All CIS Critical Security Controls: Explained

CIS (Centre for Internet Security) controls are best practices for securing company networks. These controls are your network's security blueprint, designed to combat the most common cyber threats.

Each of the 18 CIS security controls is like a piece of a bigger puzzle. When you put them all together, they create a strong defense against cyber threats. 

Following these controls is not just a box-ticking exercise; it helps you build a safer, more secure network for your company. It also streamlines regulatory compliance and risk management.

The 18 CIS security controls

Control 1: Inventory and control of enterprise assets

Control 1 entails having a solid grasp of every piece of hardware connected to your company network. This control helps you maintain an up-to-date inventory of all your enterprise assets.

Control 1 helps you flush out rogue devices, which can be a big threat to network security. With Control 1 in place, you'll know immediately if something's out of place. 

For instance, you'll have records of every computer, printer, and IoT device connected to your network. This detailed inventory helps you spot unauthorized devices, just like noticing an unfamiliar car parked in your driveway.

If you know exactly what's on your network, you can manage it better. So, if you have a fleet of laptops, some used by remote employees, you can track each laptop, knowing who has it and where it is. If one gets lost or stolen, you can immediately revoke its access to the network, minimizing risks.

Another thing to think about is software updates. When you have an inventory of all your devices, you can ensure each one gets the latest security patches. 

For example, if you get an alert about a critical update for your network printers, you can quickly determine which ones need the patch. No more guessing and no more missed updates.

This control also helps with asset lifecycle management. If you know exactly when each device was added to the network and its age, you can plan for replacements before something breaks down. 

So, by keeping a detailed inventory and managing all your enterprise assets, you're laying a strong foundation for your company's cybersecurity. You’ll always know what’s in your tech ecosystem, making it easier to protect and control.

Control 2: Inventory and control of software assets

Control 2 switches the focus from hardware to software. It involves keeping track of every software application running on your network. 

So, with this control, you will know every single app installed on your company’s devices, just like you’d keep tabs on all the furniture in your house. This control is crucial for spotting unauthorized or outdated software that could pose security risks.

Imagine discovering an unfamiliar application running on one of your servers. With Control 2 in place, you'd immediately know if it’s something that shouldn’t be there. You'd have a comprehensive list of all the software approved for use within your company. This way, any unapproved "guest" app sticks out like a sore thumb, much like noticing an odd piece of furniture in your living room.

Think about software updates. It’s a nightmare when an outdated application becomes a vulnerability. But with a solid inventory, you can ensure every app is up to date. 

Let’s say a critical vulnerability is found in a popular web browser. With Control 2, you can quickly identify which of your devices are running this browser and push updates accordingly. You do not have to scramble to figure out who’s using what.

Another scenario is licensing. Software licenses can be tricky, especially if you lose track of them. With this control, you maintain a clear record of all licenses, ensuring compliance and avoiding unnecessary costs.

Think also about software lifecycle management. Knowing when each application was installed helps you plan for updates, renewals, or replacements. You'll know in advance when each software is due an update and can plan a smooth transition to a newer version, much like replacing aging equipment before it fails.

Control 3: Data protection

Control 3 zeroes in on protecting your most valuable asset: data. It ensures your company's sensitive information is shielded from unauthorized access and breaches.

Imagine handling customer data, including personal details and payment information. You wouldn't leave those details lying around for anyone to grab, right? 

With Control 3, you encrypt this data, both at rest and in transit. So, even if someone manages to intercept it, they can't make sense of it without the encryption keys.

Access controls are another data protection tool typically employed with Control 3. Not everyone needs access to all data. So Control 3 helps you implement strict access policies, ensuring only authorized personnel can view or modify certain data.

Consider data backups, too. With Control 3, you regularly back up your data to secure locations. Let's say you face a ransomware attack; having a recent backup means you can restore your data without paying the ransom. It's like having a duplicate set of keys stored safely elsewhere in case you lose the original set.

Another Control 3 security measure is data masking, which allows you to create a believable but altered version of your data, keeping sensitive information safe. It's like using a replica of a precious artifact for display while the original stays secured in a vault.

Control 3 also covers data disposal. When you no longer need certain data, you can't just throw it away. You need to ensure it's completely erased, leaving no traces behind. It’s similar to shredding sensitive documents instead of just tossing them in the trash.

Control 4: Secure configuration of enterprise assets and software 

Control 4 emphasizes setting up both your hardware and software securely from the get-go. It ensures that right out of the box, every device and piece of software is configured to be as secure as possible.

