[Day 3] 6. CIS Critical Security Controls (13, 14, 15)

Control 13: Network Monitoring and Defence

Operate processes and tooling to establish and maintain comprehensive network monitoring and defence against security threats across the enterprise’s network infrastructure and user base.

Safeguards: 13.1 Centralise Security Event Alerting 13.2 Deploy a Host-Based Intrusion Detection Solution 13.3 Deploy a Network Intrusion Detection Solution 13.4 Perform Traffic Filtering Between Network Segments 13.5 Manage Access Control for Remote Assets 13.6 Collect Network Traffic Flow Logs 13.7 Deploy a Host-Based Intrusion Prevention Solution 13.8 Deploy a Network Intrusion Prevention Solution 13.9 Deploy Port-Level Access Control 13.10 Perform Application Layer Filtering

• Example -using Squid Proxy 13.11 Tune Security Event Alerting Thresholds

Control 14: Security Awareness and Skills Training

Establish and maintain a security awareness program to influence behaviour among the workforce to be security conscious and properly skilled to reduce cybersecurity risks to the enterprise.

Safeguards: 14.1 Establish and Maintain a Security Awareness Program 14.2 Train Workforce Members to Recognise Social Engineering Attacks 14.3 Train Workforce Members on Authentication Best Practices 14.4 Train Workforce on Data Handling Best Practices 14.5 Train Workforce Members on Causes of Unintentional Data Exposure 14.6 Train Workforce Members on Recognising and Reporting Security Incidents 14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates 14.8 Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks 14.9 Conduct Role-Specific Security Awareness and Skills Training

Control 15: Service Provider Management

Develop a process to evaluate service providers who hold sensitive data, or are responsible for an enterprise’s critical IT platforms or processes, to ensure these providers are protecting those platforms and data appropriately.

Safeguards: 15.1 Establish and Maintain an Inventory of Service Providers 15.2 Establish and Maintain a Service Provider Management Policy 15.3 Classify Service Providers

• take more precautions for the critical service providers 15.4 Ensure Service Provider Contracts Include Security Requirements 15.5 Assess Service Providers 15.6 Monitor Service Providers 15.7 Securely Decommission Service Providers