Amidst the volatility, uncertainty and noise of the cybersecurity field, few best practice frameworks have emerged as consistently reliable and useful as the Center for Internet Security (CIS) Security Controls. Recently updated as version 7.0, the CIS Controls represent the most important security controls that an organization must implement to secure its data, information systems and operational technology.
The wide recognition of this framework as a de facto standard of care for cybersecurity is based on several key attributes.
The CIS Controls take a “must do first” approach to the challenge of securing information systems. Starting with basic controls, such as knowing what’s connected to your network and what’s running on your systems, the Controls advance to more refined controls such as maintaining secure configurations and tight control over administrative rights before tackling the complexities of intrusion detection and incident response. In this way, the CIS Controls take a building block approach to cybersecurity, outlining a roadmap that all organizations can follow.
These are essential and foundational controls without which no cybersecurity program can be effective. While there are many more controls that can be implemented with an even broader range of technical capabilities that can be deployed, the focus remains on those controls that matter most. Many experts have suggested that successfully implementing even the first five or six Controls will mitigate 85% or more of cybersecurity incidents. This prioritization and focus can improve effectiveness while eliminating waste and maximizing the return on cybersecurity investments.
CIS does not develop these Controls in isolation. Rather, CIS engages a diverse group of cybersecurity practitioners from government, industry and academia in a variety of roles. The breadth of perspectives, representing the various needs and constraints of a cross section of sectors, (Read more...)
*** This is a Security Bloggers Network syndicated blog from The State of Security authored by Maurice Uenuma. Read the original post at: https://www.tripwire.com/state-of-security/security-data-protection/security-controls/jumpstarting-your-cyberdefense-machine-with-cis-controls-v7/
Digital+ Partners Leads Continuation Funding Round in Growing Automated Threat Analysis & Detection Provider, Closing its Series B Round at…
For three years OpenWRT had a severe validation problem with its download package manager, until a fuzz tester found and…
It’s time to say a final “Goodbye” to Flash. (Or should that be “Good riddance”?) With earlier this week seeing…
This is the second in a series of blog posts that discuss how smart DNS resolvers can enhance ongoing network…
Security researchers detected a new spear-phishing attack that’s using an exact domain spoofing tactic in order to impersonate Microsoft. On…
Welcome back to the last part of our three-part blog series on how to leverage analytics to deliver an exceptional…