Tag Archive for: CIS

How to Identify Your Boundary Defense Needs

/by

By Kes Jecius, RedSeal Senior Consulting Engineer

The Center for Internet Security’s (CIS) twelfth control for implementing a cybersecurity program is for your organization to control the flow of information transferring between networks of different trust levels. The first sub-control states that an organization should maintain an inventory of all network boundaries. So, the first question you need to ask is: where are your network boundaries?

Back in the days before the Internet was prevalent and mainframes dominated the IT landscape, these boundaries were very well defined. All the company’s information was warehoused in a mainframe centrally controlled by a small group of people. Getting access to the data was a very rigorous process and external links were not common. When external links were established, they were very tightly defined to exchange the minimum amount of information required to conduct business.

With the introduction of Local Area Networks, data started to be distributed within the organization. The IT department frequently was not involved in the deployment of these networks since they were seen as local resources and didn’t include external links. As these data resources grew, departments wanted to share information outside the boundaries of their local network. The Internet facilitated this connectivity, and IT departments needed to get involved to provide a control point for these data flows.

Now jump to the present where organizations have multiple internal data sources deployed in a distributed fashion, and the business owners of the data want to share this information with others to make their operations more efficient. The IT department now needs to understand the network boundaries and the security group needs to control and manage the boundary defense requirements.

To inventory these boundaries, the first step is to understand how your network infrastructure is connected. Assuming you’ve done a good job implementing CIS Control #1 (Inventory and Control of Hardware Assets), you have an initial base to identify all connections to external organizations and the Internet. A secondary pass through this information should focus on identifying internal connectivity. Understand where your organization allows data to flow and identify untrusted links within the organization, like guest wireless access.

The second phase of creating your boundary inventory is to leverage the data gathered in implementing CIS Control #2 (Inventory and Control of Software Assets). By understanding the systems running on your servers, you can start to understand where the users of the data are connecting to the enterprise. Then, map these flows to the hardware inventory to get an understanding of all network boundaries and determine where your organization should focus to implement appropriate security controls.

With automated tools and platforms in place from the first two controls, putting together the initial inventory of network boundaries should be a relatively easy process. Then your security group can start to improve overall boundary defenses as identified in the other sub-controls within the twelfth CIS control (Boundary Defense).

Although no single product can be the solution for implementing and managing all CIS controls, look for products that provide value in more than one area and integrate with your other security solutions. RedSeal, for example, is a foundational solution that provides significant value for understanding the networking environment and helping to identify the network boundaries that have already been deployed. This, in turn, will allow your organization to improve these boundary defenses in a cost efficient manner.

Download the RedSeal CIS Controls Solution Brief to find out more about how RedSeal can help you implement your cybersecurity program using the CIS Controls.

CIS Benchmarks Bring Network and Security Teams Together

/by

By Kes Jecius, RedSeal Senior Consulting Engineer

The Center for Internet Security’s (CIS) eleventh control for implementing a cybersecurity program is for your organization to actively track, report on, and correct the security configurations for network devices. This involves the use of a configuration management system and robust change control processes. What has been missing is a common set of network device security configurations standards that can be utilized by network and security teams.

As a networking professional for over 30 years, I understand the need to consistently and securely configure network devices. I built “golden templates” to make sure that any time I added a new device, it is configured the same as the last one. I utilized my own knowledge base and vendor recommendations for how to configure these network devices. Sound familiar?

But, network manufacturers frequently provide software updates to add new features, correct bugs, and address identified security holes in their networking devices. How often do we go back to update golden templates and check existing network devices when we install a new software version or use a new feature? In my experience, rarely. Network operations teams are too busy addressing access requirements and network-related support tickets. Checking existing configurations for correctness becomes a summer intern’s job.

Then, the security group starts the important work of establishing policies for how to secure information within your enterprise. Because network devices are part of the security infrastructure, the security analyst starts asking questions of the network operations teams and the divide between groups becomes apparent. The networking teams are addressing access requirements and tickets. They just don’t have the manpower to address the security analyst’s concerns.

To help bridge this internal divide, organizations are turning to security frameworks to allow teams to understand both sides of the equation. A very useful framework comes from CIS. CIS provides CIS Benchmarks, a set of configuration guidelines for the most common networking devices and platforms. These benchmarks have been developed by both security and networking professionals as minimum configuration security standards. Network teams can establish projects to update golden templates and then address security configuration issues on individual devices. By using the CIS Benchmarks, security teams have a set of standards to run an audit of network device configurations — and assess the overall risk to the enterprise when device configurations don’t match the standards.