Take your company's routers and firewalls as examples. You wouldn't want to use the default factory settings on these devices, right? With Control 4, you make sure to change default passwords and disable unnecessary services. This way, you reduce the risk of unauthorized access.

Think about your servers. A new server often comes with default configurations that aren’t always secure. For instance, file permissions might be set too leniently, or administrative accounts might have weak default passwords. 

Control 4 helps you address these issues right away. You'd set strong, unique passwords and ensure only necessary services are running. It's like setting up a new safe with a robust combination only you know.

Now, let's talk about software. Every new software installation comes with its own set of default settings. Often, these defaults prioritize ease of use over security. By following Control 4, you're making sure these configurations are hardened. 

For example, if you're setting up a new database, you'd ensure that only authorized users have access and that any default sample accounts or data are removed.

Patching is another aspect of secure configuration. If a vulnerability is discovered in an operating system you use, with Control 4 in place, you'd have processes to quickly apply patches and updates. It’s like updating the firmware on your security system to protect against new threats. The faster you apply these fixes, the less chance there is for someone to exploit the vulnerabilities.

Think also about consistency. Control 4 emphasizes standardized configurations across all assets, which ensures that every device adheres to your security policies. 

Control 4 also deals with configuration management. You'd document and maintain records of all configurations, making it easier to spot deviations and quickly rectify them. It’s like keeping a detailed log of every change made to your security system. If something goes wrong, you can quickly trace back and fix the issue.

By focusing on secure configurations from the start, you're proactively hardening your defenses. This control sets the stage for a robust cybersecurity framework, giving you peace of mind. 

Control 5: Account management

Control 5 is about managing user accounts to ensure that only authorized individuals can access enterprise assets and software. This control helps you manage credentials for user accounts, including admin and service accounts.

Why is this important? Well, it's a lot easier for a hacker to use valid login credentials than to break through your defenses with brute force. 

There are many ways someone could gain unauthorized access to user accounts. Weak passwords are one way, but also consider lingering accounts from past employees, dormant test accounts, and shared accounts that haven't been updated for ages.

Administrative accounts are a prime target because they can add new users or tweak settings to create more vulnerabilities. Plus, service accounts often slip through the cracks. Sometimes, they’re only discovered during a routine security audit.

A key security practice for this control is account logging and monitoring. This means keeping track of who is accessing what and when. Think of it like having a security system that logs every time a door opens or closes. This helps you quickly spot any suspicious activity. 

While this control overlaps with CIS Control 8 on Audit Log Management, it's critical for a comprehensive Identity and Access Management (IAM) program.

Let's say you have an employee named Jane. When Jane leaves the company, Control 5 ensures her account is promptly deactivated. This way, she can't access the system after her departure. If this step were missed, Jane's account could become a backdoor for cybercriminals.

Now, consider passwords. Control 5 emphasizes using unique passwords for each account. You wouldn't use the same key for your house, car, and office, right? The same goes for passwords. Each one should be unique to minimize risk.

Dormant accounts are another concern. These are accounts that haven't been used in a while but are still active. It's like having a forgotten spare key hidden somewhere around the house. Disabling these accounts reduces the chance of them being exploited.

Administrator privileges should also be tightly controlled. Only designated admin accounts should have the ability to make significant changes. This prevents regular users from accidentally or maliciously tampering with critical settings.

Service accounts, often used by applications or scripts, need special attention, too. They should be inventoried and regularly reviewed. So knowing exactly where all your spare keys are and who has access to them. It’s about keeping everything organized and secure.

Centralizing account management also falls under Control 5. By managing all accounts from a central location, you streamline the process and improve oversight. It’s like having a central security office that monitors all keys and locks in a building. This ensures consistency and quick response to any issues.

Control 6: Access control management

Control 6 focuses on access control management. It ensures that only the right individuals have access to the systems and data they need to do their jobs.

Assume you have a big house with lots of rooms. You wouldn’t give everyone a master key that opens every door, right? Control 6 works the same way. It encourages assigning access rights based on roles and responsibilities, making sure that each person only has access to the rooms—or in this case, the data and systems—relevant to their role.

Consider your finance team. They need access to financial records but have no business poking around in HR files. With access control, you can set up permissions so that only the finance team can access financial data. It’s like giving them a key that only opens the finance office. 

Now think about your HR department. They need access to employee records but not to financial data. By segmenting access this way, you limit the potential damage if someone’s credentials get compromised.

