Downloaded 107 times
Uploaded byBSides Delhi
Effective Cyber Defense Using CIS Critical Security Controls
The document discusses the concept of 'fog of war' and the importance of the CIS Critical Security Controls (CIS CSC) for effective cyber defense. It outlines the top 5 foundational controls, their significance in improving security posture, and emphasizes the need for continuous assessment and automation in security measures. The author, Vikas Singh Yadav, shares his qualifications and experience in information security, presenting a roadmap for implementation and assessment of these controls.
More Related Content
Similar to Effective Cyber Defense Using CIS Critical Security Controls
Effective Cyber Defense Using CIS Critical Security Controls
- 2. Fog of War “Nebeldes Krieges” The unavoidable aspect of war wherein the intelligence gathered is always incomplete to a degree, thereby making any decisions concerning said war a bit... foggy. .
- 3. The Security “Fogof More”
- 6. Simple Achievable Understandable Affordable Real World , FinallyAfter lots of …………. … ( Internet Browsing ) CIS ( SANS ) Critical Security Controls
- 7. EFFECTIVE CYBER DEFENSE USING CISCRITICAL SECURITY CONTROLS Vikas Singh Yadav vikassinghyadav@gmail.com @VikasSYadav 09999402059
- 8. Who am I? • Vikas Singh Yadav • Information Security Professional • M Tech (Comp Science) – IIT Khargapur • Certifications - PMP, CISM, CCSK • Member – ISACA , CCICI, PMI, CISO Platform • Indian Army Officer • Soldier and Leader - OP Vijay , Op Parakram • Information Warrior • Speaker , Writer , Blogger.
- 9. Overview • Are weDoing Enough ? • Why the CIS CSC ? • CIS 20 Controls • Top 5 – Foundational Cyber Hygiene • Benefits • Action points
- 10. Are we notdoing Enough ? Audits Firewall UTM Air Gap DMZ VLAN Policies DLP Compliance Anti Malware IDS / IPS SIEM
- 11.
- 13. Median time todiscover Incidents Source : Fireye MTrends Asia Pacific 2016
- 14. What are CISCritical Security Controls ? “ Technical Controls selected and prioritized by consensus agreement “ “ Prioritized well vetted and supported Security Actions that organizations can take to assess and improve their current security state”
- 16. CIS CSC Bodyof Knowledge 90 page PDF with pictures
- 18. Core Principles orCritical Tenets Automation Are we reducing human effort and error ? Continuous Diagnostics and Mitigation Are the controls still in place and functional ? Metrics Is What we are doing Effective ? Prioritization Are u investing in Controls that provide greatest Risk Reduction? Offense informs Defense Use Knowledge of Actual Attacks
- 19. Exercise What are thetop controls for your organisation ?
- 20. The Top 5Controls CSC 5: Controlled Use of Administrator Privileges CSC 4: Continuous Vulnerability Assessment and Remediation CSC 3: Secure Configurations for Hardware and Software CSC 2: Inventory of Authorized and Unauthorized Software CSC 1: Inventory of Authorized and Unauthorized Devices Prevents/stops 85-90% attacks…
- 21. CIS Critical SecurityControls CSC 10: Data Recovery Capability CSC 9: Limitation and Control of Network Ports, Protocols, and Services CSC 8: Malware Defenses CSC 7: Email and Web Browser Protections CSC 6: Maintenance, Monitoring, and Analysis of Audit Logs
- 22. CIS Critical SecurityControls CSC 15: Wireless Access Control CSC 14: Controlled Access based on the Need to Know CSC 13: Data Protection CSC 12: Boundary Defense CSC 11: Secure Configurations for Network Devices
- 23. CIS Critical SecurityControls CSC 20: Penetration Tests and Red Team Exercises CSC 19: Incident Response and Management CSC 18: Application Software Security CSC 17: Security Skills Assessment and Training CSC 16: Account Monitoring and Control
- 24. CIS CRITICAL SECURITYCONTROLS
- 27. Sub Controls • 198Sub Controls • Each controls has 4 – 8 Sub Controls • Categories • Foundational • Advanced
- 28. CIS CSC 1– Inventory of Devices
- 29. CSC 1 Inventory ofDevices Why? Unpatched Systems, Unchecked Networks, BYOD “‘If you can’t see it, you can’t protect it’ Identify all devices Document the inventory Keep the inventory current
