conversely, POSSIBLY some bad assumptions on MY end, this is possible too)... it is a GOOD thing, for the most part! apk

 

[ktr]

Here is another auditor i have found, really complex, certified CIS scoring:

http://www.cisecurity.org/tools2/windows/ng_scoring_tool-gui-1.0-win32.exe

and the manual: http://www.cisecurity.org/tools2/usersmanual/CIS_NGTool_Users_Manual-public.pdf

 

[Alec§taar]

I hauled those down, days ago... not the pdf though, thanks for THAT!



What bothered me about it though, was iirc, when I tried to install it? IT DEMANDS I HAVE JAVA IN PLACE... a security violation period, imo @ least!

APK

P.S.=> Ok, I 'gave in' & installed it for now, for THIS test... I seem to do better on it, only a few objections thusfar, but I only ran 1 of its tests (it too, makes mistakes, but the program was written prior to Windows Server 2003 having patches - I am UP TO DATE on those, running it here in a "workstation" capacity ONLY, & the tests are geared MORE to domain controllers etc.)...

#1.) IT also makes a mistake on POSIX & subsystems, like BELARC did:

-------------------------
3.2.1.63 3.2.1.63 System settings: Optional subsystems Check Type: Status:
Questionnaire Failed
Description

Here you can define subsystems which support running applications. The default entry of “POSIX” allows the POSIX subsystem to run. Defining this option but leaving the list blank will effectively disable the POSIX subsystem, which is only useful for Unix emulation services running on Windows.

Subsystems can spawn processes which access multiple user sessions. The poorly written subsystem may allow a process to escalate privileges by accessing another account's process
-------------------------

I burnt those out using secpol.msc, when I installed the OS, & BOTH programs mess up here too! BUT, iirc, they keep libs on the System (dlls iirc) & perhaps I have to find those & chop them out? I don't know...

#2.) I set this as "for systems under attack" & yet I get this?

-------------------------
3.2.1.67 MSS: (AFD MaximumDynamicBacklog) Maximum number of 'quasi-free' connections for Winsock applications Check Type: Status:
OVAL Failed
Description

A “quasi-free” connection is one in which the SYN packet is sent, but the full TCP 3-way connection handshake is not yet complete. This setting defines the number of uninitiated and the number of quasi-free connections per listening endpoint.
-------------------------

?

3.) BELARC ADVISOR FAILS ME ON THIS ONE, YET KTR'S CIS TOOL TEST PASSES ME!

-------------------------
4.1.37 Trivial FTP Daemon Check Type: Status:
OVAL Passed
Description

Trivial FTP (tftp) offers a lightweight, unauthenticated version of the FTP protocol. The service is typically used for bootstrapping devices during automated startup, and is part of the requirements for a Remote Installation service (see 4.1.24). However, tftp is also a favorite protocol for propogation of worms and Trojan horse applications, and should be disabled wherever possible
-------------------------

NOTE your test, ktr, the one which BELARC is based on? Passes me here, but BELARC fails me, & on ALL OF THE PROGRAMS IN ITS LIST (21 of them no less, but I KNOW THIS IS OFF)!

I secured them via NTFS rights long ago, yet still BELARC ADVISOR fails me?

4.) BELARC FAILS ME HERE, KTR's CIS TOOL TEST DOES NOT (again):

-------------------------
4.2.39 Take ownership of file or other objects Check Type: Status:
OVAL Passed
Description

A user who “owns” a file has greater authority over that file than even the permissions would suggest. The right to take ownership of a file is equivalent to the ability to compromise an entire file system.
-------------------------

(Editing more examples coming)... apk

 

[Alec§taar]

Aha, I see somebody named "BelArcGuy" browsing now... here we go maybe?

http://forums.techpowerup.com/member.php?u=36847



* BelArcGuy - if you are browsing the results here, thanks for showing up, & setting myself & others here straight IF need be!

APK

P.S.=> Per my letter, the program's decent, but I have objections... thanks! apk

 

[ktr]

I hauled those down, days ago... not the pdf though, thanks for THAT!