You could also give temporary access. For example, if a contractor is joining your team for a short project, you wouldn’t need to hand them the master key to the house. Instead, you would give them access only to the rooms they need to complete their work. Control 6 helps you set time-based restrictions, so once their contract ends, their access automatically gets revoked.

Access control also involves using multi-factor authentication (MFA). Picture logging into a safe. First, you use a key, and then you have to input a code. MFA adds an extra layer of security by requiring more than just a password to access systems. 

For instance, after entering a password, the system might send a code to your phone, which you need to input before gaining access. This makes it much harder for unauthorized users to break in.

You can also review access logs to identify possible network breach points. With access control management, you can track and log every access attempt. If someone enters your house, you’d want to know who they are and when they came in, right?

This means you can quickly identify any suspicious activity. Let’s say you notice a login attempt from an unusual location. You can investigate immediately, much like checking the security footage when you notice something amiss.

You can also conduct periodic reviews. Just as you would regularly check who has keys to your house, you should routinely review access permissions. 

Maybe Steven from accounting no longer needs access to certain financial software. With Control 6, you’ll conduct regular audits to ensure that permissions are up-to-date and aligned with current roles. This helps prevent privilege creep, where employees accumulate more access rights than they need over time.

If you have an emergency, you will have to revoke access instantly. Control 6 centralizes control, allowing you to quickly disable access for any user. It works like an emergency override switch that can lock down the house immediately.

Control 7: Continuous vulnerability management

Control 7 encompasses the security steps you take to stay ahead of potential weaknesses in your network. It recommends continuously scanning for vulnerabilities and addressing them promptly.

Control 7 demands that you regularly scan your systems for vulnerabilities so you can patch them up immediately. For instance, you might use vulnerability scanning tools that run automated checks across your network. These scans highlight weak points, much like a home inspection would point out areas that need repair.

Now, consider your company's software. Software vulnerabilities are like those cracks and leaks. You need to know when something's amiss. 

Let's say a new vulnerability is discovered in a popular operating system. Your continuous vulnerability management would alert you to this issue quickly. You'd then apply the necessary patches or updates to fix the problem. Think of it like getting an alert about a storm coming and reinforcing your windows before it hits.

Another part of this control is maintaining an up-to-date inventory of all software and hardware. Knowing what you have makes it easier to spot where vulnerabilities might exist. It helps you manage and patch vulnerabilities efficiently.

Patch management is crucial here. When a software vendor releases a patch for a known vulnerability, you need to act fast. Picture getting a recall notice for your car because of a safety issue. You’d address it immediately to avoid risks. 

In the same vein, patching known vulnerabilities as soon as updates are available is essential. This proactive approach minimizes the risk of exploitation.

Regularly scheduled scans are part of this control, too. These regular scans help you catch new vulnerabilities that might have cropped up since the last check. For example, new vulnerabilities can appear when you install new software or devices. Regular scans ensure nothing slips through the cracks.

Control 7 also emphasizes prioritizing vulnerabilities. Not all cracks in your house need immediate attention, but a damaged roof does. The same goes for your network. Some vulnerabilities are more critical than others. 

By prioritizing the most severe ones, you focus your efforts where they matter most. Imagine a critical vulnerability in an application that manages sensitive customer data. That would definitely be a high priority fix.

Finally, think about reporting and documentation. After fixing a vulnerability, you’d document what was done. This is like keeping a maintenance log for your house. It helps track what issues have been addressed and serves as a reference for future inspections. In your network, this documentation can be invaluable for audits and compliance.

Control 8: Audit log management

Control 8 advises keeping a detailed record of what’s happening in your network. It implores you to ensure that logs are created, maintained, and monitored to identify and respond to suspicious activities.

Think about logging into your computer. Every login attempt, whether successful or not, must be recorded. This is like having an entry log at the front door of your house that records every person who enters and leaves. 

With Control 8, you'd maintain these logs systematically, capturing every login, logout, and failed attempt. This lets you quickly spot any unauthorized access attempts.

For your network, if someone tries to breach your firewall, an audit log would capture this attempt. You'd see where the attack came from and which systems were targeted. That allows you to take steps to strengthen your defenses.

Factor your applications here, too. Every action within an app, like user updates, data modifications, or configuration changes, should be logged. For example, if an admin changes a user’s permissions, this action gets logged. If anything goes wrong later, you can trace back to see who made the change and when.

Audit logs also play a crucial role in compliance. Various regulations require maintaining detailed logs of user activities and system events. Some data security and privacy laws, like GDPR, require you to show proof of who accessed sensitive information. With well-maintained audit logs, you can provide this information easily. 

