cis critical security controls version 7

CIS CRITICAL SECURITY CONTROLS VERSION 7 HOW TO
CIS CRITICAL SECURITY CONTROLS VERSION 7 SOFTWARE

Having the right logs also help investigators determine what occurred during an investigation. Without proper logging in place, it is very difficult to detect a security compromise or an attack in the network. Do not take vulnerability management lightly.

CIS CRITICAL SECURITY CONTROLS VERSION 7 HOW TO

In addition to this, having a vulnerability scanner or endpoint security tool can help identify what systems are vulnerable and how to remediate the vulnerability. Therefore, it is important that security practitioners have timely access to relevant threat intelligence to know what vulnerabilities exist in their environment. They need to exploit one vulnerability to be successful. Cyber criminals are constantly looking for vulnerabilities in systems which will help them infiltrate the network. This is an ongoing game of cat and mouse for security practitioners. Other controls to consider is implementing MFA for high privilege accounts.

An Identity and Access Management solution provides the foundation for access management. Having a process which grants and revokes access to data based on role is best practice. This can be a tedious task when done manually. Monitor and alert on unusual behavior from those accounts.Įnsuring accounts only have access to information to perform their role is paramount. Inventory and know your administrative level accounts vs service accounts vs regular accounts. Treat accounts as you would computer assets. This is especially true of administrative accounts. They know accounts have access to company data or has elevated access in a company’s environment.

Criminals know this and have shifted a lot of their focus on compromising accounts.

CIS CRITICAL SECURITY CONTROLS VERSION 7 SOFTWARE

Knowing that your hardware assets and software are configured using a standard configuration brings a higher level of confidence they are secured in a consistent way across your organization. Take the time upfront to build a secure configuration of similar type of assets. Having a secure and standardized configuration of your company’s system assets and software significantly reduces the management of those systems. Secure Configuration of Enterprise Assets and Software This is especially true for personally identifiable information data.Ĥ. How your company manages this data is equally as important as the security controls. Encryption at rest and in transit is one technique to reduce the risk of an attack however there is also a data privacy component to data protection. Your data must be protected from theft, loss, inappropriate access, ransomware and other types of attacks. This data is valuable to an organization. Company information can include, but is not limited to, customer information, intellectual property, financial data, and employee information. Without controls 1 and 2, you are going in blind.Ĭlassifying and protecting your company information is a top priority and should be considered an enterprise level risk. It allows you to know what vulnerable software and Operating Systems are running in your organization and can act accordingly. This control is about having the necessary visibility and control over all software running on your company’s systems.

Having an inventory of the software running on your assets is imperative to increasing your security posture. Having confidence in your inventory and ability to manage your inventory will help in other areas of your security program such as incident response, software management, malware defences to name a few.Ģ. You cannot protect what you do not now exists. That includes on-premise, mobile, IoT, and Cloud. It is vital to know what assets your organization has and what company information is on those assets. Inventory and Control of Enterprise Assets

This post summarizes the importance of each control.ġ. As a result, the controls have been updated and incorporate cloud and mobile technologies. The CIS team re-assessed their current controls and how they matched up against the modern threat landscape. The number of controls has been reduced from 20 down to 18. One such reputable framework is The Center for Internet Security’s (CIS) Critical Security Controls.ĬIS recently released version 8 of the CIS Controls. There are several well-respected cyber security frameworks organizations can adopt. CIS Controls v.8 – Proven To Reduce Your Cyber-RiskĬyber security frameworks are great tools to measure the effectiveness of your company’s cyber security posture.

Cis critical security controls version 7