Attacks against applications are certainly a growing threat to organizations. Some argue that as system administrators are much better at configuring and patching their systems, the application is the next logical target of attack. What can be done at little to no cost to help prevent these threats to your environment? Glad you asked. Teach […]
Blog
Critical Control 6: Maintenance, Monitoring, and Analysis of Audit Logs
Logs are the single most important place to look when it is time to answer the question “what just happened”. The more systems you have, the more impractical it is to review at system logs individually. To facilitate this, configure each system to send its logs to a centralized log review and retention solution. This […]
Control 5 – Boundary Defense
Control 5 builds on Control 4 and is concerned with increased awareness and defense of the network boundary. To defend the boundary means you must be aware of what traffic goes through all network segments. Change control procedures that are strictly followed is also an important step toward successfully implementing this control. What can be […]
Control 4 – Secure Configurations of Network Devices Such as Firewalls, Routers, and Switches
Control 4 is similar to Control 3 in that it is concerned with maintaining a secure configuration. This time the focus is on network devices. What is the last thing you did on your network devices? Likely it was add a rule to permit a new traffic flow. When was the last time you made […]
Control 3 – Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers
Control 3 builds on the previous two controls, Inventory of Authorized and Unauthorized Devices and Inventory of Authorized and Unauthorized Software. The intent of this control is to develop secure configurations for your systems and montior for any deviation from this standard. To implement this control, you must invest in some manual work in making […]
Control 2 – Inventory of Authorized and Unauthorized Software
Control 2 focuses on knowing the software that is installed on workstations and servers throughout your organization. Like Control 1, this may seem overwhelming at first. However, once you have started to gain momentum, this one should not be difficult to maintain. Start with an initial assessment from these tools to begin the process of […]