Another key component of Control 8 is log storage and protection. Logs are valuable and need to be stored securely, much like you'd safeguard important documents in a fireproof safe. You can’t afford to lose them or have them tampered with. 

To prevent intruders from altering your security footage, you’d store logs securely and implement measures to prevent unauthorized access. Storing logs in a centralized log management system helps keep them safe and accessible.

Regularly monitoring these logs is also essential. It’s not enough to just collect logs; you need to review them. Think of it as regularly checking your security camera footage. Automated tools can help by flagging unusual patterns. 

For instance, if there’s an unusual spike in login attempts from a foreign IP address, an alert would notify you. You can then investigate promptly, much like checking your camera feeds when you hear a suspicious noise.

Retention policies also matter with control. You want to keep logs long enough to be useful but not indefinitely. For example, you want to know how long to keep your security footage before it’s overwritten. 

Your policy might dictate keeping logs for a year, ensuring you have historical data if needed. For example, if a breach is discovered months after it happened, you’ll have the logs to trace back and understand what went wrong.

Finally, think about log integrity. Logs must be accurate and unaltered. Imagine fake security footage; it would be useless. Similarly, ensuring logs are tamper-proof is critical. Implementing cryptographic techniques to validate logs helps maintain their integrity. If anyone tries to alter a log, you would know right away.

Control 9: Email and web browser protections

Control 9 focuses on securing two of the most common entry points for cyber threats: email and web browsers. Think of it as fortifying the front doors to your digital house. Implementing these protections significantly reduces the risk of malware, phishing attacks, and other online threats.

With email protections in place, you will have tools that automatically flag suspicious emails. For instance, you might use email filtering solutions that scan for known phishing patterns and malware attachments. 

Consider how often you and your team browse the web. Each click on a link or download could potentially open the door for malware. With Control 9, you'd have browser protections like pop-up blockers, anti-phishing extensions, and malware scanners. These act as digital shields that block harmful content before it reaches your system. 

For example, if you accidentally click on a malicious link, your browser extension would stop the page from loading, much like a security gate blocking an intruder’s entry.

Email attachments can also be a major risk if not properly handled. Implementing attachment scanning ensures that any file coming through email is vetted for malware. If a suspicious file is detected, the attachment is quarantined, preventing any harm to your network.

Browser configurations also play a big role. You should configure browsers to minimize exposure to threats. Disabling unnecessary plugins and configuring security settings to their highest levels helps create a safer browsing environment. For example, disabling Flash and JavaScript for untrusted sites can drastically reduce the risk of drive-by downloads.

Think about your email attachments and downloads, too. With sandboxing techniques, you can open potentially risky files in a controlled environment. Sandboxing isolates the file, letting you see if it's harmful without affecting your main system.

Your email policy should also include strong authentication measures. Multi-factor authentication (MFA) adds an extra layer of security. If someone tries to access your email account, they’d need more than just your password.

Regular training is essential. You should train your staff to recognize phishing attempts and suspicious links. They should know to hover over links to see the actual URL before clicking and to report any odd emails to your IT team.

Don’t forget about browser updates. Just as you would regularly update your home security system, keeping browsers up-to-date is crucial. Updates often patch vulnerabilities that cybercriminals exploit. 

For example, if a new security flaw in your web browser is discovered, updating it promptly ensures you’re protected against potential attacks.

Control 10: Malware defenses

Control 10 focuses on keeping malware out of your network. It ensures that you're equipped to stop malicious software in its tracks before it can wreak havoc.

One of the tools it recommends is antivirus software. Control 10 ensures that every device in your network has up-to-date antivirus programs. So, if an employee plugs in an infected USB drive, the antivirus would immediately flag and quarantine the malware.

Think about email attachments again. They often carry hidden threats. With malware defenses, you add an extra layer of scanning. It's like having a security scanner that checks every package delivered to your house. So, if someone sends a malicious file through email, your defenses will catch it before it reaches the recipient's inbox.

Web browsing is another potential risk area. You might accidentally land on a compromised site. With real-time web protection, your browser extensions can block harmful websites and downloads. Suppose you click on a shady link—your defenses would stop the page from loading, keeping malware at bay.

Application whitelisting is another tactic. You only allow approved applications to run on your network. It's like having a guest list for your house; only recognized faces get through the door. 

For instance, if an unauthorized application tries to run, it’s automatically blocked unless you approve it. This drastically lowers the risk of rogue software causing problems.

