CIS Controls e Vulnerability Assessment Piergiorgio Venuti

CIS Controls and Vulnerability Assessment: practical guide to adopting best practices

Estimated reading time: 6 minutes

Critical Security Controls, also known as CIS Controls, are a series of cybersecurity actions and technologies developed to protect organizations from common and effective cyber attacks. This article explains what CIS is, the benefits of adopting CIS Controls and how to integrate them into the Vulnerability Assessment process to improve your security posture.

What is CIS (Center for Internet Security)?

The Center for Internet Security (CIS) is a non-profit organization dedicated to improving cyber resilience globally. CIS manages various programs including:

  • The CIS Controls or Critical Security Controls.
  • The MS-ISAC (Multi-State Information Sharing & Analysis Center) to share threat intelligence.
  • CIS Benchmarks for secure computer system configurations.

CIS is supported by governments, private companies, academic institutions and technical communities to develop cybersecurity best practices.

CIS Controls (Critical Security Controls)

The CIS Controls, initially known as the SANS Top 20 Critical Security Contros, were developed by CIS together with high-level cybersecurity experts.

It is a series of actions, policies and security tools prioritized and consolidated into a standard checklist. The goal is to guide organizations to implement the most critical and effective defenses to block known and emerging cyber attacks.

The benefits of adopting CIS Controls include:

  • Pragmatic, high-impact approach – focuses on the highest-value best practices.
  • Evidence-based – derived from the analysis of millions of real attacks.
  • Cross-disciplinary applicability – effective for organizations of all sizes and sectors.
  • Measurable metrics – implementation score to track improvement.
  • Constantly updated – continuously reviewed by experts to reflect the threat landscape.

Evolution of CIS Controls

The first version of Critical Security Controls dates back to 2008. Over the years they have been reviewed and updated regularly to keep them relevant against emerging threats.

The latest release is version 8 (CIS Controls v8) released in 2021, which includes 20 core controls. Here are some of the main new features:

  • Unification of identity and access controls in a single domain.
  • New controls specific to mobile and IoT devices.
  • Increased focus on supply chain attacks and ransomware.
  • Integration of emerging technologies such as microservices and containers.
  • New deployment metrics for more granular measurement.

The 20 Critical Security Controls CIS v8

Below are the 20 domains of CIS Controls ver. 8 grouped into their respective management areas:

Protect critical information and systems

  1. Inventory of authorized and unauthorized devices
  2. Inventory of authorized and unauthorized software
  3. Protect hardware and software configurations on mobile devices, laptops, workstations and servers
  4. Continuous assessment and remediation of vulnerabilities
  5. Protection of the development and delivery stages of the software application

Develop a culture of safety and awareness

  1. Administrative authorization
  2. Maintenance, monitoring and analysis of audit logs

Strengthen defense and simplify security

  1. Defense against malware
  2. Limitation and control of network ports, protocols and services
  3. Data protection
  4. Network protection
  5. Sensitive access control

Use analytics to respond to events

  1. Data protection and security analysis systems
  2. Event detection and response to security incidents

Reduce the attack surface and opportunities for attackers

  1. Implementation of a Zero Trust security architecture
  2. Data protection and access control
  3. Security implementation for network and mobility devices
  4. Device and data center protection on on-premises, hybrid networks and cloud systems

Respond adaptively to restore the situation

  1. Incident response and disaster recovery plans
  2. Exercises to evaluate and improve incident response and disaster recovery plans

CIS Controls Self-Assessment Scanner

To simplify the adoption of CIS Controls, CIS provides a free self-assessment tool, the CIS Controls Self-Assessment Scanner.

This scanner allows you to fill out an online questionnaire on the implementation status of various controls within your organization.

At the end, a report is obtained that assigns an overall score and identifies priority areas for improvement to strengthen defenses based on CIS Controls.

The tool provides a high-level overview but does not directly test the security or effectiveness of the controls. This is why more in-depth activities such as Vulnerability Assessment are necessary.

Integrate CIS Controls into Vulnerability Assessment

Carrying out a periodic Vulnerability Assessment allows you to promptly identify all vulnerabilities and security flaws within the IT infrastructure.

