The Center for Internet Security Critical Security Controls for Effective Cyber Defense

The The Center for Internet Security Critical Security Controls for Effective Cyber Defense is a publication of best practice guidelines for computer security. The project was initiated early in 2008 as a response to extreme data losses experienced by organizations in the US defense industrial base and recently .[1] The publication was initially developed by the SANS Institute and ownership transferred to Center for Internet Security (CIS) in 2015. It was earlier known as the Consensus Audit Guidelinesare and also known as the CIS CSC, CIS 20, CCS CSC, SANS Top 20 or CAG 20.

Goals

The guidelines consist of 20 key actions, called critical security controls (CSC), that organizations should take to block or mitigate known attacks. The controls are designed so that primarily automated means can be used to implement, enforce and monitor them.[2] The security controls give no-nonsense, actionable recommendations for cyber security, written in language that’s easily understood by IT personnel.[3] Goals of the Consensus Audit Guidelines include to:

Controls

Version 3.0 was released on April 13, 2011. Version 5.0 was released on February 2, 2014 by the Council on Cyber Security (CCS).[5] Version 6.0 was released on October 15, 2015 and consists of the security controls below. Version 6.1 was released on August 31, 2016 and has the same priorization as version 6. Compared to version 5, version 6/6.1 has re-prioritized the controls and changed these two controls: 

CSC 1: Inventory of Authorized and Unauthorized Devices
CSC 2: Inventory of Authorized and Unauthorized Software
CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
CSC 4: Continuous Vulnerability Assessment and Remediation
CSC 5: Controlled Use of Administrative Privileges
CSC 6: Maintenance, Monitoring, and Analysis of Audit Logs
CSC 7: Email and Web Browser Protections
CSC 8: Malware Defenses
CSC 9: Limitation and Control of Network Ports, Protocols, and Services
CSC 10: Data Recovery Capability
CSC 11: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
CSC 12: Boundary Defense
CSC 13: Data Protection
CSC 14: Controlled Access Based on the Need to Know
CSC 15: Wireless Access Control
CSC 16: Account Monitoring and Control
CSC 17: Security Skills Assessment and Appropriate Training to Fill Gaps
CSC 18: Application Software Security
CSC 19: Incident Response and Management
CSC 20: Penetration Tests and Red Team Exercises

Contributors

The Consensus Audit Guidelines (CAG) were compiled by a consortium of more than 100 contributors[6] from US government agencies, commercial forensics experts and pen testers.[7] Authors of the initial draft include members of:

Notable results

Starting in 2009, the US Department of State began supplementing its risk scoring program in part using the Consensus Audit Guidelines. According to the Department's measurements, in the first year of site scoring using this approach the department reduced overall risk on its key unclassified network by nearly 90 percent in overseas sites, and by 89 percent in domestic sites.[8]

Criticisms

It Costs Money

US Federal agencies do not have the money to both meet the FISMA requirements and attempt to meet the "Critical Control 20".

Designed to sell product

May see the controls as a list '"20 Pseudo-Critical Faux Controls for Technology Adoption." It's clear that this list exists to push more product'

Not metric-based

The controls have no method of measuring success

Licensing

Recently SANS places additional restrictions on Attribution and NoDerivatives, (Attribution-NoDerivs 3.0 Unported (CC BY-ND 3.0)), although this set of documents was created and supported by the community. In addition, the No Derivatives, restricts developers of security controls for other systems and protocols, to distribute that derivative to further benefit greater security community.

References

  1. 1 2 "Gilligan Group Inc., CAG Background and Participants"
  2. ↑ “Understanding Technology Stakeholders: Their Progress and Challenges” by John M. Gilligan, Software Assurance Forum, November 4, 2009
  3. ↑ “Consensus Audit Guidelines: Overview” by Lieberman Software Corporation
  4. ↑ “Consensus Audit Guidelines: Time to ‘Stop The Bleeding’” by John M. Gilligan, 10th Semi-Annual Software Assurance Forum, March 12, 2009
  5. ↑ http://www.counciloncybersecurity.org/practice-areas/technology
  6. ↑ James Tarala and Jennifer Adams, "The Consensus Audit Guidelines: Drastically Improve Security of HIT Systems"
  7. ↑ SANS Website, "20 Critical Security Controls"
  8. ↑ "Hearing Before the Subcommittee on Government Management, Organization, and Procurement of the Committee on Oversight and Government Reform, House of Representatives, One Hundred Eleventh Congress, Second Session, March 24, 2010, 'Federal Information Security: Current Challenges and Future Policy Considerations'"

External links

This article is issued from Wikipedia - version of the 9/16/2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.