Behavioral analysis tools also come into play. If, for example, a program starts acting suspiciously—like encrypting large batches of files—your defenses will pick this up and shut it down, similar to how a smart alarm system might detect unusual activity and alert you immediately.

Think about regular updates, too. Your malware defenses need to be current to catch the latest threats. It's like updating the firmware on your home security system to counter new types of break-ins. 

Whenever a new malware strain appears, your defenses should adapt quickly. For example, enabling automatic updates ensures that your antivirus software is always ready to tackle new threats.

Training your team is just as important. Everyone should know the basics of spotting malware. Teach your employees about the dangers of downloading unknown software, clicking on suspicious links, or opening unexpected email attachments. A well-informed team acts as an additional layer of defense.

Consider isolated environments for testing suspicious files. Using virtual machines or sandboxing, you can examine potentially harmful files without risking your main network. This is like having a controlled room where you can safely inspect suspicious packages. If the file is clean, you release it; if not, you neutralize it without any risk to your primary systems.

Control 11: Data recovery

Control 11 focuses on ensuring you can recover your data if things go sideways. Imagine your house catches fire—having a fireproof safe with important documents inside would be a lifesaver. Similarly, this control ensures that you can recover lost data through comprehensive backup and recovery strategies.

Think about your company's critical information, like financial records or customer databases. You wouldn't just leave those unprotected. 

With Control 11, you'd regularly back up this data to secure locations. So, if your system gets hit by ransomware, having a recent backup means you can restore your data without paying the ransom. It's like having a digital duplicate of your documents stored safely elsewhere.

Consider automated backup solutions. Manual backups can be cumbersome and prone to errors. Automated solutions, on the other hand, ensure backups happen on schedule. 

For example, you might set your system to back up critical data daily at 2 AM. This way, you always have an up-to-date copy ready for emergencies.

Now, think about where you store these backups. Keeping them on the same network as your primary data isn't the best idea. It’s like storing your fireproof safe in a room that’s most likely to catch fire. 

By storing your backups offsite or in your local servers, you ensure that your backups are safe even if your main site is compromised. For example, cloud solutions like AWS or Google Cloud offer secure storage options that are geographically redundant.

Don't overlook the importance of testing your backups. Regularly test restoring your backups to ensure everything works smoothly. For instance, once a quarter, you could restore a random sample of your data to verify that your backup process is reliable.

Encryption is also key when it comes to backups. Your backed-up data needs to be just as secure as your live data. Think of it like storing sensitive files in a locked box before placing them in the fireproof safe. 

By encrypting your backups, you ensure that even if someone gets their hands on your backup data, they can't read it without the encryption keys. For example, using tools like BitLocker or VeraCrypt can help encrypt your backup data effectively.

Versioning is another useful feature. Imagine saving different editions of a document over time. If you make a mistake, you can revert to an earlier version. Backup systems with versioning capabilities work the same way, allowing you to restore data from various points in time. For instance, if a document gets corrupted, you can recover an uncorrupted version from a few days earlier.

Think about role-based access control for your backups. Not everyone should have access to your backup files. Restrict access to your backup data to authorized personnel only. This minimizes the risk of accidental deletion or tampering. For example, setting up strict access controls ensures only your IT team can handle backups.

Another point to consider is the backup schedule. Different types of data may require different backup frequencies. Critical data might need daily backups, whereas less crucial data can be backed up weekly or even monthly. 

Tailoring your backup schedule to the importance of the data ensures you're not wasting resources while keeping crucial information secure.

Control 12: Network infrastructure management

Control 12 is all about keeping your network infrastructure in top shape. It is akin to maintaining the plumbing and wiring in your house. You want everything to run smoothly and securely, minimizing the chance of leaks or short circuits. 

This control ensures that your network devices, such as routers, switches, and firewalls, are configured, maintained, and monitored effectively.

Control 12 ensures that every network device is properly documented and configured. Picture labeling each wire and knowing exactly where it leads. For example, documenting the configurations of all your routers helps you quickly identify and rectify any issues.

Network segmentation is a big part of this. It divides your network into smaller zones, which allows you to limit the spread of potential threats. Suppose you have a guest network for visitors. Segmentation ensures that if a visitor's device is compromised, it doesn't affect your main business network.

You must also regularly update your network devices. Routers and switches, just like any other device, need firmware updates. So with Control 13, you’d schedule regular updates for all network hardware. 

For example, if a vulnerability is discovered in your firewall’s firmware, timely updates will patch that hole, keeping your defenses strong.

