Name: CIS Critical Security Controls v7
|Inventory and Control of Hardware Assets
|Utilize an active discovery tool to identify devices connected to the organization's network and update the hardware asset inventory.
|Utilize a passive discovery tool to identify devices connected to the organization's network and automatically update the organization's hardware asset inventory.
|Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address management tools to update the organization's hardware asset inventory.
|Maintain an accurate and up-to-date inventory of all technology assets with the potential to store or process information. This inventory shall include all hardware assets, whether connected to the organization's network or not.
|Ensure that the hardware asset inventory records the network address, hardware address, machine name, data asset owner, and department for each asset and whether the hardware asset has been approved to connect to the network.
|Ensure that unauthorized assets are either removed from the network, quarantined or the inventory is updated in a timely manner.
|Utilize port level access control, following 802.1x standards, to control which devices can authenticate to the network. The authentication system shall be tied into the hardware asset inventory data to ensure only authorized devices can connect to the network.
|Use client certificates to authenticate hardware assets connecting to the organization's trusted network.
|Inventory and Control of Software Assets
|Maintain an up-to-date list of all authorized software that is required in the enterprise for any business purpose on any business system.
|Ensure that only software applications or operating systems currently supported by the software's vendor are added to the organization's authorized software inventory. Unsupported software should be tagged as unsupported in the inventory system.
|Utilize software inventory tools throughout the organization to automate the documentation of all software on business systems.
|The software inventory system should track the name, version, publisher, and install date for all software, including operating systems authorized by the organization.
|The software inventory system should be tied into the hardware asset inventory so all devices and associated software are tracked from a single location.
|Ensure that unauthorized software is either removed or the inventory is updated in a timely manner
|Utilize application whitelisting technology on all assets to ensure that only authorized software executes and all unauthorized software is blocked from executing on assets.
|The organization's application whitelisting software must ensure that only authorized software libraries (such as *.dll, *.ocx, *.so, etc) are allowed to load into a system process.
|The organization's application whitelisting software must ensure that only authorized, digitally signed scripts (such as *.ps1, *.py, macros, etc) are allowed to run on a system.
|Physically or logically segregated systems should be used to isolate and run software that is required for business operations but incur higher risk for the organization.
|Continuous Vulnerability Management
|Utilize an up-to-date SCAP-compliant vulnerability scanning tool to automatically scan all systems on the network on a weekly or more frequent basis to identify all potential vulnerabilities on the organization's systems.
|Perform authenticated vulnerability scanning with agents running locally on each system or with remote scanners that are configured with elevated rights on the system being tested.
|Use a dedicated account for authenticated vulnerability scans, which should not be used for any other administrative activities and should be tied to specific machines at specific IP addresses.
|Deploy automated software update tools in order to ensure that the operating systems are running the most recent security updates provided by the software vendor.
|Deploy automated software update tools in order to ensure that third-party software on all systems is running the most recent security updates provided by the software vendor.
|Regularly compare the results from back-to-back vulnerability scans to verify that vulnerabilities have been remediated in a timely manner.
|Utilize a risk-rating process to prioritize the remediation of discovered vulnerabilities.
|Controlled Use of Administrative Privileges
|Use automated tools to inventory all administrative accounts, including domain and local accounts, to ensure that only authorized individuals have elevated privileges.
|Before deploying any new asset, change all default passwords to have values consistent with administrative level accounts.
|Ensure that all users with administrative account access use a dedicated or secondary account for elevated activities. This account should only be used for administrative activities and not internet browsing, email, or similar activities.
|Where multi-factor authentication is not supported (such as local administrator, root, or service accounts), accounts will use passwords that are unique to that system.
|Use multi-factor authentication and encrypted channels for all administrative account access.
|Ensure administrators use a dedicated machine for all administrative tasks or tasks requiring administrative access. This machine will be segmented from the organization's primary network and not be allowed Internet access. This machine will not be used for reading e-mail, composing documents, or browsing the Internet.
|Limit access to scripting tools (such as Microsoft PowerShell and Python) to only administrative or development users with the need to access those capabilities.
|Configure systems to issue a log entry and alert when an account is added to or removed from any group assigned administrative privileges.
|Configure systems to issue a log entry and alert on unsuccessful logins to an administrative account.
|Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers
|Maintain documented, standard security configuration standards for all authorized operating systems and software.
|Maintain secure images or templates for all systems in the enterprise based on the organization's approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates.
|Store the master images and templates on securely configured servers, validated with integrity monitoring tools, to ensure that only authorized changes to the images are possible.
|Deploy system configuration management tools that will automatically enforce and redeploy configuration settings to systems at regularly scheduled intervals.
|Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to verify all security configuration elements, catalog approved exceptions, and alert when unauthorized changes occur.
|Maintenance, Monitoring and Analysis of Audit Logs
|Use at least three synchronized time sources from which all servers and network devices retrieve time information on a regular basis so that timestamps in logs are consistent.
|Ensure that local logging has been enabled on all systems and networking devices.
|Enable system logging to include detailed information such as a event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.
|Ensure that all systems that store logs have adequate storage space for the logs generated.
|Ensure that appropriate logs are being aggregated to a central log management system for analysis and review.