[Day 3] 3. CIS Critical Security Controls (04, 05, 06,)

Control 04: Secure Configuration of Enterprise Assets and Software

Establish and maintain the secure configuration of enterprise assets (end-user devices, including portable and mobile; network devices; non-computing/IoT devices; and servers) and software (operating systems and applications).

Safeguards: 4.1 Establish and Maintain a Secure Configuration Process 4.2 Establish and Maintain a Secure Configuration Process for Network Infrastructure 4.3 Configure Automatic Session Locking on Enterprise Assets

• Due to risk of session hijacking, this is implemented, sometimes locking or timeouts are used. 4.4 Implement and Manage a Firewall on Servers 4.5 Implement and Manage a Firewall on End-User Devices

• If any machine is using a third party software then implementing a firewall comes in handy. 4.6 Securely Manage Enterprise Assets and Software 4.7 Manage Default Accounts on Enterprise Assets and Software
• Either disable them or change their passwords, the default account ones, such as root, administrator or other pre-configured vendor accounts. 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software 4.9 Configure Trusted DNS Servers on Enterprise Assets
• fake DNS can be configured to fool the clients, which is called as DNS spoofing or DNS cache poisoning. This redirects the user to a malicious website which has a similar URL to the website the user is trying to access.
• So, the machines are configured so that they will connect only to the trusted DNS and not any other. 4.10 Enforce Automatic Device Lockout on Portable End-User Devices
• devices given by the companies should lockout after certain time of inactivity. 4.11 Enforce Remote Wipe Capability on Portable End-User Devices
• devices should have this feature in case the device is stolen to make sure that the confidentiality of the information is maintained. 4.12 Separate Enterprise Work spaces on Mobile End-User Devices

---

Control 05: Account Management

As an administrator, you are supposed to create accounts and configure them with security. Use processes and tools to assign and manage authorisation to credentials for user accounts, including administrator accounts, as well as service accounts, to enterprise assets and software.

Safeguards: 5.1 Establish and Maintain an Inventory of Accounts

• As an administrator, you should have inventory of all the accounts, but in large organisation there are thousands of accounts and it becomes tough to manage them since over the period of time people leave the company and new people join. 5.2 Use Unique Passwords
• strong password policy and unique passwords.
• As an administrator you will be managing a lot of devices which must have unique passwords.
• If you have same password for all the devices then if your device is hacked then all other devices are also compromised.
• Using a Two-Factor-Authentication or Multi-Factor Authentication (MFA) is recommended
• 16 character passwords 5.3 Disable Dormant Accounts
• Either delete or disable the accounts which haven't be used for more than 45 days.(or any other limit if specified) 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts
• Only those who require administrator privileges should be given them and not others. 5.5 Establish and Maintain an Inventory of Service Accounts
• Service account privileges are to be maintained properly. 5.6 Centralise Account Management
• We use Active Directory for the same in Windows.

Extra: Application Accounts, Service Accounts and User Accounts? What are these?

---

Control 06: Access Control Management

Use processes and tools to create, assign, manage, and revoke access credentials and privileges for user, administrator, and service accounts for enterprise assets and software.

Safeguards: 6.1 Establish an Access Granting Process

• Establish and follow a process, preferably automated, for granting access to enterprise assets upon new hire, rights grant, or role change of a user. 6.2 Establish an Access Revoking Process
• Establish and follow a process, preferably automated, for revoking access to enterprise assets, through disabling accounts immediately upon termination, rights revocation, or role change of a user.
• Disabling accounts, instead of deleting accounts, may be necessary to preserve audit trails. 6.3 Require MFA for Externally-Exposed Applications 6.4 Require MFA for Remote Network Access 6.5 Require MFA for Administrative Access
• Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a third-party provider. 6.6 Establish and Maintain an Inventory of Authentication and Authorisation Systems 6.7 Centralise Access Control 6.8 Define and Maintain Role-Based Access Control

---

EXTRA:

Application Accounts: These are accounts created for specific applications to access system resources or other applications. They are used to automate tasks or run services without direct human intervention.

Service Accounts: Similar to application accounts, service accounts are used to run system services. However, they often have more privileges than application accounts and are used for critical system functions.

User Accounts: These are accounts created for individual users to access and use a system. They typically have limited privileges and are used for day-to-day tasks.

---