CIS JUNOS Benchmark Reports

As part of a good security management program, the networking teams need to ensure a consistent configuration baseline for Juniper appliances across the network. Even the most well managed networks have misconfigurations within infrastructure devices that can leave these systems at risk for attack or exploitation. The Center for Internet Security (CIS) is an organization that works with security experts to develop a set of 'best practice' security standards designed to harden operating systems and applications. This report provides a high-level overview of results gathered from CIS compliance scans using the CIS Juniper JUNOS Benchmark v1.0.1.

Tenable Network Security has been certified by CIS to perform a wide variety of platform and application audits based on the best practice consensus benchmarks developed by CIS. Tenable submits example test cases for all of the criteria within each unique benchmark, and then submits our results to CIS personnel for official certification. Tenable has developed audit files for the Juniper JUNOS, which has been approved and certified by CIS staff members.

When performing managed scans with Tenable.sc, some CIS audits require additional patch audits and vulnerability checks. Any additional requirements for completing an audit using the Juniper JUNOS Benchmarks will be included within the audit file description text. In some cases, multiple scans may be required to be performed, as Tenable provides both Level 1 and Level 2 audit checks. Level 1 checks provide minimum settings recommendations, and are generally considered safe to apply to most systems. Level 2 checks include recommendations for complex or highly secure environments, and can lead to reduced functionality of key systems or applications.

When performing audit scans with Tenable.sc, audit files related to the CIS Juniper JUNOS Benchmarks must first be uploaded to Tenable.sc. Next, the appropriate credentials must be added, after which a scan policy can be created. Finally, a scan can be scheduled. As part of the post scan jobs, the 'Auto-Run Reports' can be enabled automatically, running this report on the data collected using the appropriate audit file. Using these benchmarks will help to assess the effectiveness of existing security controls, and provide the critical information needed to improve an organization's security posture.

The reports are available in the Tenable.sc Feed, a comprehensive collection of dashboards, reports, Assurance Report Cards, and assets. The reports can be easily located in the Tenable.sc Feed under the category Compliance & Configuration Assessment. The report requirements are:

• Tenable.sc 5.2.0
• Nessus 8.5.1
• CIS Audit files for JUNOS are required, and the files required for each template are listed below with their respective templates.

As network operations works tirelessly to maintain consistent configurations, Tenable.sc can assist in this process. Tenable.sc helps to measure and communicate results with many compliance standards using the CIS Benchmarks. By default, Tenable.sc comes with over 200 audit files for CIS and more than 400 audit files overall, which supports the security operations team in performing audits on many system types and applications.  By prioritizing remediation actions for misconfigured systems, the organization can maximize their investment in compliance reporting and system hardening efforts. Tenable.sc delivers comprehensive security solutions that provide continuous visibility and critical context, enabling decisive actions to protect the organization.

Report Templates

CIS Juniper JUNOS Benchmark v2.0.0 - This report template supports audits conducted on Juniper J, M, MX and T Series Routers running versions JUNOS 8.x, 9.x, and 10.x. This template may also be beneficial on other devices running JUNOS on the following platforms, such as JUNOS Enhanced Service, and to other platforms running JUNOS such as EX series switches or SRX series Service Gateways; however these systems are not specifically addressed by the CIS benchmark directly. The audit files required to support this report template are:

• CIS_Juniper_OS_v2.0.0_L2.audit
• CIS_Juniper_OS_v2.0.0_L1.audit