CIS Control 4 Safeguards for hardening: documented secure configuration processes, session locking, host firewalls, secure administration, default accounts, unnecessary services, trusted DNS and mobile device controls.
The documented secure configuration process for end-user, mobile, IoT and server assets and for operating systems and applications, reviewed annually: a Govern Safeguard that dozens of other Safeguards rely on for measurement.
The network counterpart to Safeguard 4.1: a written process for securely configuring network devices, reviewed annually, and the firewall and wireless configuration requirements CIS maps it to.
Automatic session locks after inactivity, with CIS maximums of 15 minutes for general-purpose operating systems and 2 minutes for mobile end-user devices.
Firewalls on servers, where supported, as an IG1 baseline, whether virtual, built into the operating system or supplied as a third-party agent.
End-user device firewalls or port filters that deny traffic by default, which goes beyond Safeguard 4.4 by requiring that only explicitly permitted services and ports get through.
How assets and software are administered: version-controlled infrastructure as code, administrative access over SSH or HTTPS, and avoiding Telnet and HTTP unless operationally essential.
Dealing with root, administrator and other vendor-preconfigured accounts by disabling them or making them unusable: the only Control 4 Safeguard in the Users asset class.
Reducing attack surface by removing or turning off services that are not needed, from idle file sharing to unused web application modules.
Pointing network infrastructure at trusted DNS servers, either enterprise-controlled or reputable externally accessible servers: an IG2 Safeguard measured by configuration coverage.
Locking portable devices after repeated failed local logins, with CIS thresholds of no more than 20 attempts for laptops and 10 for tablets and smartphones.
Being able to wipe enterprise data remotely from enterprise-owned portable devices when they are lost or stolen or when their user leaves the enterprise.
Keeping enterprise apps and data apart from personal ones on mobile devices, for example with Apple Configuration Profiles or Android Work Profiles: the only IG3 Safeguard in Control 4.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.