Federal government agencies have done this for many years using DISA STIGs (Security Technical Information Guides). CIS Benchmarks are similar to these standards, but the Department of Defense has security requirements that are different from many commercial organizations.

As a single project, reconfiguring many networking devices is a challenge. You’ll need to make these security standards part of the existing golden templates and then integrate them with the on-going change management processes. It will take some time to fully migrate to these standards. Consider smaller projects that address a portion of the CIS Benchmarks so you can demonstrate tangible improvements more quickly.

Although no single product can be the solution for implementing and managing all CIS controls, look for products that provide value in more than one area and integrate with your other security solutions. RedSeal, for example, is a foundational solution that provides significant value for understanding the networking environment and helping to identify network devices that do not meet minimum recommended network device configuration standards. Whether you utilize CIS Benchmarks, STIGs, or some other established standard, make sure that these controls receive some attention in your overall cybersecurity strategy.

Download the RedSeal CIS Controls Solution Brief to find out more about how RedSeal can help you implement your cybersecurity program using the CIS Controls.

Understanding and Managing Your Attack Surface

/by

By Kes Jecius, RedSeal Senior Consulting Engineer

The Center for Internet Security’s (CIS) ninth control for implementing a cybersecurity program is for your organization to manage the ports, protocols, and services on a networked device that are exposed and vulnerable to exploitation. The intent of the control is for your organization to understand, reduce and manage the “attack surface” of its computing assets.

Attack surface can be defined in two dimensions, the network dimension and the server configuration. The network dimension is about attack vectors, or how an attacker can gain access to a device. We assume that attackers come from an untrusted part of the network, such as the Internet. You reduce attack vectors by limiting which devices/servers are accessible from these untrusted network spaces. This is typically done by implementing firewalls within the network infrastructure.

The next attack surface dimension is the ports/protocols/services that are enabled and accessible on the server itself. To reduce your attack surface, start by understanding what ports/protocols/services are required for an application to run on the network. Any that aren’t required should be disabled on the server. For instance, on a public-facing web server only ports 80 (http) and 443 (https) need to be enabled to view web content. Next, pair this basic understanding with an active vulnerability management program. Attackers continue to develop exploits for these commonly used ports. You’ll want to remediate these potential vulnerabilities in a timely fashion to reduce the risk of compromise.

Beyond your external attack surface, however, there is an additional dimension. Many current system exploits come from within your own internal network. Hackers regularly use phishing emails and false web links to entice people to click on something that will install some type of malware. This creates a new attack vector to critical assets as an attacker gains a toehold within your trusted internal network.

To manage and reduce both your external and internal attack surfaces, you need to use tools and platforms to understand both attack vectors and the ports/protocols/services needed on critical systems. CIS recommends:

  • Using your asset inventories generated from implementing CIS Control #1 (Inventory and Control of Hardware Assets) and Control #2 (Inventory and Control of Software Assets) to map active ports/protocols/services to critical systems.
  • Ensure that only required ports/protocols/services are enabled on these critical systems.
  • Implement mitigating controls in the network, such as application firewalls, host-based firewalls, and/or port filtering tools.
  • Perform regular automated port scans of critical systems to ensure that implemented controls are being effective.
    NOTE: Many servers are not tolerant of port scanning tools due to load on the server. Other solutions exist that allow organizations to validate that only required ports/protocols/services are enabled on critical servers.

Although no single product can be the solution for implementing and managing all CIS controls, look for products that provide value in more than one area and integrate with your other security solutions. RedSeal, for example, is a foundational solution that provides significant value for understanding and managing your external and internal attack surfaces. Additionally, RedSeal provides pre-built integrations with many security products and easy integration with others via its REST API interface.

Download the RedSeal CIS Controls Solution Brief to find out more about how RedSeal can help you implement your cybersecurity program using the CIS Controls.

The Network Dimension in Vulnerability Management

/by

By Kes Jecius, RedSeal Senior Consulting Engineer

The Center for Internet Security’s (CIS) third control for implementing a cybersecurity program is to practice continuous vulnerability management. Organizations that identify and remediate vulnerabilities on an on-going basis will significantly reduce the window of opportunity for attackers. This third control assumes you’ve implemented the first two CIS framework controls — understanding both the hardware that makes up your infrastructure and the software that runs on that infrastructure.

The first two controls are important to your vulnerability management program. When you know what hardware assets you have, you can validate that you’re scanning all of them for vulnerabilities. As you update your IT inventory, you can include new assets in the scanning cycle and remove assets that no longer need to be scanned. And, when you know what software run on your infrastructure, you can understand which assets are more important. An asset’s importance is key to identifying what should be remediated first.

