CIS Control 13 covers the processes and tools for monitoring and defending the enterprise network and user base: centralized alerting, host and network intrusion detection and prevention, segment filtering, remote access control, flow logs and alert tuning.
Centralizing security event alerting across enterprise assets for log correlation and analysis, through a SIEM or a log analytics platform with security correlation alerts; the foundation for the rest of Control 13.
Deploying a host-based intrusion detection solution on enterprise assets where appropriate or supported; the detect-only host safeguard, with prevention covered by 13.7 at IG3.
Deploying network intrusion detection where appropriate, through a NIDS or an equivalent cloud provider service; the detect-only network safeguard, with prevention covered by 13.8 at IG3.
Filtering traffic between network segments where appropriate, the enforcement side of the segmentation that the network architecture in 12.2 calls for.
Managing access control for remotely connecting assets, granting access based on the asset's anti-malware status, configuration compliance and patch level; the posture check that complements the VPN requirement in 12.7.
Collecting network traffic flow logs or network traffic from network devices for review and alerting; the network telemetry source for Control 13.
Deploying host-based intrusion prevention, such as an EDR client or host IPS agent, where appropriate or supported; the IG3 step beyond host-based detection in 13.2.
Deploying network intrusion prevention, such as a NIPS or equivalent cloud provider service, where appropriate; the IG3 step beyond network detection in 13.3.
Deploying port-level network access control using 802.1X or similar protocols, which can use certificates and user or device authentication; an IG3 safeguard.
Filtering traffic at the application layer through a filtering proxy, application layer firewall or gateway; the IG3 complement to segment-level filtering in 13.4.
Tuning security event alerting thresholds at least monthly so centralized alerting (13.1) stays useful; an IG3 safeguard with a fixed review frequency.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.