What bothered me about it though, was iirc, when I tried to install it? IT DEMANDS I HAVE JAVA IN PLACE... a security violation period, imo @ least!

APK

It requires Java Virtual Machine to work

 

[Alec§taar]

It requires Java Virtual Machine to work

See my above post... the VERY one you quoted from in fact!



I edited in the fact I let Java install, which I USUALLY WON'T (it has holes & I try to minimize that, & though it was touted as having an 'impenetrable sandbox'? Today we KNOW this is NOT true!)... & noting outright errors in BOTH this program AND BELARC, @ least as far as I understand this stuff!

See above, the post you quoted of mine, I am editing it as I go w/ examples.

APK

P.S.=> I am going to stop posting now, & let BelArcGuy do HIS thing... apk

 

[BelarcGuy]

Hi Alec§taar,

Thanks for your kind words about the Belarc Advisor, and for leading this "challenge" to get the best CIS benchmark score. Other forums have had a similar challenge, with some of the users easily getting 10 scores (using a security configuration template file to make the settings). Let me warn all readers that incorrectly changing the security configuration of your Windows computer can make it completely unusable, requiring an OS reinstall or restore from backup. It's best to test these security settings on a test computer (Virtual PC is free) before applying them to any production computer.

First let me point out that the Center for Internet Security benchmarks are authored by a consortium of security experts from the US Government and industry. Belarc is providing easy access to them in the Advisor, but is not the "authoritaty" behind these benchmarks. The CIS benchmark documents (also accessible by clicking links within the Advisor's CIS benchmark report) provide reasonably complete justification for many of the security settings, so you should read those. However, do note that those documents can't completely reproduce the back-and-forth discussion between the consortium members on each of these settings.

That said, I'll try to address your concerns below, interspersed with your posting:

------------------------------------------------------------------
Available Services and Other Requirements section BELARC ADVISOR:
------------------------------------------------------------------
* I am being scored downwards on services I do NOT have enabled here (set disabled), period, first of all. I also secondarily secured said services by lessening their logon entity from SYSTEM to LOCAL SERVICE as well. Why then, am I being 'down-scored' on services which are NOT active AND have had their logon entity 'powered down' ontop of that as a security measure?

The benchmark calls for the services to both be set to a specific run state (e.g. disabled) and have their ACLs set to prevent malicious applications from simply changing that run state and starting them up. See the security template editor for how to put ACLs on services.

------------------------------------------------------------------
Security Settings section of BELARC ADVISOR:
------------------------------------------------------------------
17. Interactive Logon: Smart Card Removal Behavior

* I use no smartcard here period. This was amended in secpol.msc as well.

There are many OS options that best practices recommend to be secured whether or not installed. Although a bit academic, this certainly helps keep a system from immediately becoming vulnerable upon enabling the option. In your case this setting could be made and when/if you ever plug in a smart card you'll be "ready".

25. Network Access: Remotely Accessible Registry Paths
26. Network Access: Remotely Accessible Registry Paths and sub-Paths

* Within the regsitry I completely BLANKED THOSE OUT & have for years... & my system runs just fine. If I have none there that are remotely accessible, why then am I being downgraded?

Our licensed professional tools can also consider these blanked out registry values as more secure than the CIS recommended settings, however the free Advisor doesn't have that capability. As you can imagine, it's not possible to compare an arbitrary set of registry paths to the CIS recommendations and determine if they are more or less secure. For that reason the Advisor requires an exact match to the CIS recommendations for these settings.

Best of luck to you all getting your CIS score higher!

 

[Alec§taar]

Hi Alec§taar,

Thanks for your kind words about the Belarc Advisor, and for leading this "challenge" to get the best CIS benchmark score

No problem about the thanks from you - YOUR program is a good idea, & FREE!

Other forums have had a similar challenge, with some of the users easily getting 10 scores (using a security configuration template file to make the settings).

Well, I have questions on some of the scores it gave me (edit, more on next page with photos of each section & how I set them up, with what tools, & more - please answer the questions there as well, thanks)...

Now, you mention ACL's here: Does this mean going to the particular services' DLL or EXE & setting NTFS rights on them? Because afaik, doing the logon entity IS securing their ACL!

