CIS Controls 7.1：全球认可的网络安全最佳实践指南

需积分: 12 146 浏览量更新于2024-07-15 收藏 2.95MB PDF 举报

CIS Controls™ 是一套由IT专家共同制定并被全球广泛接受的信息安全最佳实践，旨在提供一个防御深度优先的安全框架，抵御针对系统和网络的常见攻击。这套控制措施基于实际的网络安全防御经验，其开发者来自零售、制造业、医疗保健、教育、政府、国防等多个行业，反映了多元化的实践背景和知识融合。 CIS Controls Version 7.1 是一个更新版本，发布于2019年4月1日，它遵循Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International Public License，这意味着用户可以在组织内部和外部，非商业用途的前提下复制和分发这些内容，但必须确保对CIS表示适当信用，并提供链接至许可证。对于修改、转化或在此基础上构建的内容，不得进行商业分发，且在引用CIS Controls时，用户需指向<http://www.cisecurity.org/controls/>，以获取最新的指导建议。中心对于商业使用CIS Controls有明确的规定，任何商业目的的使用需要获得CIS®（Center for Internet Security, Inc.®）的预先批准。这份文档的发布还包含了CIS®的致谢部分，感谢那些在控制措施开发过程中做出贡献的专家和机构。 CIS Controls Version 7.1的核心内容包括一系列优先级排序的控制措施，涵盖了网络和系统安全的各个方面，如身份与访问管理、网络边界保护、安全配置管理、漏洞管理、安全审计和监控等。每个控制都有明确的目标、实施步骤和评估标准，帮助组织根据自身需求定制和执行安全策略，提升整体安全防护能力。采用CIS Controls意味着企业可以遵循一套标准化的、经过验证的最佳实践，降低潜在威胁，保护敏感信息，同时符合法律法规要求。随着技术的发展和威胁环境的变化，CIS会定期更新和调整这些控制，确保它们始终与最新的威胁情报和安全趋势保持同步。因此，持续学习和实施CIS Controls是保持网络安全态势的关键。

V 7.1

CIS Control 1: Inventory and Control of Hardware Assets

Sub-

Control

1.1

1.2

1.3

1.4

1.5

1.6

1.7

1.8

Asset

Type

Devices

Security

Function

Identify

Respond

Protect

Control

Title

Utilize an Active

Discovery Tool

Use a Passive Asset

Discovery Tool

Use DHCP Logging to

Update Asset Inventory

Maintain Detailed Asset

Inventory

Maintain Asset Inventory

Information

Address Unauthorized

Assets

Deploy Port Level Access

Control

Utilize Client Certiﬁcates

to Authenticate

Hardware Assets

Control

Descriptions

Utilize an active discovery tool to identify devices

connected to the organization’s network and

update the hardware asset inventory.

Utilize a passive discovery tool to identify devices

connected to the organization’s network and

automatically update the organization’s hardware

asset inventory.

Use Dynamic Host Conﬁguration Protocol

(DHCP) logging on all DHCP servers or IP address

management tools to update the organization’s

hardware asset inventory.

Maintain an accurate and up-to-date inventory

of all technology assets with the potential to

store or process information. This inventory shall

include all assets, whether connected to the

organization’s network or not.

Ensure that the hardware asset inventory records

the network address, hardware address, machine

name, data asset owner, and department for each

asset and whether the hardware asset has been

approved to connect to the network.

Ensure that unauthorized assets are either

removed from the network, quarantined or the

inventory is updated in a timely manner.

Utilize port level access control, following

802.1x standards, to control which devices can

authenticate to the network. The authentication

system shall be tied into the hardware asset

inventory data to ensure only authorized devices

can connect to the network.

Use client certiﬁcates to authenticate hardware

assets connecting to the organization’s trusted

network.

1 2 3

Implementation

Groups

V 7.1

CIS Control 1: Procedures and Tools

This Control requires both technical and procedural actions, united in a process that accounts for

and manages the inventory of hardware and all associated information throughout its life cycle.

It links to business governance by establishing information/asset owners who are responsible

for each component of a business process that includes information, software, and hardware.

Organizations can use large-scale, comprehensive enterprise products to maintain IT asset

inventories. Others use more modest tools to gather the data by sweeping the network, and

manage the results separately in a database.

Maintaining a current and accurate view of IT assets is an ongoing and dynamic process.

