[Day 3] 4. CIS Critical Security Controls (07, 08, 09)

Control 07: Continuous Vulnerability Management

Develop a plan to continuously assess and track vulnerabilities on all enterprise assets within the enterprise’s infrastructure, in order to remediate, and minimise, the window of opportunity for attackers. Monitor public and private industry sources for new threat and vulnerability information.

Safeguards: 7.1 Establish and Maintain a Vulnerability Management Process 7.2 Establish and Maintain a Remediation Process 7.3 Perform Automated Operating System Patch Management 7.4 Perform Automated Application Patch Management 7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets 7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets 7.7 Remediate Detected Vulnerabilities

Control 08: Audit Log Management

Collect, alert, review, and retain audit logs of events that could help detect, understand, or recover from an attack.

Safeguards: 8.1 Establish and Maintain an Audit Log Management Process 8.2 Collect Audit Logs 8.3 Ensure Adequate Audit Log Storage

• Log Rotation Policy is maintained.
• Log rotation is an automated process that manages log file size by archiving or deleting old logs to free up disk space. 8.4 Standardise Time Synchronisation
• Configure at least two synchronised time sources across enterprise assets, where supported. 8.5 Collect Detailed Audit Logs 8.6 Collect DNS Query Audit Logs 8.7 Collect URL Request Audit Logs 8.8 Collect Command-Line Audit Logs
• Collect command-line audit logs.
• Example implementations include collecting audit logs from PowerShell®, BASH™, and remote administrative terminals.
• In Linux, this can be seen using history command. History is stored in .bash_history file. 8.9 Centralise Audit Logs 8.10 Retain Audit Logs
• Retain audit logs across enterprise assets for a minimum of 90 days. 8.11 Conduct Audit Log Reviews 8.12 Collect Service Provider Logs

Control 09: Email and Web Browser Protections

Improve protections and detection of threats from email and web vectors, as these are opportunities for attackers to manipulate human behaviour through direct engagement.

Safeguards: 9.1 Ensure Use of Only Fully Supported Browsers and Email Clients 9.2 Use DNS Filtering Services

• Use DNS filtering services on all enterprise assets to block access to known malicious domains.
• Here DNSBL (DNS Blacklist) is used. It has a list of malicious websites that have a history of sending spam messages or something like that. 9.3 Maintain and Enforce Network-Based URL Filters 9.4 Restrict Unnecessary or Unauthorised Browser and Email Client Extensions 9.5 Implement DMARC
• DMARC, or Domain-based Message Authentication, Reporting, and Conformance, is an email authentication protocol that helps prevent email impersonation.
• A DMARC policy tells receiving mail servers what to do with emails that don't pass SPF or DKIM authentication checks.
• To lower the chance of spoofed or modified emails from valid domains, implement DMARC policy and verification, starting with implementing the Sender Policy Framework (SPF) and the Domain Keys Identified Mail (DKIM) standards. 9.6 Block Unnecessary File Types 9.7 Deploy and Maintain Email Server Anti-Malware Protections