  Insecure default values in software settings can be exploited by attackers to
compromise the system that runs the software. As a countermeasure, there exist
security-configuration guides specifying in detail which values are secure.
However, most administrators still refrain from hardening existing systems
because the system functionality is feared to deteriorate if secure settings
are applied. To foster the application of security-configuration guides, it is
necessary to identify those rules that would restrict the functionality.
  This article presents our approach to use combinatorial testing to find
problematic combinations of rules and machine learning techniques to identify
the problematic rules within these combinations. The administrators can then
apply only the unproblematic rules and, therefore, increase the system's
security without the risk of disrupting its functionality. To demonstrate the
usefulness of our approach, we applied it to real-world problems drawn from
discussions with administrators at Siemens and found the problematic rules in
these cases. We hope that this approach and its open-source implementation
motivate more administrators to harden their systems and, thus, increase their
systems' general security.
