[Day 3] 5. CIS Critical Security Controls (10, 11, 12)

Control 10: Malware Defences

Prevent or control the installation, spread, and execution of malicious applications, code, or scripts on enterprise assets.

10.1 Deploy and Maintain Anti-Malware Software 10.2 Configure Automatic Anti-Malware Signature Updates 10.3 Disable Autorun and Autoplay for Removable Media 10.4 Configure Automatic Anti-Malware Scanning of Removable Media 10.5 Enable Anti-Exploitation Features 10.6 Centrally Manage Anti-Malware Software 10.7 Use Behaviour-Based Anti-Malware Software

• rather than signature based, use this.

Control 11: Data Recovery

Establish and maintain data recovery practices sufficient to restore in-scope enterprise assets to a pre-incident and trusted state.

Safeguards: 11.1 Establish and Maintain a Data Recovery Process 11.2 Perform Automated Backups 11.3 Protect Recovery Data 11.4 Establish and Maintain an Isolated Instance of Recovery Data 11.5 Test Data Recovery

• To ensure backup tape functionality, periodic checks are essential.
• As tapes can be damaged by magnetic fields, they must be stored in anti-static containers.
• Proper humidity control is crucial to prevent static buildup.

Control 12: Network Infrastructure Management

Establish, implement, and actively manage (track, report, correct) network devices, in order to prevent attackers from exploiting vulnerable network services and access points.

Safeguards: 12.1 Ensure Network Infrastructure is Up-to-Date 12.2 Establish and Maintain a Secure Network Architecture 12.3 Securely Manage Network Infrastructure 12.4 Establish and Maintain Architecture Diagram(s) 12.5 Centralise Network Authentication, Authorisation, and Auditing (AAA) 12.6 Use of Secure Network Management and Communication Protocols 12.7 Ensure Remote Devices Utilise a VPN and are Connecting to an Enterprise’s AAA Infrastructure 12.8 Establish and Maintain Dedicated Computing Resources for All Administrative Work

EXTRA:

What is a logic bomb? Answer: A logic bomb is a malicious code designed to activate and cause harm under specific conditions, such as a certain date or event.