Virtualization & Setup · 1.4
📏 CIS Benchmarks — The Competition Standard
The authoritative source for every security setting you'll configure⏱ ~5 min
📐CIS Benchmarks are like building codes for cybersecurity
Building codes tell contractors exactly what thickness of concrete to use, what fire-rating a door needs, and what load a beam must support. CIS Benchmarks do the same for computers — they specify exactly which settings to enable, which to disable, and what values to use, backed by consensus from security experts worldwide. In CyberPatriot, your scoring engine checks your settings against a similar standard. Knowing CIS benchmarks means knowing what the scorer expects.
What Is the Center for Internet Security (CIS)?
- •CIS (Center for Internet Security) is a nonprofit that produces vendor-neutral security standards adopted globally by governments, enterprises, and schools
- •CIS Benchmarks are step-by-step configuration guides for specific OS versions — Windows 10, Windows 11, Ubuntu 20.04, Ubuntu 22.04, etc.
- •They are free to download at cisecurity.org → CIS Benchmarks
- •Two levels: Level 1 (broadly applicable, minimal usability impact) and Level 2 (higher security, may restrict some functionality)
- •CyberPatriot scoring aligns closely to CIS Level 1 — when in doubt, CIS Level 1 is your reference
Why CIS Matters More Than Guessing
★ FactCyberPatriot competition images are pre-configured with dozens of intentional misconfigurations. The scoring engine checks each setting against a known-good baseline derived from CIS Benchmarks — teams that study CIS directly know exactly what to fix and what value to set.
Key Benchmarks for CyberPatriot
| OS | Benchmark | Where |
|---|---|---|
| Windows 10 | CIS Microsoft Windows 10 Stand-alone Benchmark v3.0 | cisecurity.org/benchmark/windows |
| Windows 11 | CIS Microsoft Windows 11 Stand-alone Benchmark v3.0 | cisecurity.org/benchmark/windows |
| Ubuntu 20.04 | CIS Ubuntu Linux 20.04 LTS Benchmark v2.0 | cisecurity.org/benchmark/ubuntu_linux |
| Ubuntu 22.04 | CIS Ubuntu Linux 22.04 LTS Benchmark v1.0 | cisecurity.org/benchmark/ubuntu_linux |
CIS Benchmark Coverage Areas
| Section | What It Covers | Example CIS Setting |
|---|---|---|
| Account Policies | Password length, history, age, complexity, lockout | Min length: 14 chars; history: 24; lockout: 5 or fewer attempts |
| Local Policies | Audit policy, user rights, security options | Enable audit logon events; rename Administrator account |
| Windows Firewall | Per-profile state, inbound/outbound defaults | All profiles ON; inbound: Block; outbound: Allow |
| Windows Defender | Real-time protection, cloud-based protection | Real-time: Enabled; cloud protection: Enabled |
| Software Restrictions | AutoPlay, unnecessary services, remote access | Disable AutoPlay; disable Telnet; disable RDP if unneeded |
| Patching | Windows Update configuration | Automatic updates: Enabled |
How to Download CIS Benchmarks (Free)
- 1.Go to cisecurity.org → click 'CIS Benchmarks' in the top navigation
- 2.Search for your OS (e.g., 'Windows 10' or 'Ubuntu 22.04')
- 3.Click 'Download' — CIS requires a free account registration (name + email; no payment needed)
- 4.You receive a PDF, typically 300–900 pages, covering every security setting for that OS
- 5.Download Windows 10/11 Stand-alone v3.0 and Ubuntu 22.04 v1.0 before competition day
- 6.Tip: keep the PDF open on a second device (tablet, phone, spare laptop) so you can search while working in the VM
Understanding a Benchmark Entry
Every entry in a CIS Benchmark PDF follows the same structure. Here is an example:
| Field | What It Means | Example |
|---|---|---|
| Title | The name of the setting | Ensure 'Minimum password length' is set to '14 or more characters' |
| Description | Why the setting matters | Short passwords fall to brute-force attacks in hours or less. |
| Rationale | Security reasoning in depth | Each extra character multiplies the attacker's work exponentially. |
| Audit (How to Check) | Steps to verify the current value | Run secpol.msc → Account Policies → Password Policy → check value |
| Remediation (How to Fix) | Exact steps to correct the setting | Set 'Minimum password length' to 14 in secpol.msc |
| Impact | Any usability side effects | Users must create longer passwords; passphrases make this painless |
| CIS Controls mapping | Which high-level CIS Control this satisfies | CIS Control 4: Secure Configuration of Enterprise Assets |
💡 TipUse Ctrl+F in the PDF to search by setting name. Searching 'Ensure Remote Desktop' instantly jumps you to that entry — much faster than reading page by page.
Level 1 vs Level 2 — Which to Use
Level 1 — Use This in Competition
- •Broadly applicable to any environment
- •Minimal usability impact — services still work normally
- •What CyberPatriot scoring aligns to
- •Safe to apply to all settings
Level 2 — Use With Caution
- •Higher security, but may break some functionality
- •Can disable features the competition scenario requires
- •Only apply if you're confident the scenario allows it
- •Better for hardened servers, not general workstations
How to Use CIS Benchmarks in Competition
- 1.Download the relevant PDF before competition (free from cisecurity.org) — most teams keep it open on a second device
- 2.Read the scenario — identify which OS versions are in play
- 3.Work Account Policies first (fastest, most points), then Local Policies, Firewall, Defender, then services
- 4.Every setting entry includes: the recommended value, the reason, and how to verify the current state
- 5.Stick to Level 1 — Level 2 settings may conflict with services the scenario requires
🔒 SecurityIf you are ever unsure what value to set for a security policy, look it up in the CIS Benchmark PDF. Never guess. Setting a wrong value — such as lockout threshold to 0, which disables lockout entirely — costs points.
🧠Quick Checkfirst try = +5 XP
What minimum password length does CIS Level 1 require on Windows?
🎮 Practice what you learned
⭐ 0 XP🔥 0 days