The CIS Critical Security Controls for Effective Cyber Defense
The Center for Internet Security Critical Security Controls for Effective Cyber Defense is a publication of best practice guidelines for computer security. The project was initiated early in 2008 in response to extreme data losses experienced by organizations in the US defense industrial base. The publication was initially developed by the SANS Institute. Ownership was then transferred to the Council on Cyber Security in 2013, and then transferred to Center for Internet Security in 2015. It was originally known as the Consensus Audit Guidelines and it is also known as the CIS CSC, CIS 20, CCS CSC, SANS Top 20 or CAG 20.
Goals
The guidelines consist of 20 key actions, called critical security controls, that organizations should implement to block or mitigate known attacks. The controls are designed so that primarily automated means can be used to implement, enforce and monitor them. The security controls give no-nonsense, actionable recommendations for cyber security, written in language that’s easily understood by IT personnel. Goals of the Consensus Audit Guidelines include
Leveraging cyber offense to inform cyber defense, focusing on high payoff areas
Ensuring that security investments are focused to counter highest threats
Maximizing the use of automation to enforce security controls, thereby negating human errors
Using consensus process to collect best ideas
Controls
Version 3.0 was released on April 13, 2011. Version 5.0 was released on February 2, 2014 by the Council on Cyber Security. Version 6.0 was released on October 15, 2015 and consists of the security controls below. Version 6.1 was released on August 31, 2016 and has the same priorization as version 6. Version 7 has been released March 19 2018. Version 7.1 has been released April 4 2019. CSC 1: Inventory of Authorized and Unauthorized Devices CSC 2: Inventory of Authorized and Unauthorized Software CSC 3: Continuous Vulnerability Assessment and Remediation CSC 4: Controlled Use of Administrative Privileges CSC 5: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers CSC 6: Maintenance, Monitoring, and Analysis of Audit Logs CSC 7: Email and Web Browser Protections CSC 8: Malware Defenses CSC 9: Limitation and Control of Network Ports, Protocols, and Services CSC 10: Data Recovery Capability CSC 11: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches CSC 12: Boundary Defense CSC 13: Data Protection CSC 14: Controlled Access Based on the Need to Know CSC 15: Wireless Access Control CSC 16: Account Monitoring and Control CSC 17: Security Skills Assessment and Appropriate Training to Fill Gaps CSC 18: Application Software Security CSC 19: Incident Response and Management CSC 20: Penetration Tests and Red Team Exercises Compared to version 5, version 6/6.1 has re-prioritized the controls and changed these two controls:
'Secure Network Engineering' was CSC 19 in version 5 but has been deleted in version 6/6.1.
'CSC 7: Email and Web Browser Protections' has been added in version 6/6.1.
In Version 7, controls 3, 4, and 5 were reshuffled. Controls 1-6 are considered "Basic", 7-16 are "Foundational" and 17-20 are "Organizational". It also released CIS RAM, an information security risk assessment method to help implement CIS Controls.
Contributors
The Consensus Audit Guidelines were compiled by a consortium of more than 100 contributors from US government agencies, commercial forensics experts and pen testers. Authors of the initial draft include members of:
Starting in 2009, the US Department of State began supplementing its risk scoring program in part using the Consensus Audit Guidelines. According to the Department's measurements, in the first year of site scoring using this approach the department reduced overall risk on its key unclassified network by nearly 90 percent in overseas sites, and by 89 percent in domestic sites.