Most vulnerability scanning platforms allow you to rank the importance of systems being scanned. They prioritize vulnerabilities by applying the CVSS (Common Vulnerability Scoring System) score for each vulnerability on an asset and couple it with the asset’s importance to develop a risk score.

The dimension missing from this risk scoring process is understanding if attackers can reach the asset to compromise it. Although you are remediating vulnerabilities, you can still be vulnerable to attacks if what you’re remediating isn’t accessible by an attacker. It may be protected by firewalls and other network security measures. Knowledge of the network security controls already deployed would allow the vulnerability management program to improve its prioritization efforts to focus on high value assets with exposed vulnerabilities that can be reached from an attacker’s location.

Other vulnerability scanning and risk rating platforms use threat management data to augment their vulnerability risk scoring process. While threat management data (exploits actively in use across the world) adds value, it doesn’t incorporate the network accessibility dimension into evaluating that risk.

As you work to improve your vulnerability management program, it’s best to use all the information available to focus remediation efforts. Beyond CVSS scores, the following elements can improve most programs:

  • Information from network teams on new and removed subnets (IP address spaces) to make sure that all areas of the infrastructure are being scanned.
  • Information from systems teams on which systems are most important to your organization.
  • Including network information in the risk scoring process to determine if these systems are open to compromise.

Although no single product can be the solution for implementing and managing all CIS controls, look for products that provide value in more than one area and integrate with your other security solutions. RedSeal, for example, is a foundational solution that provides significant value for meeting your vulnerability management goals by providing network context to existing vulnerability scanning information. Additionally, RedSeal provides pre-built integrations with many security products and easy integration with others via its REST API interface.

Download the RedSeal CIS Controls Solution Brief to find out more about how RedSeal can help you implement your program using the CIS Controls.

Visibility of IT Assets for Your Cybersecurity Program

/by

By Kes Jecius, RedSeal Senior Consulting Engineer

The Center for Internet Security’s (CIS) first control for implementing a cybersecurity program is to understand and manage the hardware assets that make up your IT infrastructure. These hardware assets consist of network devices, servers, workstations, and other computing platforms. This is a difficult goal to achieve, further complicated by the increasing use of virtualized assets, such as public and/or private cloud, Software as a Service (SaaS), and virtualized servers.

In the past, inventorying these assets was relatively simple. When it came in the door, the physical device was given an inventory tag and entered into an asset management system. The asset management system was controlled by the finance group, primarily so assets could be depreciated for accounting records. As the IT world matured, we saw the advent of virtualized systems where a single box could be partitioned into multiple systems or devices. Further evolution in IT technology brought us cloud-based technologies, where a company no longer has a physical box to inventory. Network services are configured and servers are created dynamically. Hence the daunting task of trying to create and manage the IT inventory of any company.

CIS recognizes this and recommends using both active and passive discovery tools to assist. Since no human can keep up with this inventory of physical and virtual devices, discovery tools can help present an accurate picture of IT assets.

Active discovery tools leverage network infrastructure to identify devices by some form of communication to the device. Network teams are generally opposed to these tools because they introduce extra network traffic. Tools that attempt to “ping” every possible IP address are not efficient. They are also identified as potential security risks, since this is the same behavior that hackers generally use. Newer discovery strategies have evolved that are significantly more network friendly yet do a good job identifying the devices in your IT infrastructure. These newer, active discovery strategies target specific network IP addresses to gather information about a single device. When the information is processed, it can reveal information about other devices in the network.

Passive discovery tools are placed on the network to listen and parse traffic to identify all devices. Passive discovery tools do not add significantly to network traffic, but they need to be placed correctly to capture data. Some computing devices may never be identified because they are infrequently used, or their traffic never passes by a passive discovery tool. Newer passive discovery tools can integrate information with active discovery tools.

Most organizations need a combination of discovery tools. Active discovery tools should minimize their impact to the network and the devices they communicate with. Passive discovery tools can discover unknown devices. IT groups can do a gap analysis between the two tools to assess what is under management and what isn’t (frequently referred to as Shadow IT). This combined approach will provide the best strategy for understanding and managing all assets that make up an IT infrastructure.

Without this first step, having visibility into what these IT assets are and how they are connected, the remaining CIS controls can only be partially effective in maturing your cybersecurity strategy.

Although no single product can be the solution for implementing and managing all CIS controls, look for products that provide value in more than one area and integrate with your other security solutions. RedSeal, for example, is a foundational solution that provides significant value for meeting the first control, while providing benefit to implementing many of the other controls that make up the CIS Control framework. Additionally, RedSeal provides pre-built integrations with many security products and easy integration with others via its REST API interface.

