Today\u2019s world is one filled with cybersecurity threats and more, with new kinds of malware coming out every single day. While the basics of cybersecurity and cyber hygiene are important for everyone, it\u2019s especially important for an enterprise\u2019s network. A single breach into a large network can cause a huge range of problems, including, in worse case scenarios, the installation of ransomware.<\/p>\n\n\n\n
CIS controls outline important steps for network monitoring and how to create and maintain a secure configuration of enterprise assets.<\/p>\n\n\n\n
Control 1 is the first step in creating a system that protects the totality of an enterprise\u2019s network. Here\u2019s what you need to know.<\/p>\n\n\n\n
CIS stands for the Center for Internet Security. CIS is an organization created to help monitor security risks across the entire internet. They create standards for cyber defense that are designed to help businesses, large enterprises, and even individuals better maintain control of hardware assets, software asset, and create systems that detect and prevent cyber attacks before they happen.<\/p>\n\n\n\n
The controls themselves are the 18 things you can control in your system to help eliminate cyber vulnerabilities and improve your cyber defense overall.<\/p>\n\n\n\n
CIS also offers certifications for businesses and enterprises that meet control specifications, giving both the business, and their clients, some additional peace of mind. CIS Controls and NIST CSF don\u2019t necessarily line up one to one, but both systems and implementation groups can be useful for system security.<\/p>\n\n\n\n
CIS Control 1 is inventory and control of enterprise assets. This control is critical because you cannot defend devices, assets, and networks when you don\u2019t know what devices are potentially accessing that network.<\/p>\n\n\n\n
This control is the base on which all of your other security efforts are built. Network monitoring, from the computers, mobile devices, and internet of things devices connected to your enterprise\u2019s network is the most basic first step to creating an effective security network.<\/p>\n\n\n\n
Here\u2019s how you do it.<\/p>\n\n\n\n
The steps to meeting CIS control 1 requirements are simple in concept, but can be surprisingly difficult to accomplish. Here\u2019s what you need to do.<\/p>\n\n\n\n
The first step is to create as complete an asset inventory as possible for your enterprise. This should include all of the devices that are continuously accessing your enterprise network, as well as devices that only occasionally connect.<\/p>\n\n\n\n
Additionally, non-computing devices that are connected to the network (Internet of things devices) need to be included as a potential point of entry. Every device in employee workstations, mobile devices that move with the owner, laptops that only occasionally connect, etc, should be counted.<\/p>\n\n\n\n
Almost any enterprise network is going to have at least a few endpoint devices attempt to access the network that are unauthorized to do so. There are a lot of reasons for that to happen, from devices that would normally be authorized, but have had their authorization lapse, to devices that shouldn\u2019t be connected, momentarily are, to breach attempts.<\/p>\n\n\n\n
Even something as simple as a device changing operating systems can lead to an unauthorized asset accessing the system.<\/p>\n\n\n\n
Cataloguing, going through the process to authorize or remove a device, and having a plan for how to handle malware defenses in the case of a bad actor accessing the system, all need to be part of this process.<\/p>\n\n\n\n
Creating a static inventory isn\u2019t going to do a lot of good in a typical enterprise\u2019s network. The list of assets is going to change frequently as devices leave, wear out, get replaced, get upgraded, have a change in service providers, and other differences.<\/p>\n\n\n\n
Utilize an active discovery tool to help keep your inventory up to date by actively looking for new devices and adding them to the list. This isn\u2019t a substitute for inventory maintenance, but it can make it easier to keep your inventory up to date.<\/p>\n\n\n\n
Dynamic host configuration protocols can also be used to update asset inventory. Using DHCP long in protocols or IP address management tools to update inventory when a device logs in, weekly or more often, is another way to keep the inventory up to date.<\/p>\n\n\n\n
In addition to active detection tools you should use a passive asset discovery tool to identify assets already connected to the enterprise network. Passive asset discovery tools should be used at least once a week.<\/p>\n\n\n\n
Using different asset detection and inventory management tools helps prepare you for CIS control 2, software asset management, and is the most basic line of defense of IT assets should an attack surface.<\/p>\n\n\n\n
Yes, because even if every other CIS control is met, your network maintenance is only going to be as effective as it\u2019s coverage. If you have devices and assets missing from your inventory you have no guarantee that your other control efforts protect that equipment.<\/p>\n\n\n\n
There are a number of critical challenges to CIS Control 1 implementation, even in this updated and more streamlined version of the protocol. Some of these challenges are inevitable, and your security team should be aware of common weaknesses and system failures that can lead to problems – even if you have perfect implementation.<\/p>\n\n\n\n
One of the most common challenges to Control 1 is the fact that not all devices can be accounted for in real time. A combination of unagentable assets, pass through devices, and devices that connect between scans, but not during active scanning, can all present inventory challenges.<\/p>\n\n\n\n
The main reason that Control 1 is critical is because you cannot protect assets and devices you don\u2019t know about. You also can\u2019t close potential security breaches that come from an unagentable device or an otherwise uncountable asset.<\/p>\n\n\n\n
There is some amount of control you assert, even over end-user devices and hardware assets simply by keeping track of the known devices that aren\u2019t caught in inventory. Comparing inventory over time is a key aspect of asset management, and can help you catch and monitor network devices that might be missed on individual scans.<\/p>\n\n\n\n
Having incident response protocols in place both to address unauthorized assets, and to respond to cybersecurity threats in real-time can provide an additional layer of protection. Scans for malware and other basic cybersecurity measures can often give insight into the kinds of network devices and access points were used to breach security systems and design a more effective cyber defense plan for the future.<\/p>\n\n\n\n
It\u2019s also important to make sure you\u2019re prioritizing Control 1 as a preventative and management measure, and that you don\u2019t neglect the other CIS controls in pursuit of perfect Control 1 implementation. Continuous vulnerability management involves a lot of different moving parts. Control 1 is the foundation, but it doesn\u2019t do any good in isolation.<\/p>\n\n\n\n
The Center for Internet Security has 18 CIS Critical Security Controls, including inventory and control of software assets, data protection, penetration testing, and access control management to name just a few.<\/p>\n\n\n\n
All 18 of these controls are critical for system security, particularly at the Enterprise level. Cyber defense and the requirements for good cyber hygiene and cyberattack defense are always changing, but getting CIS control certifications is a good way to make sure you\u2019re ahead of the curve and prepared before an attack can cause problems.<\/p>\n","protected":false},"excerpt":{"rendered":"
Today\u2019s world is one filled with cybersecurity threats and more, with new kinds of malware coming out every single day. While the basics of cybersecurity and cyber hygiene are important for everyone, it\u2019s especially important for an enterprise\u2019s network. A single breach into a large network can cause a huge range of problems, including, in […]<\/p>\n","protected":false},"author":77,"featured_media":66610,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[6217],"tags":[],"class_list":["post-66607","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-business-security"],"yoast_head":"\n