Monitoring is another essential component in this control. Network monitoring tools can alert you to unusual activities. If a switch starts acting up or a rogue device tries to access your network, you’ll know right away. For instance, tools like SolarWinds or PRTG can notify you of abnormal traffic patterns, allowing you to take immediate action.

Access controls extend to network devices too. Not everyone should have the ability to log into your routers and switches. Restricting administrative access to network infrastructure means you minimize the risk of unauthorized changes. 

Suppose an IT admin leaves the company; you’d immediately revoke their access to the network devices, much like taking back their house keys.

Redundancy is crucial for resilience. You should have redundant network paths and devices. If a switch fails, redundancy ensures traffic is rerouted seamlessly. 

For example, implementing high-availability configurations for your firewalls means there’s always a backup ready to take over if one goes down.

Periodic audits are akin to regular house inspections. You should routinely review your network configurations to ensure everything aligns with security policies. It’s like checking all the locks and alarms in your house every few months. 

Conducting network audits helps spot any misconfigurations or outdated setups that could pose security risks. For instance, an audit might reveal a firewall rule that’s too permissive, which you can then tighten up.

Think about secure configurations from the start. When you install new network devices, they come with default settings that aren’t always secure. It’s like moving into a new house and immediately changing the default locks. 

Configuring devices securely from the outset closes potential entry points for attackers. For example, changing default passwords and disabling unnecessary services on new routers helps prevent unauthorized access.

Lastly, consider logging and documentation. Keeping detailed records of network configurations, changes, and incidents is crucial. This makes it easier to troubleshoot issues and provides a clear history of network management activities. So, if something goes wrong, you can trace back through the logs to understand what changed and when.

Control 13: Security awareness and skills training

Control 13 emphasizes the importance of educating your team about cybersecurity. It teaches everyone in your household how to lock the doors and set the alarm. This ensures that all employees are aware of security best practices and have the skills to protect the company's network.

With Control 13 entails providing regular training sessions to keep everyone up to speed. This could mean conducting monthly workshops where you discuss the latest phishing scams. You might show emails that look legitimate but have subtle red flags, which helps employees recognize and avoid falling for phishing traps.

Think about password security. Everyone knows they should use strong passwords, but not everyone does. By training your team, you can emphasize the importance of using unique, complex passwords for each account. You could show them how password managers work and why they’re useful.

Consider the risks of public Wi-Fi. Many employees work remotely these days, often from cafes or other public places. During training, you would explain the dangers of unsecured networks. 

You could instruct them never to access sensitive company data over public Wi-Fi unless they're using a VPN. You could show them how to set up and use a VPN on their devices.

Social engineering attacks are another threat that Control 13 aims to address. Hackers can manipulate people into giving away confidential information. 

Training can include role-playing exercises where employees practice handling suspicious requests. Employees should know to verify the request through official channels before giving any information.

Phishing tests can be very effective. For example, you could send out fake phishing emails to see how many employees take the bait. Afterward, you can review the results together, discussing what was missed and how to do better next time. It’s like a fire drill but for email security.

Think about software updates and patches. Employees should know these are critical for security. During training, explain that ignoring update notifications is like ignoring a recall notice for a car. You might set up automatic updates but also educate them on why it’s important to apply patches promptly.

Consider the physical security of devices. An unattended laptop can be a goldmine for a thief. In training, you’d emphasize the importance of locking screens when stepping away. Reminder employees to treat their work devices like a wallet—they should never leave them unprotected in public spaces.

Because cyber threats evolve, regularly update the training materials. Your training should also evolve. Regularly review and refresh your training programs to cover the latest threats and best practices. For instance, if a new type of ransomware emerges, make sure your team knows how to recognize and avoid it.

Encourage a culture of security awareness. Everyone should know they play a part in protecting the company. Employees must report anything unusual, no matter how minor it seems. For example, if someone notices a strange email, they should report it to IT immediately.

Control 14: Service provider management

Control 14 entails keeping a close watch on your service providers. Think of it as vetting the contractors and service people who work on your house. This control ensures that any external partners or vendors you work with follow stringent security measures, protecting your company’s data and systems.

You wouldn’t hire a plumber to fix a leak without checking their credentials. The same goes for service providers. Control 14 emphasizes thoroughly vetting each vendor before engaging them. 

For example, you would review their security policies, perform background checks, and ensure they comply with industry standards like GDPR or HIPAA. This helps ensure they won’t introduce new vulnerabilities into your network.

