How do the CIS controls address secure configurations?

Do not index

Understanding CIS v8 and Secure Configurations

In order to help businesses better defend themselves again the growing threat of cyber attack, The Center for Internet Security (CIS) developed a set of guidelines known as the CIS Controls, which provide a framework for organisations to enhance their cyber security posture. Among these controls, CIS Control 4 specifically addresses the importance of secure configurations for enterprise assets and software. This blog post will explore how CIS v8 tackles secure configurations and why they are critical for maintaining robust security.

What is CIS Control 4?

CIS Control 4 focuses on the Secure Configuration of Enterprise Assets and Software. This control strongly emphasizes the need to establish and maintain secure configurations for various types of assets, including:

End-user devices (e.g. laptops, desktops)

Network devices (e.g. routers, switches)

Non-computing devices (e.g. IoT devices)

Servers and applications

The primary goal of this control is to ensure that these assets are not only deployed securely but are also maintained throughout their lifecycle to mitigate vulnerabilities that could be exploited by attackers.

Key Components of Secure Configuration in CIS v8

1. Establishing a Secure Configuration Process

CIS v8 outlines the necessity of establishing a secure configuration process for all enterprise assets. This involves:

Documenting configurations: Organisations should maintain comprehensive documentation of their configurations, which should be reviewed and updated regularly, or whenever significant changes occur.

Configuration management workflows: Implementing workflows that track configuration changes helps maintain a record that can be reviewed for compliance and leveraged during audits or incident responses.

2. Managing Default Accounts and Passwords

One of the critical aspects of secure configurations is managing default accounts on enterprise assets. Many devices come with pre-configured accounts that may have default passwords, which can pose significant security risks if not addressed. CIS v8 recommends:

Disabling or changing default accounts to prevent unauthorised access.

Regularly reviewing account permissions to ensure they align with the principle of least privilege.

3. Implementing Firewalls and Session Locking

CIS Control 4 also emphasizes the importance of implementing firewalls on both servers and end-user devices. This includes:

Host-based firewalls: Configuring firewalls to allow only whitelisted traffic helps protect against unauthorised access.

Automatic session locking: Configuring devices to lock automatically after a defined period of inactivity reduces the risk of unauthorised access when users step away from their devices.

4. Continuous Management and Updates

Secure configurations are not a one-time effort; they require ongoing management. CIS v8 stresses the need for:

Regular updates to configurations as new vulnerabilities are discovered or as software is patched.

Continuous monitoring to ensure that configurations remain secure over time, adapting to new threats as they arise.

The Role of OneClickComply in Supporting CIS v8 Compliance

For organisations looking to implement CIS Control 4 effectively, leveraging compliance automation tools like OneClickComply can be invaluable. OneClickComply offers features that help organisations:

Automate control configuration, in a single click, ensuring correct and secure implementation at all times.

Maintain secure configurations through continuous monitoring and alerts for any deviations from established security baselines.

Smooth compliance checks by providing comprehensive reports on compliance posture and any changes over time.

Conclusion

CIS v8 provides a robust framework for businesses to secure their enterprise assets through effective configuration management. By following the guidelines outlined in CIS Control 4, businesses can significantly reduce their risk exposure and enhance their overall cyber security posture. Tools like OneClickComply can further streamline this process, making it easier for businesses to maintain compliance and protect their critical assets against evolving threats.

By prioritising secure configurations, organisations not only comply with industry standards but also foster a culture of security that can lead to long-term resilience against cyber threats.