The Center of Internet Security, or CIS for short, has recently released a new revision of their Top 20 Security Controls. This set of regulations represents the top security measures designed to detect security threats and prevent cyberattacks. While following the CIS Top 20 Security Controls is not in any way a requirement by law, it is recommended to both small and large business who aim to protect their data and clients from the threats of today’s cyber world.
Statistics have shown that implementing only the first five CIS security controls results in a significant decrease of security threats. Therefore, if only five of the CIS security controls can prevent 85% of potential cyberattacks, imagine what implementing all 20 regulations would do for your business. In order to better understand the CIS Top 20 Security Controls, we are going to list and briefly explain each of them below!
- Inventory and Control of Hardware Assets: The first CIS security control includes monitoring hardware inventory in order to have a clear view of all devices connected to your company’s network at all times. This security measure reduces the company’s potential attack surface.
- Inventory and Control of Software Assets: Similarly to the first regulation, the second measurement requires you to keep track of all your software assets in order to strengthen your security system.
- Continuous Vulnerability Management: Vulnerability management involves scanning the network regularly in order to reveal risks and vulnerabilities at the earliest stage, before they evolve in serious cyberattacks.
- Controlled Use of Administrative Privileges: Cybercriminals frequently target administrative credentials, as this data is very easy to compromise. To secure this data, you should keep track of all your admin accounts, as well as change your passwords on a consistent basis.
- Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers: The fifth security control includes implementing FIM or file integrity monitoring in order to keep track of important configuration files.
- Maintenance, Monitoring, and Analysis of Audit Logs: Keeping an accurate system log means having information regarding all activities that take place on your network. By consistently analyzing, monitoring, and maintaining the audit logs, you will be able to know crucial information about security incidents, including where and how they happened.
- Email and Web Browser Protection: A large percentage of security threats comes from emails and web browsers through phishing scams and other misleading links and websites. The seventh CIS security regulation requires you to protect your email and web browser, as well as stay aware of these security issues.
- Malware Defenses: Installing an Anti-Virus software and keeping it up to date, as well as regularly scanning your device for malware.
- Limitation and Control of Network Ports, Protocols and Services: This regulation allows you to use automated port scanning and firewalls to significantly reduce cybersecurity threats.
- Data Recovery Capabilities: The tenth CIS security measurement includes regularly or even automatically performing data backup.
- Secure Configuration for Network Devices such as Firewalls, Routers, and Switches: This regulation refers to using encryption to secure all your network devices.
- Boundary Defense: Refers to your methods of controlling communications across your network boundaries.
- Data Protection: One of the most complex CIS security regulations that requires consistent, ongoing processes that aim to protect sensitive data.
- Controlled Access based on the Need to Know: This regulation implies that you should encrypt all information in transit and disable communication between workstations in order to decrease the number of security incidents.
- Wireless Access Control: Includes implementing measures to avoid potential wireless access risks.
- Account Monitoring and Control: Refers to the efforts you put into controlling authentication mechanisms to keep your credentials safe.
- Implement a Security Awareness and Training Program: According to the 17th CIS security control, each business should conduct training programs to educate employees on the risks and potential solutions to cybersecurity.
- Application Software Security: Includes analysis that is meant to reveal vulnerabilities in code and applications.
- Incident Response and Management: Includes strategies that help businesses respond to security incidents more effectively.
- Penetration Tests and Red Team Exercises: Conducting tests that help teams identify threats, stop or respond to potential attacks.
If you need professional assistance when it comes to following the CIS Top 20 Security Controls, feel free to reach out experts at The Network Pro, who will work with you on improving your company’s online security.
(714) 333-9620
714-333-9620