Download the RedSeal CIS Controls Solution Brief to find out more about how RedSeal can help you implement your program using the CIS Controls.

Using the CIS Top 20 Controls to Implement Your Cybersecurity Program

/by

By Kes Jecius, Senior Consulting Engineer

I have the privilege of working with security groups at many different enterprise companies. Each of them is being bombarded by many different vendors who offer security solutions. No surprise, the common estimate is that there are approximately 2,000 vendors offering different products and services to these companies.

Each of these companies struggles with determining how to implement an effective cybersecurity program. This is made more difficult by vendors’ differing views on what is most important. On top of this, companies are dealing with internal and external requirements, such as PCI, SOX, HIPAA and GDPR.

The Center for Internet Security (www.cisecurity.org) offers a potential solution in the form of a framework for implementing an effective cybersecurity program. CIS defines 20 controls that organizations should implement when establishing a cybersecurity program. These controls fall into three categories:

  • Basic – Six basic controls that every organization should address first. Implementation of solutions in these 6 areas forms the foundation of every cybersecurity program.
  • Foundational – Ten additional controls that build upon the foundational elements. Think of these as secondary initiatives once your organization has established a good foundation.
  • Organizational – Four additional controls that are that address organizational processes around your cybersecurity program.

Most organizations have implemented elements from some controls in the form of point security products. But many don’t recognize the importance of implementing the basic controls before moving on to the foundational controls – and their cybersecurity programs suffer. By organizing your efforts using CIS’s framework, you can significantly improve your company’s cyber defenses, while making intelligent decisions on the next area for review and improvement.

Although no single product can be the solution for implementing and managing all CIS controls, look for products that provide value in more than one area and integrate with your other security solutions. RedSeal, for example, is a platform solution that provides significant value in 7 of the 20 control areas and supporting benefit for an additional 10 controls. Additionally, RedSeal has pre-built integrations with many security products and easy integration with others via its REST API interface.

Download the RedSeal CIS Controls Solution Brief to find out more about how RedSeal can help you implement your program using the CIS Controls.

 

RedSeal Awarded CIS Benchmark Certification

/by

SUNNYVALE, Calif. – December 12, 2017 – RedSeal announced today that its market leading network modeling and risk scoring platform has been certified by CIS to compare the configuration status of network devices against the consensus-based best practice standards contained in the Cisco IOS 15 CIS Benchmark. Organizations that leverage RedSeal can now ensure that the configurations of their critical assets align with the associated CIS Benchmarks consensus-based practice standards.

“RedSeal customers using Cisco network devices can combat the evolving cybersecurity challenges they face by following CIS’s proven guidelines,” said Kurt Van Etten, vice president of product management at RedSeal. “Adhering to standards, industry best practices and organizational policies is critical as organizations strive to become digitally resilient. RedSeal customers can now compare the configurations of their Cisco network devices with the CIS Benchmarks and verify compliance.”

RedSeal’s network modeling and risk scoring platform builds an accurate, up-to-date model of an organization’s entire, as-built network to visualize access paths, prioritize what to fix, and target existing cybersecurity resources to protect their most valuable assets. With RedSeal’s Digital Resilience Score, decision makers can see the security status and benchmark progress toward digital resilience.

“Cybersecurity challenges are mounting daily, which makes the need for standard configurations imperative. By certifying its product with CIS, RedSeal has demonstrated its commitment to actively solve the foundational problem of ensuring standard configurations are used throughout a given enterprise,” said Curtis Dukes, Executive V.P. & G.M., CIS Security Best Practices & Automation.

In order for a product to receive the CIS Benchmark Certification, a CIS SecureSuite Product Vendor member must adapt its product to accurately check/score/report as compared to the security recommendations in the associated CIS Benchmarks profile. CIS Benchmark Certified Products demonstrate a strong commitment by the vendors to provide their customers with the ability to ensure their assets are secured according to consensus-based best practice standards.

The CIS Benchmarks program is recognized as a trusted, independent authority that facilitates the collaboration of public and private industry experts to achieve consensus on practical and actionable solutions. CIS Benchmarks are recommended as industry-accepted system hardening standards and are used by organizations in meeting compliance requirements for Federal Information Security Management Act, PCI, Health Insurance Portability Accountability Act and other security requirements.

About the CIS

CIS is a forward-thinking nonprofit entity that harnesses the power of a global IT community to safeguard private and public organizations against cyber threats. Our CIS Controls and CIS Benchmarks are the global standard and recognized best practices for securing IT systems and data against the most pervasive attacks. These proven guidelines are continually refined and verified by a volunteer global community of experienced IT professionals. CIS is home to the Multi-State Information Sharing & Analysis Center (MS-ISAC®), the go-to resource for cyber threat prevention, protection, response, and recovery for state, local, tribal, and territorial government entities.

