Critical Security Controls: An Introduction

This is an original post by Jana White of Alpine Security.

The+Top+20+Critical+Security+Controls+are+Covered+by+an+Enterprise+Security+Audit

Everyone knows that they need to improve the current state of their cybersecurity measures, but to many people this task is a daunting one. “Where do I start? What should I focus on first? What security measures will have the greatest impact on the security of my computer systems and network?” Don’t worry, the Center for Internet Security can answer all these questions, and help guide you to a more secure infrastructure. The Critical Security Controls (CSCs) will be your guidebook to developing and implementing industry standards and best practices, helping you improve your overall security and reducing the overall risk to your organization. This blog article will be followed up by a series of 20 blog posts, each providing a detailed examination of one of the Controls, to help provide you with ideas of how you can implement each control within your organization.

Where do I start?

The Center for Internet Security (CIS) is a global non-profit community of IT and security individuals who develop and share resources that help organizations protect themselves from cyber threats and attacks. They are innovative leaders in cyber defense solutions, and provide information and guidance to private and public companies and organizations from all over the world.

The CIS keeps you up to date on trends in cybersecurity threats, and shows the current alert level for current vulnerabilities and threats that might affect your networks. The Multi-State Information and Sharing Center (MS-ISAC) supplies the information for the alert levels. The MS-ISAC is committed to improving “the overall cybersecurity posture of the nation’s state, local, tribal, and territorial governments through focused cyber threat prevention, protection, response, and recovery.” You can read more about the MS-ISAC here.

The CIS also provides tools and industry best practices that will help improve your security posture, including the Critical Security Controls (CSCs) and CIS Benchmarks. There are currently 20 Controls, each grouped into a specific category (referred to as “families”). These families are listed as System, Network, and Application; they exist to assist with prioritization. The Controls are listed in prioritized order, with Control 1 being the most important to implement. There are 149 individual security practices that are part of the 20 Controls, and implementing these practices and the 20 Controls will help secure your organization against the everyday threats that might affect your networks.

What should I focus on first?

With 20 Controls and 149 individual practices to implement it can be difficult to know where to start. Fortunately, the CIS has put the most important Controls at the top of the list. Controls 1 -5 represent the areas you should focus on first, known as Foundational Cyber Hygiene. By implementing the first 5 Controls, you can improve your security posture and eliminate 85% or more of your organization’s cybersecurity vulnerabilities. More information about the CIS Controls can be found here. Future blog posts will cover each of the Controls in depth including the Foundational Cyber Hygiene controls. In case you just can’t wait to read the future blogs, I will list the Foundational Cyber Hygiene Controls for you now. The first 5 Controls are:

Inventory of Authorized and Unauthorized Devices
Inventory of Authorized and Unauthorized Software
Secure Configurations for Hardware and Software
Continuous Vulnerability Assessment and Remediation
Controlled Use of Administrative Privileges

The Foundational Cyber Hygiene Controls represent some of the most important concepts in security. How can you protect what is on your network, if you don’t know what is supposed to be there and what isn’t? All systems should have a documented, secure configuration that can be imaged on all like systems within your network. This help you recover quickly from viruses and malware, and other unforeseen events that require you to reimage your systems. Defending your network is a constant arms race against cyberattackers. You need to continuously monitor and check your systems for vulnerabilities… because the attackers certainly do. Lastly, a common point of entry into your network is through the use of Admin accounts or privileges. Always implement the concepts of least privilege, separate accounts for user and administrative duties, and log all activity that comes from your Admin accounts. If you incorporate the Foundational Cyber Hygiene Controls into your security practices, you will greatly reduce the vulnerabilities within your network, and this is enough to encourage many attackers to seek out companies who may be less secure, known as lower hanging fruit.

What security measures will have the greatest impact on the security of my computer systems and network?

“OK, I have implemented the Foundational Cyber Hygiene Controls. I still want to do more to improve my network security. What else can I do?” Many organizations want to have better security, they just are not sure where to start, or what they can do to improve their current security measures. The Controls are a great place to start, but sometimes you need to really take a hard look in the mirror first to see if your current practices are helping or hurting your security posture. This is where an Enterprise Security Audit can help bring you that clarity, and provide you with the answers you seek.

An Enterprise Security Audit uses the CIS 20 Controls to review and analyze your current security practices. The Enterprise Security Audit will determine what policies you have in place that cover the 20 Controls. It will give you a scorecard that shows you which specific controls you are missing, or which ones need to be refined or improved. An ESA Technical Audit will look at your systems to help identify which controls are actually implemented within your networks, and which ones need to be implemented. If you are really serious about improving your organization’s security or want to check and see how secure your network might be against todays cyberattacks, then an Enterprise Security Audit is a great place to start.

Contact IMEC to get started with an Enterprise Security Audit and Technical Audit to help improve the security of your network.

View original article.

Defense Contractors - are you prepared to meet the new DoD cybersecurity requirements?

With current and future DoD contracts at stake, compliance is a strategic necessity that contractors cannot ignore. And with third party certification audits to be conducted in 2020, time is running out for manufacturers to reach compliance.

IMEC and Alpine Security are offering a 6-part Cybersecurity Resiliency for Defense Contractors Webinar Series to help you understand the complete requirements for DoD contractors. Register for the DFARS NIST 800-171 Compliance Process session, and check out the rest of the series below!

Session 3: DFARS NIST 800-171 Compliance Process
October 22 | 10:00 am - 11:30 pm
This session will focus on how to become compliant with DFARS 800-171, the difference between CUI and CDI, the NIST 800-171A: 100 controlls assessment, and documents of compliance.