--- title: 'CIS hardened Ubuntu: cyber attack and malware prevention for mission-critical systems' description: The Ubuntu CIS hardening tool allows selecting the desired level of hardening to assure cyber attack and malware prevention for mission-critical systems url: https://canonical.com/blog/cis-hardened-ubuntu-cyber-attack-and-malware-prevention-for-mission-critical-systems?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Vineetha Kamath](https://canonical.com/blog/author/vineetha "More about Vineetha Kamath") 9 April 2020 # CIS hardened Ubuntu: cyber attack and malware prevention for mission-critical systems [Certification](https://canonical.com/blog/tag/certification) [Compliance](https://canonical.com/blog/tag/compliance) [Open source](https://canonical.com/blog/tag/open-source) [Security](https://canonical.com/blog/tag/security) [Ubuntu Advantage for infrastructure](https://canonical.com/blog/tag/ubuntu-advantage-for-infrastructure) --- Share the article The Center for Internet Security (CIS) is a nonprofit organisation that uses a community-driven process to release benchmarks to safeguard enterprises against cyber attacks. It is one of the most recognised industry standards that provides comprehensive secure configuration and configuration hardening checklists in a computing environment. [The CIS benchmark](https://ubuntu.com/security/cis) has hundreds of configuration recommendations, so hardening a system manually can be very tedious. For large deployments and clouds that may not be practically viable. To drastically improve this process for enterprises, Canonical has made CIS automation tooling available to its [Ubuntu Advantage for Infrastructure](https://ubuntu.com/advantage) customers. The compliance tooling has two objectives: it lets our customers harden their Ubuntu systems effortlessly and then quickly audit those systems against the published CIS Ubuntu benchmarks. The SCAP content for audit tooling that scans the system for compliance is [CIS certified](https://www.cisecurity.org/partner/canonical/). ### **Applying CIS benchmarks** CIS benchmarks locks down your systems by removing non-secure programs, disabling unused filesystems, disabling unnecessary ports or services, auditing privileged operations and restricting administrative privileges. CIS benchmark recommendations are adopted in virtual machines in public and private clouds. They are also used to secure on-premises deployments. For some industries, hardening a system against a publicly known standard is a criteria auditors look for. CIS benchmarks are often a system hardening choice recommended by auditors for industries requiring PCI-DSS and HIPPA compliance, such as banking, telecommunications and healthcare. ### **Hardening and auditing done right** Canonical has actively worked with the CIS to draft operating system benchmarks for Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS releases. The Ubuntu CIS benchmarks are organised into different profiles, namely ‘Level 1’ and ‘Level 2’ intended for server and workstation environments.  A Level 1 profile is intended to be a practical and prudent way to secure a system without too much performance impact. Disabling unneeded filesystems, restricting user permissions to files and directories, disabling unneeded services, configuring network firewalls are some examples of configuration changes recommended in a Level 1 profile. A Level 2 profile is used where security is considered very important and it may have a negative impact on the performance of the system.  Creating separate partitions, auditing privileged operations are some examples of configuration changes recommended in a Level 2 profile. The Ubuntu CIS hardening tool allows customers to select the desired level of hardening against a profile (Level1 or Level 2) and the work environment (server or workstation) for a system. The audit tooling uses OpenSCAP libraries to do a scan of the system. Both audit scanning and hardening are executed using a profile. The tool provides options to generate a report in XML or a html format. The report shows compliance for all the rules against the profile selected during the scan. ### **Start using the Ubuntu CIS automation tooling today** CIS automation tooling can be used in virtual machines, private and [public clouds](https://ubuntu.com/public-cloud) as well as on-premises and desktops. The tooling is available for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 20.04 LTS with  [Ubuntu Advantage for Infrastructure](https://ubuntu.com/advantage). To start using it now check out the [CIS tooling instructions](https://ubuntu.com/security/certifications/docs/cis). [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026