Configuration Review
The gap between default and secure, closed.
Systematic review of servers, firewalls, databases, endpoints and identity platforms against secure baselines — finding the quiet misconfigurations that automated compliance checks and attackers both know about.
The problems this solves
Sound familiar?
Defaults are not secure
Vendors ship for compatibility, not security. Systems deployed on defaults carry known, documented weaknesses.
Configuration drift is invisible
Systems hardening erodes as changes accumulate. Without review, today’s configuration is anyone’s guess.
Firewalls accumulate legacy rules
Years of rule additions create openings nobody remembers creating — and nobody dares remove without analysis.
Auditors ask for hardening evidence
ISO 27001, SOC 2 and PCI DSS all expect demonstrable secure configuration. “We think it’s hardened” is not evidence.
What the engagement includes
In scope, in detail
- Server operating system hardening review (Windows & Linux)
- Firewall and network device rule-base analysis
- Database configuration and access-control review
- Identity platform and IAM configuration assessment
- Endpoint and platform security baseline review
- Gap analysis against CIS Benchmarks and vendor guidance
Systems & technologies
Aligned standards
Standards listed describe the frameworks our methodology aligns with — not certifications held by Softous Solutions.
How we deliver
A methodology you can hold us to
01
Asset & baseline selection
We confirm the systems in scope and the baselines that fit your environment — CIS Benchmarks plus vendor-specific guidance.
02
Configuration analysis
Read-only review of configurations against baselines, combined with manual analysis of context tools cannot judge.
03
Risk prioritisation
Findings are ranked by exploitability and exposure — internet-facing and identity systems first.
04
Hardening roadmap
You receive specific, tested configuration changes with rollback notes, sequenced to avoid operational disruption.
What you receive
- Configuration gap analysis per system
- CIS Benchmark alignment scoring
- Prioritised hardening recommendations
- Specific configuration changes with rollback notes
- Evidence pack suitable for audit
Common questions
FAQs
Will a review disrupt production?
No. Reviews are read-only. We analyse configuration exports or read-only access — nothing is changed during the assessment.
How is this different from a vulnerability scan?
Scanners look for missing patches and known CVEs. Configuration review examines how systems are set up — weak protocols, excessive permissions, insecure defaults — which scans largely miss.
Which baselines do you use?
Primarily CIS Benchmarks, adapted to your operational reality. A baseline that breaks your applications is not a baseline you will keep.
Can you help implement the fixes?
Yes. We can work alongside your team during remediation, or validate changes afterwards as part of a follow-up review.
Related services
Configuration Review
Ready to understand your real exposure?
Speak with a senior specialist about configuration review for your environment. No obligation, no sales scripts — a practical conversation about scope and outcomes.