Saturday, April 17, 2021
  • Who Invented the Personal Computer? “Apple Was Literally Following Us Around”
  • Phishing 101: How It Works & What to Look For
  • Cyberthreat update from Acronis CPOCs: Week of April 12, 2021
  • El futuro de TI según Forrester
  • WeAreDelphix: Meet Javier Barthe

Security Boulevard

The Home of the Security Bloggers Network

Community Chats Webinars Library
  • Home
    • Cybersecurity News
    • Features
    • Industry Spotlight
    • News Releases
  • Security Bloggers Network
    • Latest Posts
    • Contributors
    • Syndicate Your Blog
    • Write for Security Boulevard
  • Webinars
    • Upcoming
    • On-Demand
  • Chat
    • Security Boulevard Chat
    • Marketing InSecurity Podcast
  • Library
  • Related Sites
    • MediaOps Inc.
    • DevOps.com
    • Container Journal
    • Digital Anarchist
    • SweetCode.io
  • Media Kit

  • Analytics
  • AppSec
  • CISO
  • Cloud
  • DevOps
  • GRC
  • Identity
  • Incident Response
  • IoT / ICS
  • Threats / Breaches
  • More
    • Blockchain / Digital Currencies
    • Careers
    • Cyberlaw
    • Mobile
    • Social Engineering
  • Humor
Security Bloggers Network 

Home » Security Bloggers Network » Two-Thirds of Organizations Don’t Use Hardening Benchmarks to Establish a Secure Baseline, Report Reveals

Two-Thirds of Organizations Don’t Use Hardening Benchmarks to Establish a Secure Baseline, Report Reveals

by Ray Lapena on August 9, 2018

The Center for Internet Security’s Critical Security Controls (“the CIS Controls”) are incredibly useful in helping organizations defend themselves against digital threats. By adopting the first five controls alone, it’s possible for companies to prevent 85 percent of attacks. Adopting all 20 controls can prevent as much as 97 percent of attacks.

Unfortunately, a majority of organizations still haven’t implemented industry standards like the CIS Controls into their security strategies. That’s one of the findings from Tripwire’s State of Cyber Hygiene report. The survey found that two-thirds of organizations do not use hardening benchmarks like CIS or Defense Information Systems Agency (DISA) guidelines to establish a secure baseline.

Tim Erlin, vice president of product management and strategy at Tripwire, said this finding wasn’t expected:

These industry standards are one way to leverage the broader community, which is important with the resource constraints that most organizations experience. It’s surprising that so many respondents aren’t using established frameworks to provide a baseline for measuring their security posture. It’s vital to get a clear picture of where you are so that you can plan a path forward.

For the report, Tripwire surveyed 306 IT security professionals in July 2018 in partnership with Dimensional Research to examine how organizations are implementing security controls that the Center for Internet Security (CIS) refers to as “Cyber Hygiene.” Specifically, Tripwire’s State of Cyber Hygiene explored how organizations are implementing security practices related to network visibility, vulnerability management, configuration management, administrative privileges and logging.

Given the lacking adoption of the CIS Controls and other hardening benchmarks, it’s not surprising the survey found that organizations were falling short in many of those key areas identified above, as well:

  • More than half (57 percent) of respondents said it takes hours, weeks, months or longer to detect new (Read more...)

*** This is a Security Bloggers Network syndicated blog from The State of Security authored by Ray Lapena. Read the original post at: https://www.tripwire.com/state-of-security/security-data-protection/security-hardening/organizations-hardening-benchmarks-secure-baseline/

August 9, 2018August 9, 2018 Ray Lapena Benchmarks, CIS, hardening, security, Security Hardening
  • ← That’s Right, We are Playing Both Sides of the Key Management Game:
  • Researchers aim to befuddle cybercriminals with defensive WWII fighter pilot trick →

TechStrong TV – Live

Watch latest episodes and shows

Subscribe to our Newsletters

Get breaking news, free eBooks and upcoming events delivered to your inbox.
  • View Security Boulevard Privacy Policy

Most Read on the Boulevard

Identity Management Day: Cybercriminals No Longer Hack in, They Log In
Hackers Leak Hacker Data in Swarmshop Breach
YT$AW: FBI Cleans Up Exchange Servers, NSA Tips Microsoft 4 More Bugs
Salesforce DevSecOps: Avoiding Arrested Development
Majority of Mobile App Vulnerabilities From Open Source Code
GUEST BLOG: Secure your data for cyber resilience
Mayhem for API ❤️ GitHub: Seamless DevSecOps for your REST APIs
Tradecraft Training Q&A: How to Use the Dark Web for Your Investigations
5 Major Reasons for “Why is Cyber Security Important?”
How AI is Contributing to Global Warming and What it Can Learn from Bitcoin