Organizations can actively scan on a regular basis, sending a variety of dierent packet types to

identify devices connected to the network. Before such scanning can take place, organizations

should verify that they have adequate bandwidth for such periodic scans by consulting load

history and capacities for their networks.

In conducting inventory scans, scanning tools could send traditional ping packets (ICMP Echo

Request) looking for ping responses to identify a system at a given IP address. Because some

systems block inbound ping packets, in addition to traditional pings, scanners can also identify

devices on the network using transmission control protocol (TCP), synchronize (SYN), or

acknowledge (ACK) packets. Once they have identiﬁed IP addresses of devices on the network,

some scanners provide robust ﬁngerprinting features to determine the operating system type of

the discovered machine.

In addition to active scanning tools that sweep the network, other asset identiﬁcation tools

passively listen on network interfaces for devices to announce their presence by sending trac.

Such passive tools can be connected to switch span ports at critical places in the network to

view all data ﬂowing through such switches, maximizing the chance of identifying systems

communicating through those switches.

Many organizations also pull information from network assets such as switches and routers

regarding the machines connected to the network. Using securely authenticated and encrypted

network management protocols, tools can retrieve media access control (MAC) addresses

and other information from network devices that can be reconciled with the organization’s

asset inventory of servers, workstations, laptops, and other devices. Once MAC addresses are

conﬁrmed, switches should implement 802.1x and Network Access Control (NAC) to only allow

authorized systems that are properly conﬁgured to connect to the network.

Wireless devices (and wired laptops) may periodically join a network and then disappear, making

the inventory of currently available systems very dynamic. Likewise, virtual machines can be

dicult to track in asset inventories when they are shut down or paused. Additionally, remote

machines accessing the network using virtual private network (VPN) technology may appear

on the network for a time, and then be disconnected from it. Whether physical or virtual, each

machine using an IP address should be included in an organization’s asset inventory.

V 7.1

1 2 3

Implementation Group 3

A mature organization with signiﬁcant

resources and cybersecurity experience

to allocate to Sub-Controls

Implementation Group 2

An organization with moderate resources

and cybersecurity expertise to implement

Sub-Controls

Implementation Group 1

An organization with limited resources

and cybersecurity expertise available to

implement Sub-Controls

CIS Control 2:

Inventory and Control of Software Assets

Actively manage (inventory, track, and correct) all software on the network so that only authorized

software is installed and can execute, and that all unauthorized and unmanaged software is found

and prevented from installation or execution.

Why Is This CIS Control Critical?

Attackers continuously scan target organizations looking for vulnerable versions of software

that can be remotely exploited. Some attackers also distribute hostile web pages, document ﬁles,

media ﬁles, and other content via their own web pages or otherwise trustworthy third-party

sites. When unsuspecting victims access this content with a vulnerable browser or other client-

side program, attackers compromise their machines, often installing backdoor programs and

bots that give the attacker long-term control of the system. Some sophisticated attackers may

use zero-day exploits, which take advantage of previously unknown vulnerabilities for which no

patch has yet been released by the software vendor. Without proper knowledge or control of the

software deployed in an organization, defenders cannot properly secure their assets.

Poorly controlled machines are more likely to be either running software that is unneeded for

business purposes (introducing potential security ﬂaws), or running malware introduced by an

attacker after a system is compromised. Once a single machine has been exploited, attackers

often use it as a staging point for collecting sensitive information from the compromised system

and from other systems connected to it. In addition, compromised machines are used as a

launching point for movement throughout the network and partnering networks. In this way,

attackers may quickly turn one compromised machine into many. Organizations that do not

have complete software inventories are unable to ﬁnd systems running vulnerable or malicious

software to mitigate problems or root out attackers.

Managed control of all software also plays a critical role in planning and executing system

backup, incident response, and recovery.

剩余75页未读，继续阅读

lionFromAsia

粉丝: 7
资源: 34

CIS Controls 7.1：全球认可的网络安全最佳实践指南

CIS Controls Version 7.1 Implementation Groups 1.2.xlsx

CIS-2 是MIPI吗？

CIS-2 和MIPI有什么区别？

是什么意思

关于正确认识全球能源安全形式的文献格式复制

cadence SPB17.2 - CIS数据库

YOLOv8-CIs

failed to lazily initialize a collection of role: com.hmglog.cis.model.Product.ebookDetailProductRels, could not initialize proxy - no Session

最新资源