Pages

Categories

Search

 

The 20 Security Controls: Smartly Enhancing Enterprise Security

by
July 26, 2013
CTOvision
No Comment

By

We have written before about SANS and the  virtuous collaborative work they encourage in the community. They work so well with others and have for so long that a community of trust has arose around them. The collegial project that produced the “20 security controls” referenced here includes a wide range of experienced organizations with knowledge of real attacks and insight into what really works in stopping them (for more on the history of these controls and list of participants who maintain them see SANS).  

So, if you are looking to quickly get up to speed on what really works when thwarting attacks, a great source is the community coordinated 20 Critical Security Controls for Effective Cyber Defense. 

Here is more from SANS on what these are:

To secure against cyber attacks, organizations must vigorously defend their networks and systems from a variety of internal and external threats. They must also be prepared to detect and thwart damaging follow-on attack activities inside a network that has already been compromised. Two guiding principles are: “Prevention is ideal but detection is a must” and “Offense informs defense.”

The goal of the Critical Controls is to protect critical assets, infrastructure, and information by strengthening your organization’s defensive posture through continuous, automated protection and monitoring of your sensitive information technology infrastructure to reduce compromises, minimize the need for recovery efforts, and lower associated costs.

And now the full list of the 20 controls, with links to the SANS hosted site explaining each:

20 Critical Security Controls – Version 4.1

  • <a title="
    Inventory of Authorized and Unauthorized Devices
    ” href=”http://www.sans.org/cag/control/1.php”>Critical Control 1: Inventory of Authorized and Unauthorized Devices
  • <a title="
    Inventory of Authorized and Unauthorized Software
    ” href=”http://www.sans.org/cag/control/2.php”>Critical Control 2: Inventory of Authorized and Unauthorized Software
  • <a title="
    Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
    ” href=”http://www.sans.org/cag/control/3.php”>Critical Control 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
  • <a title="
    Continuous Vulnerability Assessment and Remediation
    ” href=”http://www.sans.org/cag/control/4.php”>Critical Control 4: Continuous Vulnerability Assessment and Remediation
  • <a title="
    Malware Defenses
    ” href=”http://www.sans.org/cag/control/5.php”>Critical Control 5: Malware Defenses
  • <a title="
    Application Software Security
    ” href=”http://www.sans.org/cag/control/6.php”>Critical Control 6: Application Software Security
  • <a title="
    Wireless Device Control
    ” href=”http://www.sans.org/cag/control/7.php”>Critical Control 7: Wireless Device Control
  • <a title="
    Data Recovery Capability
    ” href=”http://www.sans.org/cag/control/8.php”>Critical Control 8: Data Recovery Capability
  • <a title="
    Security Skills Assessment and Appropriate Training to Fill Gaps
    ” href=”http://www.sans.org/cag/control/9.php”>Critical Control 9: Security Skills Assessment and Appropriate Training to Fill Gaps
  • <a title="
    Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
    ” href=”http://www.sans.org/cag/control/10.php”>Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
  • <a title="
    Limitation and Control of Network Ports, Protocols, and Services
    ” href=”http://www.sans.org/cag/control/11.php”>Critical Control 11: Limitation and Control of Network Ports, Protocols, and Services
  • <a title="
    Controlled Use of Administrative Privileges
    ” href=”http://www.sans.org/cag/control/12.php”>Critical Control 12: Controlled Use of Administrative Privileges
  • <a title="
    Boundary Defense
    ” href=”http://www.sans.org/cag/control/13.php”>Critical Control 13: Boundary Defense
  • <a title="
    Maintenance, Monitoring, and Analysis of Audit Logs
    ” href=”http://www.sans.org/cag/control/14.php”>Critical Control 14: Maintenance, Monitoring, and Analysis of Audit Logs
  • <a title="
    Controlled Access Based on the Need to Know
    ” href=”http://www.sans.org/cag/control/15.php”>Critical Control 15: Controlled Access Based on the Need to Know
  • <a title="
    Account Monitoring and Control
    ” href=”http://www.sans.org/cag/control/16.php”>Critical Control 16: Account Monitoring and Control
  • <a title="
    Data Loss Prevention
    ” href=”http://www.sans.org/cag/control/17.php”>Critical Control 17: Data Loss Prevention
  • <a title="
    Incident Response and Management
    ” href=”http://www.sans.org/cag/control/18.php”>Critical Control 18: Incident Response and Management
  • <a title="
    Secure Network Engineering
    ” href=”http://www.sans.org/cag/control/19.php”>Critical Control 19: Secure Network Engineering
  • <a title="
    Penetration Tests and Red Team Exercises
    ” href=”http://www.sans.org/cag/control/20.php”>Critical Control 20: Penetration Tests and Red Team Exercises

Via CTO Vision