Consider the access you grant to service providers. You should limit the access service providers have to your systems. If a vendor needs to manage your email system, you grant them access only to that specific area. This is the principle of least privilege that reduces the risk of a broader security breach if their credentials are compromised.

And just because a service provider passed the initial vetting doesn’t mean they’re always in the clear. You must conduct periodic reviews to ensure they meet your security standards.

For example, if you find that a provider’s security measures have slipped, you either work with them to improve or consider switching to a more reliable option.

Service level agreements (SLAs) are crucial. These are the contracts that outline what you expect from your service providers regarding security and performance. Your SLAs can include clauses that hold the providers accountable for maintaining specific security measures.

Another key aspect is incident response. If something goes wrong, you need to know how quickly and effectively the service provider will respond. Your service providers must have robust incident response plans that you should regularly review.

You can even conduct joint drills with service providers to ensure everyone knows their role. For instance, if a provider detects suspicious activity, they should notify you immediately and follow a predefined protocol to contain the threat.

Encryption is non-negotiable. Any data shared with service providers must be encrypted. Think of it like handing over a valuable item in a locked box. This ensures that even if the provider’s defenses are breached, your data remains secure.

Transparency is vital. You must require that your service providers be open about their security practices and any incidents that occur. Regular updates and transparency help maintain trust. 

Suppose a provider experiences a minor security event that doesn’t directly affect you; they should still inform you and outline the steps they’re taking to prevent future issues.

Training also extends to service providers. You must encourage them to conduct regular security training for their employees. For instance, you may require your contractor to be up-to-date with the latest safety practices before working on your house.

Control 15: Application software security

Control 15 zeroes in on ensuring your software applications are secure from the get-go. This control focuses on integrating security into every phase of the software development lifecycle (SDLC), from design to deployment. It is like building a house with sturdy materials right from the foundation. 

When starting a new software project, before writing a single line of code, you conduct a thorough threat modeling exercise. In other words, you outline all potential risks and weak points, much like assessing your house plans for vulnerabilities before construction begins. 

For example, you identify areas where sensitive data might be exposed and plan to secure these touchpoints right from the design phase.

Another key exercise here following secure coding practices. Just as you wouldn't use substandard materials to build your house, you shouldn’t cut corners with your code. By following secure coding guidelines, you ensure that your applications are resilient against common attacks like SQL injection and cross-site scripting (XSS).

Code reviews are a related critical step. Much like having a building inspector check your progress, peer reviews help to catch security flaws early. For example, a peer review might reveal a piece of code that handles passwords insecurely. With insight from the peer review, you can catch the vulnerability and fix it before it poses a risk.

You should also consider using automated security testing tools. These act like regular safety checks on your network and business systems. For example, you may integrate static application security testing (SAST) and dynamic application security testing (DAST) into your development pipeline. 

SAST scans your code for vulnerabilities before it's even compiled, while DAST tests the running application for security flaws.

Be careful how you use third-party libraries and frameworks. Using them is like incorporating pre-fabricated parts into your house. They save time but can introduce vulnerabilities if not properly vetted. 

You scrutinize each third-party component for known vulnerabilities and maintain an up-to-date inventory. Tools like Dependabot help to keep your dependencies secure and updated.

Monitoring isn’t an afterthought. Once an application is live, you must continuously monitor it for suspicious activities. Tools like Security Information and Event Management (SIEM) help to keep tabs on your applications. 

If your SIEM tool detects an anomaly, you investigate promptly. For example, it will send you an alert if someone tries to break into your applications.

When vulnerabilities are discovered, timely patches are critical. For instance, if a critical vulnerability is found in your web application, you must apply patches without delay to minimize exposure.

Control 16: Incident response management

Control 16 ensures you are always ready to handle any cybersecurity incident quickly and effectively. This control is your escape plan for digital emergencies. It makes sure you have a structured approach to detect, respond to, and recover from security incidents.

First, you set up an incident response team. This team includes IT staff, security experts, and communication personnel. For example, if a malware attack is detected, your incident response team jumps into action to contain the threat.

Then you establish clear incident response policies, which are detailed instructions for what to do if there's a fire or a break-in. These policies outline how to identify an incident, whom to notify, and what steps to take. 

For instance, if an employee discovers a phishing email, the policy guides them on how to report it and instructs the incident response team on how to investigate and respond.

Regular training and simulations are critical. They help prepare you for different types of cyber incidents. For example, you might simulate a data breach to test your response procedures and identify any gaps in your plan.