Some ideas of those templates don't 'fit' here though, I note 1 below (regarding NTFS on all diskdrives, & I have to make an exception on that note, see below, later in my P.S. why).

Let me warn all readers that incorrectly changing the security configuration of your Windows computer can make it completely unusable, requiring an OS reinstall or restore from backup. It's best to test these security settings on a test computer (Virtual PC is free) before applying them to any production computer.

Understood & I WARN FOLKS ABOUT THAT IN A SECURING SERVICES STICKY THREAD I AUTHORED IN THE GENERAL SOFTWARE SECTION HERE IN FACT... good move on your end too!

Securing Windows 2000/XP/Server 2003 services HOW TO:

http://forums.techpowerup.com/showthread.php?t=16097

First let me point out that the Center for Internet Security benchmarks are authored by a consortium of security experts from the US Government and industry.

I understand... it's impossible in ALL cases/circumstances, to fit every security scenario perfectly.

However - I hate to put it THIS way, but some PhD's & experts have taken a beating from me before & to the point they either RAN online, or did not reply vs. proofs I had made... Dr. Mark Russinovich being one example thereof.

Belarc is providing easy access to them in the Advisor, but is not the "authoritaty" behind these benchmarks.

Again, understood - there is no "uber" advisor in any field most likely... especially complex fields, like computers.

Agreed, 110%...

Here? I am just trying to point out things I noted in your program is all that I feel ARE off, & not just by my own view - vs. CIS tools as well!

See 4 posts above, or the URL I post in this page below...

The CIS benchmark documents (also accessible by clicking links within the Advisor's CIS benchmark report) provide reasonably complete justification for many of the security settings, so you should read those. However, do note that those documents can't completely reproduce the back-and-forth discussion between the consortium members on each of these settings.

http://forums.techpowerup.com/showthread.php?p=281278#post281278

I cite examples a few posts (the URL directly above posted for YOUR reference) up though, using THEIR CIS tool, that contradict what BELARC ADVISOR SHOWS... please, see above 2-3 posts, to see what I mean.

That said, I'll try to address your concerns below, interspersed with your posting:

All I ever wanted... let's go!

and have their ACLs set to prevent malicious applications from simply changing that run state and starting them up. See the security template editor for how to put ACLs on services.

Again:

Securing Windows 2000/XP/Server 2003 services HOW TO:

http://forums.techpowerup.com/showthread.php?t=16097

I have put that up here to do the ACL change on services. How to secure them. If you have time, take a peek there, it is, afaik, CORRECT!

The benchmark calls for the services to both be set to a specific run state (e.g. disabled)

Most of those noted here ARE... disabled (or manual) & additionally, set with LOWER than SYSTEM logon entities, THIS is done in case they are SOMEHOW turned on, even if set disabled, they cannot run out of the privelege token assigned of LOCAL SYSTEM (far weaker than system).

I set some manual, because at times? I use them... saves time. This is why I set some of them as LOCAL SERVICE too, some run ok that way.

I guess I had BEST CHECK if all of them are disabled... for sure.

There are many OS options that best practices recommend to be secured whether or not installed. Although a bit academic, this certainly helps keep a system from immediately becoming vulnerable upon enabling the option. In your case this setting could be made and when/if you ever plug in a smart card you'll be "ready".

Fair enough on that one, it is academic in my case, no smartcard...

Our licensed professional tools can also consider these blanked out registry values as more secure than the CIS recommended settings, however the free Advisor doesn't have that capability.

Got ya... so, I should be scored higher is what you are saying... a bug?

As you can imagine, it's not possible to compare an arbitrary set of registry paths to the CIS recommendations and determine if they are more or less secure. For that reason the Advisor requires an exact match to the CIS recommendations for these settings.

Understood, & I know that it is nearly impossible to be able to get ALL of the permutations in code & OS' down 100%, @ least not right away & especially IF they change (a program I have hosted here for others, good for security in many ways no less, had to take SOME changes to work on VISTA, & I spent part of my nite redong its config, not it's exe, unneeded, for it to work on VISTA), too much change in other words...

