CIS Top 20 Controls Explained

The Center for Internet Security (CIS) Top 20 Controls, formerly known as the SANS Top 20 Critical Security Controls, provide a prioritized set of best practices designed to help organizations improve their cybersecurity posture. These controls offer a comprehensive framework for implementing security measures that significantly reduce the risk of cyber attacks. Let's dive deeper into each of these controls to understand their importance and implementation.

1. Inventory and Control of Hardware Assets

Identify and manage all hardware devices on the network to ensure they are properly maintained and secure.

• Maintain an up-to-date inventory of all hardware devices.
• Ensure only authorized devices are connected to the network.
• Implement processes for device discovery and asset tracking.

2. Inventory and Control of Software Assets

Maintain an inventory of all software assets and ensure that unauthorized software is not installed.

• Use automated tools to track and manage software installations.
• Regularly review and update the list of authorized software.
• Remove or disable unauthorized software to prevent security risks.

3. Continuous Vulnerability Management

Regularly scan for vulnerabilities and apply patches to keep systems up-to-date.

• Conduct regular vulnerability assessments using automated tools.
• Prioritize and apply security patches based on risk and severity.
• Monitor for new vulnerabilities and update defenses accordingly.

Get A GRC Demo Today

4. Controlled Use of Administrative Privileges

Limit administrative privileges to only those who need them and monitor their use.

• Implement least privilege access controls.
• Use multi-factor authentication for administrative accounts.
• Regularly review and audit administrative privileges.

5. Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

Implement and maintain secure configurations for all devices and software.

• Develop and enforce security configuration standards.
• Use automated tools to apply and verify configurations.
• Regularly review and update security configurations.

6. Maintenance, Monitoring, and Analysis of Audit Logs

Enable and monitor audit logs to detect and respond to suspicious activities.

• Centralize logging to a secure location.
• Regularly review and analyze log data for signs of malicious activity.
• Retain logs for an appropriate period to support forensic investigations.

7. Email and Web Browser Protections

Ensure that only supported web browsers and email clients are used and kept up-to-date.

• Implement security settings and policies for email and web browsers.
• Use content filtering and anti-malware solutions to protect against threats.
• Regularly update software to address known vulnerabilities.

8. Malware Defenses

Deploy and manage anti-malware software to protect against malicious software.

• Install and configure anti-malware solutions on all endpoints.
• Regularly update anti-malware definitions and software.
• Conduct regular scans and monitor for malware activity.

9. Limitation and Control of Network Ports, Protocols, and Services

Restrict network ports, protocols, and services to only those required for business operations.

• Use firewalls and access control lists (ACLs) to restrict network traffic.
• Regularly review and update network configurations.
• Disable unused ports, protocols, and services.

10. Data Recovery Capabilities

Implement regular backups and ensure that data can be recovered in the event of a disaster.

• Perform regular data backups and test recovery procedures.
• Store backups in secure, offsite locations.
• Implement data recovery plans as part of the overall disaster recovery strategy.

11. Secure Configuration for Network Devices, such as Firewalls, Routers, and Switches

Ensure that network devices are configured securely and managed using multi-factor authentication.

• Develop and enforce security configuration standards for network devices.
• Use automated tools to apply and verify configurations.
• Regularly review and update security configurations.

12. Boundary Defense

Deny communications with known malicious IP addresses and limit access to trusted IP ranges.

• Implement intrusion detection and prevention systems (IDPS).
• Use geo-blocking and IP reputation services.
• Monitor and analyze network traffic for signs of compromise.

13. Data Protection

Protect sensitive data through encryption, access controls, and other security measures.

• Encrypt sensitive data in transit and at rest.
• Implement strong access controls and data loss prevention (DLP) solutions.
• Regularly review and update data protection policies.

Get A GRC Demo Today

14. Controlled Access Based on the Need to Know

Limit access to information based on user roles and responsibilities.

• Implement role-based access controls (RBAC).
• Regularly review and update access permissions.
• Use least privilege principles to restrict access.

15. Wireless Access Control

Secure wireless networks and devices to prevent unauthorized access.

• Use strong encryption and authentication for wireless networks.
• Segment wireless networks to separate critical and non-critical traffic.
• Regularly review and update wireless security configurations.

16. Account Monitoring and Control

Monitor and control user accounts to detect and respond to suspicious activities.

• Implement automated account monitoring tools.
• Regularly review and audit user accounts and access logs.
• Enforce strong authentication and password policies.

17. Incident Response Management

Develop and implement an incident response plan to quickly address security incidents.

• Establish an incident response team and roles.
• Develop and test incident response procedures.
• Maintain an incident response playbook and contact list.

18. Penetration Tests and Red Team Exercises

Conduct regular penetration tests and red team exercises to identify and address vulnerabilities.

• Hire external experts to conduct penetration tests.
• Perform regular red team exercises to simulate real-world attacks.
• Use findings to improve security measures and incident response plans.

19. Service Provider Management

Manage third-party service providers to ensure they meet security requirements.

• Conduct due diligence and risk assessments for service providers.
• Establish security requirements and monitoring processes.
• Regularly review and audit service provider performance.

20. Application Software Security

Secure application software to prevent vulnerabilities and exploits.

• Implement secure coding practices and code reviews.
• Use automated tools to scan for vulnerabilities in applications.
• Regularly update and patch application software.

By implementing these controls, organizations can significantly enhance their cybersecurity defenses and reduce the risk of cyber attacks. The CIS Top 20 Controls provide a comprehensive framework for protecting IT systems and data from a wide range of threats.