[Day 3] 7. CIS Critical Security Controls (16, 17, 18)

Control 16: Application Software Security

Manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect, and remediate security weaknesses before they can impact the enterprise.

Safeguards: 16.1 Establish and Maintain a Secure Application Development Process 16.2 Establish and Maintain a Process to Accept and Address Software Vulnerabilities 16.3 Perform Root Cause Analysis on Security Vulnerabilities 16.4 Establish and Manage an Inventory of Third-Party Software Components 16.5 Use Up-to-Date and Trusted Third-Party Software Components 16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities 16.7 Use Standard Hardening Configuration Templates for Application Infrastructure 16.8 Separate Production and Non-Production Systems 16.9 Train Developers in Application Security Concepts and Secure Coding 16.10 Apply Secure Design Principles in Application Architectures 16.11 Leverage Vetted Modules or Services for Application Security Components 16.12 Implement Code-Level Security Checks 16.13 Conduct Application Penetration Testing 16.14 Conduct Threat Modelling

Control 17: Incident Response Management

Establish a program to develop and maintain an incident response capability (e.g., policies, plans, procedures, defined roles, training, and communications) to prepare, detect, and quickly respond to an attack.

Safeguards: 17.1 Designate Personnel to Manage Incident Handling 17.2 Establish and Maintain Contact Information for Reporting Security Incidents 17.3 Establish and Maintain an Enterprise Process for Reporting Incidents 17.4 Establish and Maintain an Incident Response Process 17.5 Assign Key Roles and Responsibilities 17.6 Define Mechanisms for Communicating During Incident Response 17.7 Conduct Routine Incident Response Exercises 17.8 Conduct Post-Incident Reviews 17.9 Establish and Maintain Security Incident Thresholds

Control 18: Penetration Testing

Test the effectiveness and resiliency of enterprise assets through identifying and exploiting weaknesses in controls (people, processes, and technology), and simulating the objectives and actions of an attacker.

Safeguards: 18.1 Establish and Maintain a Penetration Testing Program 18.2 Perform Periodic External Penetration Tests 18.3 Remediate Penetration Test Findings 18.4 Validate Security Measures 18.5 Perform Periodic Internal Penetration Tests