I know, because I've been coding for almost 20 years now, 15 as a pro.

Best of luck to you all getting your CIS score higher!

Trying my man... trying!



http://forums.techpowerup.com/showthread.php?p=281278#post281278

* See the list above, again for your reference the URL directly above, which is 4 posts up from this reply of mine in fact though!

It's where I noted exceptions in BELARC ADVISOR vs. CIS SCORING TOOL, the source who's tool you use, yes?

THANKS!

APK

P.S.=> I don't like acting the way I did above (about Dr. Mark R., he & I used to work for the same shop & he's GOOD @ this stuff) & other "experts" out there, because I know 1 thing about them: They're human, they DO ERR!

Heck, I do too, sometimes intentionally (like the NTFS rights on ALL disks, but I do that WITH GODO REASON (to not waste diskspace on a very small SSD I run here for added speed)).

However, in my statement about "running a few into the ground"? It's fact... Above all though - I am NOT out to 'show you up' or otherwise be an ass... I just want to make sure I am solid!

Basically, I am just trying to make this program of YOURS better, because it's a great idea, free, & works... but, by the same token?

I want to know I am doing the RIGHT thing for security here... so far, so good, but per the URL here (again):

http://forums.techpowerup.com/showthread.php?p=281278#post281278

I see contradictions... between BELARC & THE CIS SCORING TOOL... outright ones. Perhaps it is something to look at on your end, thanks, & good luck! apk

 

[BelarcGuy]

Hi Alec§taar,

The CIS' scoring tool is not in any way related to the Belarc benchmark scoring engine, so you should talk to the CIS folks about issues you find with their tool. We're happy to talk about the Advisor, and welcome your comments.

It seems that perhaps one recurring theme in your tests is that you make some security settings that are logically "better" than those called out by the CIS that aren't reasonable to expect a benchmark scoring program to interpret as such. One example is that you've set the services with ACLs "LOWER than SYSTEM logon entities", yet that's a very hard thing for a program to interpret. All current benchmark scoring programs have limitations in the interpretation of "better" settings than recommended. However, it's rarely an issue in practice.

What most security folks do is use a security template (with the CIS benchmark settings already in it) that lets you just set all the benchmark settings in one shot. Then they modify that template to suit their needs (e.g. allow IIS to run on WinXP Pro).

 

[Alec§taar]

Hi Alec§taar,

The CIS' scoring tool is not in any way related to the Belarc benchmark scoring engine, so you should talk to the CIS folks about issues you find with their tool. We're happy to talk about the Advisor, and welcome your comments.

Hi, Ok... I thought it was? It bears the SAME descriptions in its explanations the CIS tool does in fact!

Oh well...

Still, it disagrees w/ your tool, if you checked above...

E.G.-> About securing things like the tftp.exe (trivial ftp) for instance... I did the NTFS ACL on that & 20 others it states I am 'off/wrong' on!

Still BELARC ADVISOR states it is WRONG/OFF above... but the CIS tool says I am ok?

It seems that perhaps one recurring theme in your tests is that you make some security settings that are logically "better" than those called out by the CIS that aren't reasonable to expect a benchmark scoring program to interpret as such.

Agreed... especially for scenarios I uniquely have to deal with...

E.G.-> The NTFS on all disks is one above, on my pagefile.sys partition on a Solid State Ramdisk here...

Reason for it here? I do NOT want to lose 20% of its space using NTFS & offset risk (pagefile.sys is the ONLY file on that part of my SSD) by clearing the pagefile.sys @ shutdown.

One example is that you've set the services with ACLs "LOWER than SYSTEM logon entities", yet that's a very hard thing for a program to interpret.

I know, & accept that fact... so, it is just a warning then! Still here is an area your program should ASK THE USER what is up then... your tools should ASK FIRST, as the CIS tool noted above does for various things!

Just a suggestion, & one to make the program MORE ACCURATE.

I.E.-> I know one thing: I would not lie to a program, or person, that was asking me questions on how to secure my home... OR, my computer, for example.