To comprehensively cover attack vectors, the assessment should check both misconfigurations that can violate CIS Controls and technical vulnerabilities in systems.

For example, scanning can:

  • Detect configuration errors that expose sensitive network ports.
  • Identify unnecessary services active on servers and workstations.
  • Find out-of-date and exploit-prone software applications.
  • Uncover accounts with weak passwords or default credentials.
  • Identify operating systems or databases that are obsolete and no longer supported.
  • Analyze security policies and settings in detail.

Therefore, the final Vulnerability Assessment report can include specific remediation indications to resolve these problems, aligning with the violated CIS Controls.

In this way the organization is able to:

  • Measure the actual level of compliance with CIS best practices.
  • Prioritize corrective actions based on risk.
  • Monitor progress in implementing key defenses.
  • Demonstrate commitment to following standards validated by the IT community.
  • The Vulnerability Assessment becomes an even more valuable tool by integrating the checks with the CIS Controls as a reference framework.
  • Hardening of systems via CIS Controls
  • CIS Controls provide operational guidance to protect IT systems through “hardening” best practices, i.e. strengthening security.
  • Here are some examples of hardening activities led by CIS Controls:
  • Remove unnecessary software – uninstall non-essential components, features and services according to Check 2.
  • Closing ports and services – block network ports, disable obsolete and unused services by applying Checks 9 and 11.
  • Periodic updates – keep operating systems, software and firmware fully patched as indicated in Check 4.
  • Minimize users and privileges – assign the minimum administrative privileges required by the user’s role as per Check 6.
  • Data Protection – encrypt sensitive data both in transit and at rest by implementing Control 10.
  • Multi-factor authentication – require multiple credentials to access critical assets as Control 12 dictates.
  • Network segmentation – logically separate sensitive environments and data flows as recommended by Control 11.
  • Log collection and retention – collect, centralize and maintain system, application and security event logs for Control 7.
  • By regularly verifying compliance with these best practices during Vulnerability Assessment, organizations can maintain a robust security posture for their critical assets.
  • Continuous Automated Infrastructure Penetration Testing – Breach and Attack Simulation (BAS)
  • To maintain compliance with CIS Controls and an understanding of security risks, it is essential to perform Vulnerability Assessment frequently and continuously.
  • Benefits of an ongoing VA program include:
  • Real-time visibility – proactively monitor exposure to new threats as systems and applications change.
  • Speed of intervention – immediate identification of new gaps to be resolved according to CIS Controls.
  • Progressive improvement – tracking progress over time towards complete coverage of critical controls.
  • Dynamic risk management – evaluating the impact of internal and external changes on exposure to attacks.
  • Proof of Diligence – demonstration of concrete commitment to following recognized best practice frameworks.
  • By outsourcing ongoing Vulnerability Assessment to qualified managed service providers, companies and organizations can benefit from specialized skills and advanced technologies to effectively integrate CIS Controls into their security program.
  • Conclusion
  • The CIS Critical Security Controls constitute a solid foundation of cybersecurity best practices developed by high-profile experts.
  • By integrating them into the Vulnerability Assessment process, organizations can concretely evaluate their compliance with these validated standards and identify priority areas for improvement.
  • A continuous program of checks allows you to monitor the security status over time and guide hardening and risk mitigation activities in line with the CIS Controls recommendations.
  • By taking a proactive approach, you can respond more quickly to evolving threats, reducing your attack surface and strengthening your overall cybersecurity posture.