Upcoming Webinars

Wed 21

Managing Open Policy Agent at Scale

April 21 @ 3:00 pm - 4:00 pm
Thu 22

A New Approach to Secure Web Gateways

April 22 @ 11:00 am - 12:00 pm
Mon 26

The Kubernetes Network (Security) Effect

April 26 @ 9:00 am - 10:00 am
Mon 26

Application Security: Moving at the Speed of DevOps

April 26 @ 1:00 pm - 2:00 pm
Wed 28

Cyber Attacks From the Open Source Perspective

April 28 @ 1:00 pm - 2:00 pm
Thu 29

Hack My Java Application: Demonstrating How Snyk and Red Hat Help Developers Stay Performant and Secure

April 29 @ 11:00 am - 12:00 pm
May 05

Managing Permissions and Entitlements is at the Core of a Zero Trust Model in the Cloud

May 5 @ 3:00 pm - 4:00 pm

More Webinars

Download Free eBook

Managing the AppSec Toolstack

Recent Security Boulevard Chats

  • Cloud, DevSecOps and Network Security, All Together?
  • Security-as-Code with Tim Jefferson, Barracuda Networks
  • ASRTM with Rohit Sethi, Security Compass
  • Deception: Art or Science, Ofer Israeli, Illusive Networks
  • Tips to Secure IoT and Connected Systems w/ DigiCert

Industry Spotlight

Three Wishes to Revitalize SIEM and Your SOC
Cybersecurity Data Security Endpoint Industry Spotlight Network Security Security Boulevard (Original) 

Three Wishes to Revitalize SIEM and Your SOC

April 16, 2021 Albert Zhichun Li | Yesterday 0
Breach Clarity Weekly Data Breach Report: Week of April 12
Cybersecurity Data Security Identity & Access Industry Spotlight Security Boulevard (Original) Threats & Breaches 

Breach Clarity Weekly Data Breach Report: Week of April 12

April 14, 2021 Kyle Marchini | 3 days ago 0
Securing Remote Health Care Post-COVID-19
Cloud Security Cybersecurity Data Security Governance, Risk & Compliance Industry Spotlight Mobile Security Security Boulevard (Original) 

Securing Remote Health Care Post-COVID-19

April 14, 2021 Mike Nelson | 3 days ago 0

Top Stories

U.S. Fingers Putin’s Cozy Bear for SolarWinds Attacks
Analytics & Intelligence Application Security Cloud Security Cyberlaw Cybersecurity Data Security Endpoint Featured Governance, Risk & Compliance Incident Response IoT & ICS Security Malware Network Security News Security Boulevard (Original) Spotlight Threat Intelligence Threats & Breaches Vulnerabilities 

U.S. Fingers Putin’s Cozy Bear for SolarWinds Attacks

April 16, 2021 Richi Jennings | Yesterday 0
YT$AW: FBI Cleans Up Exchange Servers, NSA Tips Microsoft 4 More Bugs
Analytics & Intelligence Cloud Security Cyberlaw Cybersecurity Data Security Endpoint Featured Governance, Risk & Compliance Incident Response Malware Network Security News Security Awareness Security Boulevard (Original) Spotlight Threat Intelligence Threats & Breaches Vulnerabilities 

YT$AW: FBI Cleans Up Exchange Servers, NSA Tips Microsoft 4 More Bugs

April 14, 2021 Richi Jennings | 3 days ago 0
Son of Stuxnet? Iran Nuke Site Hacked ‘by Israel’ (Again)
Analytics & Intelligence Application Security AppSec Cyberlaw Cybersecurity Deep Fake and Other Social Engineering Tactics Endpoint Featured Governance, Risk & Compliance Identity & Access Identity and Access Management Incident Response IoT & ICS Security Malware Network Security News Securing the Edge Security Awareness Security Boulevard (Original) Social Engineering Spotlight Threat Intelligence Threats & Breaches Vulnerabilities 

Son of Stuxnet? Iran Nuke Site Hacked ‘by Israel’ (Again)

April 12, 2021 Richi Jennings | Apr 12 0

Security Humor

via   the comic delivery system monikered   Randall Munroe   resident at   XKCD  !

XKCD ‘Post Vaccine Social Scheduling’

Join the Community

  • Add your blog to Security Bloggers Network
  • Write for Security Boulevard
  • Bloggers Meetup and Awards
  • Ask a Question
  • Email: info@securityboulevard.com

Useful Links

  • About
  • Media Kit
  • Sponsors Info
  • Copyright
  • TOS
  • Privacy Policy
  • DMCA Compliance Statement

Other Mediaops Sites

  • Container Journal
  • DevOps.com
  • DevOps Connect
  • DevOps Institute
Copyright © 2021 MediaOps Inc. All rights reserved.
Our website uses cookies. By continuing to browse the website you are agreeing to our use of cookies. For more information on how we use cookies and how you can disable them, please read our Privacy Policy.