Once an incident is detected, you follow a structured process - a step-by-step guide for handling emergencies. You start with identification: determining if an incident has occurred. Suppose your monitoring tools flag unusual network traffic—this is where your incident response team starts investigating.

Containment comes next. Just like you’d isolate a fire to prevent it from spreading, you contain the incident to limit its impact. If malware is spreading through your network, you might isolate affected systems to stop the infection. For example, you could disconnect compromised devices from the network to prevent further damage.

Eradication follows containment. This step is about removing the root cause of the incident. If you are dealing with malware, you would remove it from all affected systems and ensure no remnants are left behind. For instance, you would use antivirus tools to clean infected machines thoroughly.

Then, you move to recovery where you repair the damage after putting out a fire. You restore affected systems and verify they’re back to normal operation. For example, if a server was compromised, you would rebuild it from clean backups and test to ensure it’s functioning correctly and securely.

Finally, you conduct a post-incident review. Think of this as analyzing what went wrong in a fire drill and how you can improve. You document the incident, assess your response, and identify lessons learned. 

For instance, if you find that a delay in detection worsened the impact, you might invest in better monitoring tools or improve your alert protocols.

Communication is vital throughout this process. You need to keep everyone informed, just like you’d update family members during a home emergency. You must have predefined communication channels to notify stakeholders, employees, and, if necessary, customers. 

For example, if there’s a data breach, you would inform affected customers about what happened, what steps you are taking, and how they can protect themselves.

Control 17: Penetration testing

Control 17 advises taking a proactive approach to find weaknesses before attackers do. This may mean hiring an ethical hacker to attempt to break into your network to identify vulnerabilities. 

This control ensures you regularly conduct penetration tests to uncover and fix security gaps. Penetration testing starts with planning. Think of creating a blueprint for the tests. You define the scope, identifying which systems and networks will be tested. 

For example, you might decide to test your customer-facing web applications and internal databases. This helps you focus your efforts and resources on the most critical areas.

Next, you move to the reconnaissance phase. Your testers gather as much information as possible about the target systems. They look for publicly available information, like domain names, IP addresses, and employee email addresses. This phase helps them understand the landscape and identify potential entry points. For instance, they might find an outdated software version with known vulnerabilities.

With the information gathered, your testers move to the actual attack phase. They use various techniques, including automated tools and manual methods, to exploit vulnerabilities. For example, they might try to gain unauthorized access by exploiting weak passwords or security misconfigurations.

If they gain access, the testers attempt to escalate privileges. They look for ways to move from a regular user account to an administrative one. For instance, they might exploit a flaw in the system to gain higher-level access. This helps you understand the potential impact of an exploit.

Throughout the test, documentation is crucial. You must keep a detailed log of every attempted break-in method and its outcome. The testers document each step, noting which vulnerabilities were found and exploited. 

They might record that a SQL injection flaw allowed them to access the database. This information is invaluable for understanding the weaknesses and planning remediation.

Once the attack phase is complete, you must analyze. Think of it as reviewing the break-in attempts and assessing the damage. The testers compile a detailed report, outlining the vulnerabilities found, how they were exploited, and the potential impact. They might highlight that an outdated plugin in your web application allowed unauthorized access to sensitive data.

Then comes remediation. You take the findings from the penetration test and address the vulnerabilities. This might involve applying security patches, updating configurations, or improving our security policies. If weak passwords were exploited, you might implement stricter password requirements and multi-factor authentication.

After remediation, you must conduct a retest. The testers attempt to exploit the previously identified vulnerabilities again. This helps you ensure that the changes made have effectively closed the security gaps. For instance, they might verify that the SQL injection flaw has been patched and can no longer be exploited.

Control 18: Security awareness and skills training

Control 18 emphasizes the importance of educating your team about cybersecurity. It ensures that all employees are aware of security best practices and have the skills to protect the company's network.

Control 18 legislates for regular training sessions to keep everyone up to speed. For example, you may conduct monthly workshops where you discuss the latest phishing scams. You might show emails that look legitimate but have subtle red flags. This helps employees recognize and avoid these traps.

You should also include training on password security where you emphasize the importance of using unique, complex passwords for each account, among other password best practices. You could also show them how password managers work and why they’re useful.

Encourage a culture of security awareness. Everyone should know they play a part in protecting the company. Implore employees to report anything unusual, no matter how minor it seems. For example, if someone notices a strange email, they should report it to IT immediately.

By emphasizing security awareness and skills training, you empower your team to be the first line of defense against cyber threats. This control helps create a culture where security is everyone’s responsibility, making your network safer and more secure.

‍