Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Local Oracle Linux installations do not support CIS Oracle Linux benchmarks or hardened images. When you implement CIS Benchmarks on an Oracle server, you are on your own. We wrote this post to help you.

On September 9, 2025, Microsoft released details of CVE-2025-55234, a critical vulnerability in the Windows Server Message Block (SMB) protocol. With a CVSS v3 score of 8.8, it’s classified as High severity and poses a serious elevation-of-privilege (EoP) risk. An attacker exploiting this flaw could launch a relay attack, allowing them to gain the privileges of a legitimate user without elevated permissions or insider access.

Server hardening’s core principle is, “unnecessary functionality compromises security.” Adopting Linux should greatly simplify the process. No matter which flavor of Linux you choose to run, hardening your servers should be the same process; once you know one, you know them all. When it comes to Oracle Linux Server Hardening, what works for Red Hat or CentOS should continue to work. In theory, yes, but in practice, there are significant differences that could make or break your project.

The Federal Financial Institutions Examination Council (FFIEC) retired its Cybersecurity Assessment Tool (CAT) on August 31, 2025. This self-assessment resource, used by financial institutions to gauge cybersecurity risk and readiness, won’t be updated going forward. The FFIEC launched CAT in 2015 to help organizations measure their exposure to risk and assess their cyber preparedness.

The National Credit Union Administration (NCUA) was created to insure and regulate the industry. Under the Federal Code of Regulations, Part 748, each federally insured credit union is required to develop a security program within 90 days of the effective date of insurance. To ensure that credit unions comply with federal cybersecurity requirements, the NCUA collaborates with the Federal Financial Institutions Examination Council (FFIEC) to set examination standards.

Suppose you are an experienced IT professional or consultant working in the private sector. You get a new job working in the US Healthcare industry. On starting your new job, you learn about the Health Insurance Portability and Accountability Act (HIPAA) Security Rule and the consequences of failure to comply with it. As an IT professional, you understand that a crucial component of mitigating cyber threats is to implement server hardening, but how does this relate to HIPAA?

Before we move forward with our exploration of HIPAA, HITRUST, and server hardening, let’s review what we learned in Part One. We began as experienced IT professionals and consultants working in the private sector, after starting a new job in the US Healthcare industry.

The Payment Card Industry Data Security Standard (PCI DSS) is a global initiative that provides a consistent, baseline framework of security measures, facilitating their adoption and implementation. PCI DSS Requirement 2.2 states that System components are configured and managed securely. In this guide, we will provide the necessary background and context to understand and comply with Requirement 2.2.

Linux distributions, such as Red Hat Enterprise Linux (RHEL), dominate the enterprise and cloud computing sectors. One of the many reasons for the success and popularity of Linux is its support of convenient and straightforward remote access protocols, such as Secure Shell (SSH). In the right hands, SSH’s ability to securely access remote servers enables access to any Linux server, regardless of the environment. The problem is that, in the wrong hands, SSH can be a security nightmare.

CIS Benchmark levels along with STIG profiles offer flexibility, allowing organizations to configure security settings based on the level of risk they face and the criticality of their systems. This layered approach ensures a balance between security and real world requirements and performance.