About RedSeal

RedSeal’s network modeling and risk scoring platform is the foundation for enabling enterprise networks to be resilient to cyber events and network interruptions in an increasingly digital world. RedSeal helps customers understand their network from the inside, out – and provides rich context, situational awareness and a Digital Resilience Score to help enterprises measure and ultimately build greater resilience into their infrastructure. Government agencies and Global 2000 companies around the world rely on RedSeal to help them improve their overall security posture, accelerate incident response and increase the productivity of their security and network teams. Founded in 2004, RedSeal is headquartered in Sunnyvale, California and serves customers globally through a direct and channel partner network. Follow RedSeal on Twitter at @redseal_co and on LinkedIn.

Contact:
Dean Fisk, Finn Partners
+1 (707) 292-4201
dean.fisk@finnpartners.com

RedSeal Enhances Digital Resilience Platform, Dramatically Reducing Network Analysis Time and Boosting Security Team Productivity

/by

Expanded coverage of hybrid datacenters creates more complete and accurate network models
New integration apps accelerate incident investigations and bring live traffic into RedSeal platform

SUNNYVALE, Calif. – November 14, 2017 – RedSeal today announced new enhancements and integrations for its market leading network modeling and risk scoring platform, used by more than 40 U.S. government agencies and many Global 2000 companies worldwide.

More Holistic View Across Hybrid Datacenters

Nearly all large enterprises today include on-premise, cloud and virtualized networks, which results in network systems that are large, complex, and constantly changing. This makes it very difficult to have a complete and detailed understanding of the current state of a network. To address this, RedSeal is expanding its Software Defined Networks (SDN) and public cloud capabilities with the addition of Microsoft Azure ARM (Azure Resource Manager) modeling, and support for RedSeal’s virtual appliance to run on Microsoft Hypervisor, Hyper-V. This builds on its existing ability to model networks on Amazon Web Services Virtual Private Clouds (VPCs), and software-defined networks (SDNs) in VMWare NSX, and Cisco ACI.

CIS Benchmarks

RedSeal also announces support for CIS Benchmarks for Cisco, enabling customers to conduct secure configuration checks of their network devices against the CIS standard.

New Integrations for Improved Productivity

To improve security team productivity, RedSeal is adding new integration apps with IBM’s QRadar SIEM and Micro Focus ArcSight’s Enterprise Security Management (ESM) software. RedSeal customers can also bring live traffic information from Gigamon’s Visibility Platform directly into their RedSeal queries. Specifically:

  • Gigamon Visibility Platform customers can now call Gigamon from the RedSeal user interface to see if live traffic is occurring in any detailed path query in RedSeal.
  • Apps for IBM’s QRadar SIEM and Micro Focus ArcSight’s ESM dramatically reduce incident investigation times for users by giving them unprecedented network context and actionable intelligence. By integrating RedSeal’s network modeling platform into their current interface, they will be able to quickly kick off an incident investigation phase by cross launching the RedSeal IR query directly from the console of the product they use.

These add to RedSeal’s existing suite of integration apps with Splunk’s Enterprise Security SIEM, Rapid7’s Insight VM vulnerability management software, and ForeScout’s CounterACT, announced earlier this year.

“Bad actors continue to unleash advanced attacks targeting vulnerabilities enterprises don’t know exist,” Kurt Van Etten, vice president of product management at RedSeal. “The first step to improving digital resilience is to prepare for these unknown and unavoidable attacks by having a complete understanding of access across hybrid datacenters. These new enhancements bring our customers a holistic view of their network, whether on-premise, virtual or in the cloud, while accelerating incident containment times through increased power and deep integrations with current security solutions.”

About RedSeal
RedSeal’s network modeling and risk scoring platform is the foundation for enabling enterprise networks to be resilient to cyber events and network interruptions in an increasingly digital world. RedSeal helps customers understand their network from the inside, out – and provides rich context, situational awareness and a Digital Resilience Score to help enterprises measure and ultimately build greater resilience into their infrastructure. Government agencies and Global 2000 companies around the world rely on RedSeal to help them improve their overall security posture, accelerate incident response and increase the productivity of their security and network teams. Founded in 2004, RedSeal is headquartered in Sunnyvale, California and serves customers globally through a direct and channel partner network. Follow RedSeal on Twitter at @redseal_co and on LinkedIn.

Contact:
Dean Fisk, Finn Partners
+1 (707) 292-4201
dean.fisk@finnpartners.com