CIS Cybersecurity Framework

Cybersecurity is most effective when approached in a layered or tiered manner. The Center for Internet Security (CIS) currently has 20 controls published and split between three main categories: Basic, Functional, and Organizational. These 20 controls can be layered to give your business a successful cybersecurity posture. According to Tenable.com, there are five steps to a successful cybersecurity program: Discover, Assess, Analyze, Fix, and Measure.

Learning the Control Groups

The first six controls make up the Basic category and are commonly referred to as the “cyber hygiene” controls. The basic controls focus on security guidelines like monitoring, vulnerability assessment, and configuration management.

The Foundation Controls group empowers companies to lay the framework of a good security program.  This group is defined by controls 7 through 16 and covers various defense tactics, data loss, data recovery, and access controls.

The final category is the Organizational Controls group which are also known as the final four controls.  These controls are primarily targeted at defining guidelines that are aimed at the people and processes within the organization.

Basic Controls

The first six controls are the cyber hygiene controls, but what are they?

1. Inventory and Control of Hardware Assets
   1. This step consists of making sure that only authorized physical devices are given access to the system. During this process, unmanaged devices are identified and prevented from gaining access.
2. Inventory and Control of Software Assets
   1. Similar to control #1, this control looks at software that is installed on authorized devices within the organization. Making sure authorized software is the only software active on a network enables an organization to quickly identify rogue platforms.
3. Continuous Vulnerability Management
   1. Control #3 is designed to incorporate a vulnerability management program that will perform comprehensive and credentialed scans regularly across the organization.
4. Controlled Use of Administrative Privileges
   1. Any administrator on a network should have at minimum two accounts. The first account should be for their day-to-day activities and other accounts can be elevated depending on their need. Administrator accounts should not be used for daily user activities like web browsing or email.
5. Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
   1. Control #5 encompasses establishing a baseline security configuration for all hardware within an organization. This configuration should have a documented implementation and change control process. It should also be visible through reporting on every endpoint device.
6. Maintenance, Monitoring, and Analysis of Audit Logs
   1. Detecting, understanding, and recovering from a cybersecurity attack is all in the logs. This control is meant to establish the collection, management, and analysis of audit logs.

The basic control group aims to identify all the pieces of a network, their legitimacy on the network, and their ability to communicate.

Foundation Control Group

The foundation control group contains 10 controls (7-16) that lay the groundwork for a great cybersecurity posture.

7. Email and Web Browser Protections
   1. Bad actors are looking to gain access to your systems through the people in your organization. This control looks to minimize their interaction with your users in web browsers and email.
8. Malware Defenses
   1. Catching malware at the time of installation can prevent the spread and execution of malicious code throughout the enterprise. Ensuring your malware defense is continuously updated and somewhat restricting can prevent a widespread event.
9. Limitation and Control of Network Ports, Protocols, and Services
   1. Electronic communication is transported via protocols, and services and happens through often specific network ports. Instilling limitations on the who, what, and where electronic communication happens, minimizes vulnerabilities and makes it harder for bad actors to operate in your network.
10. Data Recovery Capabilities
    1. In the event of an event, retrieving data is the number one priority. Proper backup, documentation, and a plan need to be in place.
11. Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches
    1. To prevent bad actors from exploiting services and settings, this control is meant to establish, implement, and actively track the security configuration of network devices to track reports, and correct gaps.
12. Boundary Defense
    1. When all your systems were in-house or pointed to one single location, boundary defense was a slightly easier topic. Today, information and entry points can be pinpointed in several ways. These entry points require a perimeter of defense.
13. Data Protection
    1. Creating a classification scheme for data within an organization is key when ensuring the information needed to perform a job duty is accessible only to those it should be accessible to. This classification scheme should be documented and distributed to ensure organizational buy-in.
14. Controlled Access Based on the Need to Know
    1. Control #14 echoes the principle of least privilege described in Control #13. Users should only have access to information that is needed to perform their job duties.
15. Wireless Access Control
    1. Wireless access points should be configured to track and control access while simultaneously preventing unauthorized access. Wireless access has the potential to expose a network to problems if not controlled properly.
16. Account Monitoring and Control
    1. All accounts within the organization should be managed in a way that promotes clean account hygiene.

The foundation control group is meant to keep data and access out of the hands of those that do not need it. This control group lives in what we like to refer to as the Principle of Least Privilege. Limiting access to places and devices within the organization is the first step in keeping data out of the hands of those who don’t need it.

Organizational Controls

The final control group revolves around providing the organization with ways to complete their security journey.

17. Implement a Security Awareness and Training Program
    1. Teaching users to be aware of ways in which bad actors currently try to infiltrate organizations is the first line of defense.
18. Application Software Security
    1. This control looks at keeping applications and stored customer data from being exposed.
19. Incident Response and Management
    1. Incident response plans (IRPs) have been a steadily growing topic between IT professionals and business owners. Being prepared in the event of a breach can help maintain relationships between businesses and their clients as well as reducing productivity losses.
20. Penetration Tests and Red Team Exercises
    1. Penetration tests are used to test the security controls put in place by an organization.

The organizational control group trains, responds to and assesses the security posture of an organization.

The Center for Internet Security and Tenable have configured a comprehensive guide that reviews all of the controls in-depth. Understanding, implementing, and reviewing these controls can become a task not all companies are equipped to take on. ERGOS assists clients by reviewing current controls, assessing the needs of the organization, and putting controls and monitoring systems in place. Contact our offices today to learn more about having a better cybersecurity posture for your business.