  Security Hardening is the process of configuring IT systems to ensure the
security of the systems' components and data they process or store. In many
cases, so-called security-configuration guides are used as a basis for security
hardening. These guides describe secure configuration settings for components
such as operating systems and standard applications. Rigorous testing of
security-configuration guides and automated mechanisms for their implementation
and validation are necessary since erroneous implementations or checks of
hardening guides may severely impact systems' security and functionality. At
Siemens, centrally maintained security-configuration guides carry
machine-readable information specifying both the implementation and validation
of each required configuration step. The guides are maintained within git
repositories; automated pipelines generate the artifacts for implementation and
checking, e.g., PowerShell scripts for Windows, and carry out testing of these
artifacts on AWS images. This paper describes our experiences with our
DevOps-inspired approach for authoring, maintaining, and testing
security-configuration guides. We want to share these experiences to help other
organizations with their security hardening and, thus, increase their systems'
security.