All current benchmark scoring programs have limitations in the interpretation of "better" settings than recommended. However, it's rarely an issue in practice.

I know that for sure, per my statements above on coding... lol, BOY do I know that.

What most security folks do is use a security template (with the CIS benchmark settings already in it) that lets you just set all the benchmark settings in one shot. Then they modify that template to suit their needs (e.g. allow IIS to run on WinXP Pro).

I thought CIS stuff was not related to BELARC stuff? I don't understand... oh well, I see your views now, & know what I have to do... going for more than 5.00/10 here.

Still, I feel your program is making some errors, & should ask a few questions first, as the CIS tool does... when you are NOT sure of the status of say, a services' logon entity (for securing it) or other areas in question I noted above.

APK

 

[BelarcGuy]

Hi BXtreme,

Sorry for the suprise. The Belarc Advisor version that's fully qualified for Vista (released last month) respects the CIS benchmarks by applying them only (and automatically) to the OS they're designed for. That's because there's little point in using a benchmark that tests security settings that are non-existant or obsoleted or superceded in the OS being used. With hundreds of security settings to pay attention to, we don't need any more distractions than we already have.

The CIS has begun discussions of their Vista security benchmarks but hasn't agreed upon anything yet. You might want to join the CIS and participate in those discussions, if you enjoy that kind of thing.

OMGWTF!!! Now that I start belarc in Vista it says only compatible with 2000, XP, 2003 ???? last time it didn't say anything, what's happened ???

 

[Alec§taar]

The CIS has begun discussions of their Vista security benchmarks but hasn't agreed upon anything yet. You might want to join the CIS and participate in those discussions, if you enjoy that kind of thing.

Well, one thing your program DID show that was good: VISTA is more secure out of the box, BY FAR, than is XP... by a HUGE amount, & unpatched no less!



* See my edits above, they are for your reference... thanks for speaking to us also!

APK

 

[BelarcGuy]

Hi Alec§taar,

Belarc is a CIS "Vendor Member" and all of the benchmarks in our products are CIS certified to work correctly. The only CIS "stuff" Belarc uses is the benchmark specifications and documents (see below).

Perhaps a bit of terminology definition might help. A CIS benchmark is a collection of recommended security settings for a particular OS in a particular environment. That benchmark takes the form of a document describing those settings (you've apparently downloaded one of those in PDF form). The security "posture" of a computer is measured against that benchmark separately for each of the hundreds of security settings in the OS, passing for those that "measure up" to the benchmark and failing for those that are "below".

The method of coming up with a numerical score, for a benchmark result, isn't specified by the CIS. However, the CIS benchmarks do specify a rough percentage of total score that each section of the benchmark should contribute. Up until last year the CIS' own scoring tool used the same scoring method the Belarc Advisor uses. Last year the CIS changed their tool's scoring method, for better or worse. There are different viewpoints as to how scoring should be done and only recently has the CIS begun a discussion among their consortium on that topic.

I thought CIS stuff was not related to BELARC stuff? I don't understand... oh well, I see your views now, & know what I have to do... going for more than 5.00/10 here.

 

[BelarcGuy]

My desktop score

FWIW, my Windows XP desktop computer gets a CIS benchmark score of 7.29 (the reduction from 10 is mostly because I have some settings made to allow running the IIS web server).

 

[Alec§taar]

FWIW, my Windows XP desktop computer gets a CIS benchmark score of 7.29 (the reduction from 10 is mostly because I have some settings made to allow running the IIS web server).

I am doing 1 thing that may need doing here, per your advice... setting the services I got scored down on, to DISABLED.

I had many set as MANUAL (because some I actually DO USE, on occasion).

Hopefully, this will get my score up some... I am looking @ both the BELARC ADVISOR & the CIS TOOL for this.

APK

 

[Alec§taar]

BelarcGuy:

I am going to post screenshots of my failed areas, per your program's suggestions:

Can you tell me why they are failing on the "X" noted ones?

Thanks!

APK

P.S.=> In turn? I will post why I have certain things set a certain way, & why, & if you have questions why I do so, ask... thanks! apk