CIS Control 2 Safeguards for knowing and controlling the software that runs in the enterprise: the software inventory, support status, unauthorized software, automated inventory tools and allowlisting of software, libraries and scripts.
The detailed inventory of licensed software installed on enterprise assets: required and recommended fields, the twice-yearly review, and why most other software, data and configuration Safeguards depend on it.
Keeping unsupported (end-of-life) software off the authorized list: the monthly support check, documented exceptions with mitigating controls and accepted residual risk, and how assessors measure mislabeled and unsupported software.
The response Safeguard for software: removing unauthorized software from enterprise assets or documenting an exception, reviewed at least monthly, and how assessors count unaddressed software per asset.
Automating software discovery and documentation with inventory tools across the enterprise: an IG2 Safeguard measured by how many software-capable endpoints the tooling covers.
Technical enforcement, such as application allowlisting, so that software outside the approved list cannot run: the twice-yearly reassessment and the coverage metrics assessors use.
Extending allowlisting to software libraries such as .dll, .ocx and .so files so that unauthorized libraries cannot load into system processes, reassessed at least twice a year.
The IG3 end of software control: allowing only authorized scripts, such as .ps1 and .py files, to execute, using techniques such as digital signatures and version control.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.