- 30. CSC 2 Inventory ofAuth and UnAuth Software Why? Attackers look for vulnerable software, malware installation, etc. List of Auth software Application whitelisting Software inventory tools Use of VMs and Air Gapped NWs Vikas Singh Yadav 30
- 31. CSC 3 Secure Configfor HW and SW Why? Default configuration designed for use, not security. Security “Decay”. Secure Config for OS and SW Strict Config Mgt File integrity Checkers Config Mgt Tools Vikas Singh Yadav 31
- 32. CSC 4 Continuous VulnerabilityAssess & Remediation Why? Attackers exploit vulnerable systems “Vendors continue to produce security remediations, it does little good if they are not installed by the end user.” Automated Scanning Tools Automated Patch Mgt Monitor event logs Vikas Singh Yadav 32
- 33. CSC 5 Controlled useof Admin Privileges Why? One of the primary means attackers spread through an enterprise. Minimize Admin Privileges Inventory Admin Accounts Change default passwords Use Multi Factor Auth Vikas Singh Yadav 33
- 34. Benefits of CISControls • Risk based • Simple. • Reality based • Dynamic • Affordable
- 35. Additional Benefits Solid Platformto build other standards on Can be used to create a Roadmap A starting point for those who don’t know where to begin
- 36. Getting Started Answer KeyQuestions • What am I trying to protect ? • What are my Gaps ? • What are my priorities ? • Where can I automate ? • How can my vendor partners help ?
- 37. Implementation • Depends onyour Environment • Areas which you are weak • Gap Analysis • Do the Foundational first • Then tackle Advanced
- 38. Action Steps • Readthe CIS CSC version 6.1 • Do a Gap Assessment • Read implementation articles • Make a roadmap for 1 / 3 / 6 / 12 months what you want to accomplish in your organisation.
- 39. Critical Security Controls InitialAssessment Tool
- 40. Starting Off Take inventoryand/or use existing tools or free tools to start. • CSC 1: Nmap, DHCP, 802.1x, Wireshark • CSC 2: Windows SRP, GPOs • CSC 3: CIS Security Benchmarks • CSC 4: OpenVAS, Nmap • CSC 5: Runas, sudo
- 42. Issues and Concerns •Technology Centric • Overlooks Policies and Governance • Is not a replacement for a proper Risk Management Framework.
- 43. Which is themost widely used Information Security framework in India ?
- 44. Are we doingall this ? Simple Basic Intuitive Is it prioritized ?
- 45.
- 46. Vikas Singh Yadav •Information Security professional with specialization in Telecom and Cloud Computing. • 15 years plus experience in field of Information Security, Cyber Audit, Incident Response, Technology Management, Project Management, Training & Development and Personnel Management. • Leadership role in It and Cyber Security for last 6 years. • B Tech (Telecom and IT) , M Tech (Comp Science) – IIT Khargapur • Certifications - PMP, CISM, CCSK • Member – ISACA , CCICI, PMI, CISO Platform • Keen Photographer, Travel Enthusiast and Golfer.
- 47. REFERENCES • The CISCritical Controls for Effective Cyber Defence Version 6.0 - http://www.cisecurity.org/critical-controls. • SANS Critical Controls - http://www.sans.org/critical-security-controls • NIST Cyber Security Framework (CSF) - http://www.nist.gov/cyberframework/ • UK Cyber Essentials Scheme - https://www.cyberstreetwise.com/cyberessentials/ • ISO 27001 - www.iso.org/iso/iso27001 • Open Vulnerability Assessment System (OpenVAS)- http://www.openvas.org • Total Network Inventory - http://www.softinventive.com • CIS Security Benchmark resources - https://benchmarks.cisecurity.org/downloads • NIST SP 800-128 Guide for Security-Focused Configuration Management of Information Systems - http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800- 128.pdf
Editor's Notes
- #3 The state of ignorance in which commanders frequently find themselves as regards the real strength and position, not only of their foes, but also of their friends Cal Von Clauswitz the great German or be more precise Prussian military strategist is believed to have coined the term Fog Of War It describes a state in which military commanders find themselves when they are flooded with Information which is both ambiguous and incomplete thereby making decision making difficult but necessary.
