Best Posture Policy

[maf_1]

I am trying to create a posture policy for both wired and wireless. I want it to be as fool proof as possible. What are some of the things that are a must and makes any posture policy great?

[Kasun Bandara]

Hi,

you must check for AV, AV update and OS update in first level. 

then you can do some custom check such as applications related your organization, required REG keys, etc.

[maf_1]

can we, thru ISE check what apps are running on one's PC?

[Mike.Cifelli]

I would start with taking a look at this: ISE Posture Prescriptive Deployment Guide - Cisco Community

The posture solution has tons of options that can be utilized to determine endpoint compliance status.  In the link shared take a look at the 'Windows Posture Assessment Options' & 'macOS Posture Assessment Options'.  Then from there IMO your best bet is to determine with the appropriate folks what is desired in your environment.  HTH!

[maf_1]

hello Mike,

I have been thru that link previously. What I wanted to ask was what are some of the things that MUST be there in any posture policy regardless of the organization. 

[Mike.Cifelli · Accepted solution]

Off the top of my head, here are some examples that I have seen to ensure compliance:

-browser version checks

-domain registry check to ensure computer is a domain client

-windows registry check to ensure client is running supported version

-windows cumulative patch check

-3rd party sw services are running; example: McAfee AV, HIPS, Agent all present and running on client

-secure boot check

-3rd party agents for other things installed & running; example: nessus agent

HTH!

[maf_1]

wow. that's what i was looking for. any document on how this can be implemented? also, do you have any more suggestions to make it more robust?