Hardening baselines for firewalls, switches and Windows hosts in OT

What a baseline is for

A baseline is the documented, approved configuration of a device: software and firmware versions, enabled services and ports, accounts, security patches applied and custom software. CIP-010 asks you to keep one per BES Cyber Asset and to authorise and document changes to it.

The point is not the document — it is being able to tell, at any time, whether a device still matches what you approved.

Firewalls

• Management only from a dedicated management network or jump host; no management on outside interfaces.
• Named administrator accounts with MFA where supported; disable or rename default accounts.
• Log to a central collector (syslog) and keep time synchronized.
• Back up the configuration after every approved change and compare it with the last known-good copy.

Switches and routers

• Disable unused ports and place them in an unused VLAN; enable port security where the hardware supports it.
• Turn off services you do not use (HTTP management, CDP/LLDP on edge ports, legacy protocols).
• Use SNMPv3 with authentication and privacy; remove default community strings.
• Send logs and SNMP traps to your collector.

Windows hosts (HMIs, engineering workstations, historians)

• Remove software and roles the host does not need; disable unused services and listening ports (CIP-007 R1).
• Apply security patches through an evaluated process with documented decisions (CIP-007 R2).
• Use application allow-listing or anti-malware suited to the host's role (CIP-007 R3).
• Enforce password and lockout settings; review accounts and remove those no longer needed (CIP-007 R5, CIP-004).
• Forward security event logs centrally and retain them (CIP-007 R4).

Keeping it from drifting

Baselines drift through emergency fixes, vendor visits and forgotten tests. Compare live configuration with the approved baseline regularly — CIP-010 R2 requires monitoring for changes at least every 35 days for high-impact systems — and treat every unexplained difference as an event to investigate.