CIS Controls and Vulnerability Assessment: practical guide to adopting best practices

Estimated reading time: 6 minutes

Critical Security Controls, also known as CIS Controls, are a series of cybersecurity actions and technologies developed to protect organizations from common and effective cyber attacks. This article explains what CIS is, the benefits of adopting CIS Controls and how to integrate them into the Vulnerability Assessment process to improve your security posture.

What is CIS (Center for Internet Security)?

The Center for Internet Security (CIS) is a non-profit organization dedicated to improving cyber resilience globally. CIS manages various programs including:

• The CIS Controls or Critical Security Controls.
• The MS-ISAC (Multi-State Information Sharing & Analysis Center) to share threat intelligence.
• CIS Benchmarks for secure computer system configurations.

CIS is supported by governments, private companies, academic institutions and technical communities to develop cybersecurity best practices.

CIS Controls (Critical Security Controls)

The CIS Controls, initially known as the SANS Top 20 Critical Security Contros, were developed by CIS together with high-level cybersecurity experts.

It is a series of actions, policies and security tools prioritized and consolidated into a standard checklist. The goal is to guide organizations to implement the most critical and effective defenses to block known and emerging cyber attacks.

The benefits of adopting CIS Controls include:

• Pragmatic, high-impact approach – focuses on the highest-value best practices.
• Evidence-based – derived from the analysis of millions of real attacks.
• Cross-disciplinary applicability – effective for organizations of all sizes and sectors.
• Measurable metrics – implementation score to track improvement.
• Constantly updated – continuously reviewed by experts to reflect the threat landscape.

Evolution of CIS Controls

The first version of Critical Security Controls dates back to 2008. Over the years they have been reviewed and updated regularly to keep them relevant against emerging threats.

The latest release is version 8 (CIS Controls v8) released in 2021, which includes 20 core controls. Here are some of the main new features:

• Unification of identity and access controls in a single domain.
• New controls specific to mobile and IoT devices.
• Increased focus on supply chain attacks and ransomware.
• Integration of emerging technologies such as microservices and containers.
• New deployment metrics for more granular measurement.

The 20 Critical Security Controls CIS v8

Below are the 20 domains of CIS Controls ver. 8 grouped into their respective management areas:

Protect critical information and systems

1. Inventory of authorized and unauthorized devices
2. Inventory of authorized and unauthorized software
3. Protect hardware and software configurations on mobile devices, laptops, workstations and servers
4. Continuous assessment and remediation of vulnerabilities
5. Protection of the development and delivery stages of the software application

Develop a culture of safety and awareness

6. Administrative authorization
7. Maintenance, monitoring and analysis of audit logs

Strengthen defense and simplify security

8. Defense against malware
9. Limitation and control of network ports, protocols and services
10. Data protection
11. Network protection
12. Sensitive access control

Use analytics to respond to events

13. Data protection and security analysis systems
14. Event detection and response to security incidents

Reduce the attack surface and opportunities for attackers

15. Implementation of a Zero Trust security architecture
16. Data protection and access control
17. Security implementation for network and mobility devices
18. Device and data center protection on on-premises, hybrid networks and cloud systems

Respond adaptively to restore the situation

19. Incident response and disaster recovery plans
20. Exercises to evaluate and improve incident response and disaster recovery plans

CIS Controls Self-Assessment Scanner

To simplify the adoption of CIS Controls, CIS provides a free self-assessment tool, the CIS Controls Self-Assessment Scanner.

This scanner allows you to fill out an online questionnaire on the implementation status of various controls within your organization.

At the end, a report is obtained that assigns an overall score and identifies priority areas for improvement to strengthen defenses based on CIS Controls.

The tool provides a high-level overview but does not directly test the security or effectiveness of the controls. This is why more in-depth activities such as Vulnerability Assessment are necessary.

Integrate CIS Controls into Vulnerability Assessment

Carrying out a periodic Vulnerability Assessment allows you to promptly identify all vulnerabilities and security flaws within the IT infrastructure.

To comprehensively cover attack vectors, the assessment should check both misconfigurations that can violate CIS Controls and technical vulnerabilities in systems.

For example, scanning can:

• Detect configuration errors that expose sensitive network ports.
• Identify unnecessary services active on servers and workstations.
• Find out-of-date and exploit-prone software applications.
• Uncover accounts with weak passwords or default credentials.
• Identify operating systems or databases that are obsolete and no longer supported.
• Analyze security policies and settings in detail.

Therefore, the final Vulnerability Assessment report can include specific remediation indications to resolve these problems, aligning with the violated CIS Controls.

In this way the organization is able to:

• Measure the actual level of compliance with CIS best practices.
• Prioritize corrective actions based on risk.
• Monitor progress in implementing key defenses.
• Demonstrate commitment to following standards validated by the IT community.
• The Vulnerability Assessment becomes an even more valuable tool by integrating the checks with the CIS Controls as a reference framework.
• Hardening of systems via CIS Controls
• CIS Controls provide operational guidance to protect IT systems through “hardening” best practices, i.e. strengthening security.
• Here are some examples of hardening activities led by CIS Controls:
• Remove unnecessary software – uninstall non-essential components, features and services according to Check 2.
• Closing ports and services – block network ports, disable obsolete and unused services by applying Checks 9 and 11.
• Periodic updates – keep operating systems, software and firmware fully patched as indicated in Check 4.
• Minimize users and privileges – assign the minimum administrative privileges required by the user’s role as per Check 6.
• Data Protection – encrypt sensitive data both in transit and at rest by implementing Control 10.
• Multi-factor authentication – require multiple credentials to access critical assets as Control 12 dictates.
• Network segmentation – logically separate sensitive environments and data flows as recommended by Control 11.
• Log collection and retention – collect, centralize and maintain system, application and security event logs for Control 7.
• By regularly verifying compliance with these best practices during Vulnerability Assessment, organizations can maintain a robust security posture for their critical assets.
• Continuous Automated Infrastructure Penetration Testing – Breach and Attack Simulation (BAS)
• To maintain compliance with CIS Controls and an understanding of security risks, it is essential to perform Vulnerability Assessment frequently and continuously.
• Benefits of an ongoing VA program include:
• Real-time visibility – proactively monitor exposure to new threats as systems and applications change.
• Speed of intervention – immediate identification of new gaps to be resolved according to CIS Controls.
• Progressive improvement – tracking progress over time towards complete coverage of critical controls.
• Dynamic risk management – evaluating the impact of internal and external changes on exposure to attacks.
• Proof of Diligence – demonstration of concrete commitment to following recognized best practice frameworks.
• By outsourcing ongoing Vulnerability Assessment to qualified managed service providers, companies and organizations can benefit from specialized skills and advanced technologies to effectively integrate CIS Controls into their security program.
• Conclusion
• The CIS Critical Security Controls constitute a solid foundation of cybersecurity best practices developed by high-profile experts.
• By integrating them into the Vulnerability Assessment process, organizations can concretely evaluate their compliance with these validated standards and identify priority areas for improvement.
• A continuous program of checks allows you to monitor the security status over time and guide hardening and risk mitigation activities in line with the CIS Controls recommendations.
• By taking a proactive approach, you can respond more quickly to evolving threats, reducing your attack surface and strengthening your overall cybersecurity posture.

Useful links:

• CIS Critical Security Controls Version 8: what they are and why they are important for cybersecurity
• Vulnerability Assessment and Penetration testing