Useful links:

Share


RSS

More Articles…

Categories …

Tags

RSS darkreading

RSS Full Disclosure

  • Some SIM / USIM card security (and ecosystem) info October 4, 2024
    Posted by Security Explorations on Oct 04Hello All, Those interested in SIM / USIM card security might find some information at our spin-off project page dedicated to the topic potentially useful: https://security-explorations.com/sim-usim-cards.html We share there some information based on the experiences gained in the SIM / USIM card security space, all in a hope this […]
  • SEC Consult SA-20240930-0 :: Local Privilege Escalation via MSI Installer in Nitro PDF Pro (CVE-2024-35288) October 1, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 30>
  • Backdoor.Win32.Benju.a / Unauthenticated Remote Command Execution September 29, 2024
    Posted by malvuln on Sep 28Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/88922242e8805bfbc5981e55fdfadd71.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Benju.a Vulnerability: Unauthenticated Remote Command Execution Family: Benju Type: PE32 MD5: 88922242e8805bfbc5981e55fdfadd71 SHA256: 7d34804173e09d0f378dfc8c9212fe77ff51f08c9d0b73d00a19b7045ddc1f0e Vuln ID: MVID-2024-0700...
  • Backdoor.Win32.Prorat.jz / Remote Stack Buffer Overflow (SEH) September 29, 2024
    Posted by malvuln on Sep 28Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/277f9a4db328476300c4da5f680902ea.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Prorat.jz Vulnerability: Remote Stack Buffer Overflow (SEH) Description: The RAT listens on TCP ports 51100,5112,5110 and runs an FTP service. Prorat uses a vulnerable component in a secondary malware […]
  • Backdoor.Win32.Amatu.a / Remote Arbitrary File Write (RCE) September 29, 2024
    Posted by malvuln on Sep 28Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/1e2d0b90ffc23e00b743c41064bdcc6b.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Amatu.a Vulnerability: Remote Arbitrary File Write (RCE) Family: Amatu Type: PE32 MD5: 1e2d0b90ffc23e00b743c41064bdcc6b SHA256: 77fff9931013ab4de6d4be66ca4fda47be37b6f706a7062430ee8133c7521297 Vuln ID: MVID-2024-0698 Dropped...
  • Backdoor.Win32.Agent.pw / Remote Stack Buffer Overflow (SEH) September 29, 2024
    Posted by malvuln on Sep 28Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/68dd7df213674e096d6ee255a7b90088.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Agent.pw Vulnerability: Remote Stack Buffer Overflow (SEH) Description: The malware listens on TCP port 21111. Third-party attackers who can reach an infected machine can send specially crafted sequential packetz […]
  • Backdoor.Win32.Boiling / Remote Command Execution September 29, 2024
    Posted by malvuln on Sep 28Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: https://malvuln.com/advisory/80cb490e5d3c4205434850eff6ef5f8f.txt Contact: malvuln13 () gmail com Media: x.com/malvuln Threat: Backdoor.Win32.Boiling Vulnerability: Unauthenticated Remote Command Execution Description: The malware listens on TCP port 4369. Third party adversaries who can reach an infected host, can issue single OS commands to […]
  • Defense in depth -- the Microsoft way (part 88): a SINGLE command line shows about 20, 000 instances of CWE-73 September 29, 2024
    Posted by Stefan Kanthak on Sep 28Hi @ll, CWE-73: External Control of File Name or Path is a well-known and well-documented weakness. as well as demonstrate how to (ab)use just one instance of this weakness (introduced about 7 years ago with Microsoft Defender, so-called "security software") due to...
  • SEC Consult SA-20240925-0 :: Uninstall Password Bypass in BlackBerry CylanceOPTICS Windows Installer Package (CVE-2024-35214) September 29, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Sep 28SEC Consult Vulnerability Lab Security Advisory < 20240925-0 > ======================================================================= title: Uninstall Password Bypass product: BlackBerry CylanceOPTICS Windows Installer Package vulnerable version: CylanceOPTICS
  • Apple iOS 17.2.1 - Screen Time Passcode Retrieval (Mitigation Bypass) September 29, 2024
    Posted by Patrick via Fulldisclosure on Sep 28Document Title: =============== Apple iOS 17.2.1 - Screen Time Passcode Retrieval (Mitigation Bypass) Release Date: ============= 2024-09-24 Affected Product(s): ==================== Vendor: Apple Inc. Product: Apple iOS 17.2.1 (possibly all < 18.0 excluding 18.0) References: ==================== VIDEO PoC: https://www.youtube.com/watch?v=vVvk9TR7qMo The vulnerability has been patched in the latest release of […]

Customers

Newsletter

{subscription_form_1}