Untitled

• CIS (Center for Internet Security) is a nonprofit organization protecting computer networks and data from cyber threats.
• CIS collaborates with government, businesses, and universities to formulate security best practices for public use

CIS Benchmarks

• Security checklists offering step-by-step guidance on setting up computers, servers, and software securely.
• Based on CIS Controls, security rules safeguarding organizations from cyberattacks.
• Follow well-known security standards like NIST Cybersecurity Framework (CSF), ISO 27000, PCI DSS, and HIPAA

Benchmark Creation

• Security experts discuss and test security settings.
• Best security practices agreed upon to create benchmarks.
• Public feedback considered for benchmark updates.

Security Levels

• Level 1 comprises basic security settings with minimal system impact.
• Level 2 offers stronger security settings for high-risk environments, possibly limiting some system functions.
• CIS Benchmarks serve as guidelines for securing operating systems, cloud services, applications, and networks

Operating Systems

• OS manages computer hardware and software, bridging user and computer for applications and tasks
• Windows, macOS, Linux, Android, and iOS are examples of operating systems.

OS Benchmarks & Auditing

• Operating systems translate high-level languages into machine-level languages.
• The OS allocates computer resources to users, workgroups, and applications.
• The OS manages tasks like job scheduling and multiprogramming..

5 Fundamental Operating System Objectives

• An operating system must protect itself from users.
• An operating system must protect users from each other.
• An operating system must protect users from themselves.
• The operating system must be protected from itself.
• The operating system must be protected from its environment.

Operating System Control & Audit Tests

• Access Privileges: User access privileges are assigned to authorize individuals and workgroups.
• Auditors verify that access privilege grants align with separating incompatible functions with organizational policy.
• Password Control: A password is a secret code to access systems, applications, and data.
• Audit objectives ensure an adequate and effective password policy to control OS access.
• Malicious/Destructive Programs: These are responsible for millions in losses annually.
• Program types include viruses, worms, logic bombs, back doors, and Trojan horses.
• Audit objectives maintain management policies/procedures for preventing intrusion & spread of destructive programs.
• System Audit Trail Control: Audit trails record system, application, and user-level activity.

Audit Trail Log Types

• Detailed Logs: Keystroke monitoring records user keystrokes & system responses.
• Event-Oriented Logs: Event monitoring summarizes key activities related to system resources.

Audit Trail Security Objectives

• Detecting unauthorized system access.
• Facilitating event reconstruction.
• Promoting personal accountability.
• Audit log information assists accountants in measuring potential damage and financial loss.
• Audit objectives ensure the established system audit trail prevents abuses, reconstructs events, and plans resources.

Cloud Platforms

• Cloud platforms refer to public cloud services, like AWS, Microsoft Azure, and GCP
• These services provide virtual computing resources over the internet.
• Cloud environments require strong security settings to prevent cyber threats.
• CIS Cloud Benchmarks gives step-by-step security recommendations.

Cloud Platform Examples

• AWS (Amazon Web Services)
• Microsoft Azure
• Google Cloud Platform (GCP)

Cloud Platforms and Auditing

• AWS has CloudTrail to track all actions and create auditor-reviewable logs.
• Azure has Security Center, which checks if cloud setups meet regulatory requirements like GDPR or ISO 27001.
• Google Cloud's Security Command Center detects misconfigurations and suggests fixes.
• AWS and Azure manage user permissions via IAM so auditors can check only the right people can access sensitive resources.
• Azure Policy automatically checks resource compliance with set security rules like ensuring encryption.
• AWS's CloudTrail can help auditors trace all activities leading up to a security incident for responses to breaches.

Network Devices

• Network devices refer to the hardware and software that connect and secure computer networks.
• Network settings are essential for strong security to prevent cyber threats.
• The CIS Network Device Benchmarks provide best practices to harden devices against attacks.

Examples of Network Devices

• Firewalls control incmomng and outgoing internet traffic.
• Routers transfer network traffic between system.
• Switches connect multiple devices within a network
• VPNs encrypt internet connections for security
• Wireless Access Points (WAPs) provide Wi-Fi connectivity.
• Firewalls log internet activity; auditors check logs during break-in attempts.
• Routers/firewalls allow only authorized employees access to block outsiders.
• Auditors flag unpassworded Wi-Fi networks as security risks.
• Auditors check for firewalls in security standards compliance to properly block unauthorized access.
• Overloaded network switches can be detected in auditing helps before they cause problems.
• After break-ins, firewall logs might show which IP address was used as well as the data accessed.

Using CIS Benchmarks for Secure Configuration

• Define a structured baseline based on industry best practices like the CIS benchmarks or DISA STIG's.
• Update servers regularly with security patches for addressing vulnerabilities and exploit protections.
• Strong Access Controls: Enforce authentication mechanisms like complex passwords or multifactor authentication.
• Perform regular reviews of User Right Assignment settings for aligning access privileges with security best practices.
• Disable unnecessary services or protocols to minimize potential attack vectors.
• Use automated configuration monitoring to check secure configuration elements and raise alerts if unauthorized changes occur.
• Configuration monitoring tools that integrate with Security Content Automated Protocol are recommended
• Deploy system configuration management tools to automatically enforce system configuration settings in real-time.

Interpreting/Applying CIS Benchmark Guidelines

• Understand CIS Benchmarks: Utilize security checklists created by cybersecurity experts to prevent data breaches.
• Strengthen security and lower the risk of cyber threats.
• Assess Security Posture: Check system security and use tools like CIS-CAT to see where your organization can improve.
• Develop an Implementation Plan with IT, security, and compliance teams
• Set clear goals, deadlines, assign responsible parties, and document changes. Testing, Validation and Continuous Monitoring practices are essential for effective cybersecurity.
• Automate tools to check security settings.
• Perform constant system montoring and update security measures.
• Leverage Your Team to practice safe settings and increase security.
• Your cybersecurity team should know how benchmarks protect the organization.

CIS Benchmarks Role for Auditors

• CIS Benchmarks serve as an invaluable tool for auditors to assess system configurations, identify vulnerabilities, and strengthen an organization's security.