- #4 Similarly in Security today we are confronted with huge amount of information in terms of Polices , procedures , standards and guidelines, Latest technologies – DLP, UTM, SIEM, Anti Malware , multiple compliances – IT Act , ISO 27001, RBI Guidelines , GDPR ,. Add to that Audits and need to adhere to budgets and deadlines and the whole situation can be described by the term Security Fog of More coined by Tony Sager Technology evangelist of Centre of Internet Security the non profit org which presently oversees the development and progress of CIS Critical Security Controls.
- #8 Over the next 15 to 20 mins I will talk of how to achieve Effective Cyber Defense using CIS CSC.
- #11 Now most of time Security professionals tend to be asking the question that are they doing enough - Technology - Audit - Compliance
- #12 The question is are Are we Winning ?
- #14 Statistics speak other wise We can dispute the findings to be hype and biased But there is no denying the fact that breaches and incidents are happening. Examples range from Yahoo internationally to Hitachi ATMs locally Stuxnet by Nation States to Lottery SCAMs by Nigerains
- #16 So the Issue is what can an organization do in this regard. In 2010 I was deep into implementing telecom networks and then computer science research during my M Tech in IIT Kharagpur After getting back to mainstream I was given the task of Driving Infosecurity across our Organisation with 30 locations all over India. I did not have the time to see all these locations , we could not hire consultants and I did not know the state of IT implementations in this departments My best bet would have been Install Anti Virus at the Endpoints , Firewall at the perimeter and Encrypting the Data But I decided to take a while and study the literature of Info Sec and I read a few articles browsed a few books including the Tome 1000 age Shon Harris I needed a framework - ISO 27001 cost money , NIST was too long. Then I stumbled on the Top 20 Security Controls - or the SANS Critcal Security controls as they were called a that point m time
- #17 90 page PDF with number of Diagrams
- #19 Offense informs defense: Use knowledge of actual attacks that have compromised systems to provide the foundation to continually learn from these events to build effective, practical defenses. Include only those controls that can be shown to stop known real-world attacks. Prioritization: Invest first in Controls that will provide the greatest risk reduction and protection against the most dangerous threat actors and that can be feasibly implemented in your computing environment. Metrics: Establish common metrics to provide a shared language for executives, IT specialists, auditors, and security officials to measure the effectiveness of security measures within an organization so that required adjustments can be identified and implemented quickly. Continuous diagnostics and mitigation: Carry out continuous measurement to test and validate the effectiveness of current security measures and to help drive the priority of next steps. Automation: Automate defenses so that organizations can achieve reliable, scalable, and continuous measurements of their adherence to the Controls and related metrics.
- #21 Do we know what is connected to our systems and networks? Do we know what software is running (or trying to run) on our systems and networks? Are we continuously managing our systems using “known good” configurations? Are we continuously looking for and managing “known bad” software? Do we limit and track the people who have the administrative privileges ? Prevents/stops 85-90% attacks…
- #22 Do we know what is connected to our systems and networks? Do we know what software is running (or trying to run) on our systems and networks? Are we continuously managing our systems using “known good” configurations? Are we continuously looking for and managing “known bad” software? Do we limit and track the people who have the administrative privileges ?
- #23 Do we know what is connected to our systems and networks? Do we know what software is running (or trying to run) on our systems and networks? Are we continuously managing our systems using “known good” configurations? Are we continuously looking for and managing “known bad” software? Do we limit and track the people who have the administrative privileges ?
- #24 Do we know what is connected to our systems and networks? Do we know what software is running (or trying to run) on our systems and networks? Are we continuously managing our systems using “known good” configurations? Are we continuously looking for and managing “known bad” software? Do we limit and track the people who have the administrative privileges ?
- #35 These seem to meet my requirement as they were • What are we trying to protect? How much should we spend? • Risk is function of threat (offense), vulnerability (defense), probability, and, consequence • What can be controlled?