Security baseline as code

Challenge

The security baseline of around 150 Windows servers was checked by hand. On top of that, servers ran outdated Windows Server versions and Exchange 2016 had to be replaced.

What I did

• Built a new Puppet framework that enforces the CIS Benchmark on ~150 Windows servers.
• The baseline is monitored continuously and drift is remediated automatically.
• Migrated servers to Windows Server 2022.
• Wrote the migration plan from Exchange 2016 to Exchange SE.

Result

The security baseline is monitored and remediated automatically instead of checked by hand.