Proposed Framework for Automating Network Infrastructure Hardening Audits Based on CIS Benchmarks and Vendor Security Standards

Abstract

The complexity of multi-vendor network infrastructure demands configuration hardening audits that are consistent, measurable, and repeatable. Differences in operating systems, command syntax, output formats, and security references across Cisco, MikroTik, and Ruijie devices make auditing difficult using a single uniform approach. This study designs, implements, and evaluates an automated network infrastructure hardening audit framework based on CIS Benchmarks and vendor-specific security standards. Using an applied experimental approach, an audit-only workflow was developed comprising Collector, Evaluator, and Report modules. The Collector retrieves actual device configurations via SSH and stores them as raw JSON; the Evaluator compares device outputs against vendor-specific YAML baselines; and the Report module generates audit artifacts in HTML, PDF, CSV, chart, and audit-log formats. Evaluation was conducted on 50 production devices (25 Cisco, 10 MikroTik, and 15 Ruijie), using a 68-rule baseline that produced 1,135 evaluated controls. Results showed 626 Pass controls (55.15%) and 509 Fail controls (44.85%). A complete audit session finished in 206 seconds, with all devices successfully processed. CIA Impact mapping revealed Integrity as the dominant aspect associated with non-compliant controls. Findings indicate the framework offers a structured, adaptive, and well-documented audit-only approach for evaluating multi-vendor configuration hardening compliance without modifying production configurations.