CIS Control 04: Secure Configuration of Enterprise Assets and Software

Key Takeaways for Control 4

Most fresh installs of operating systems or applications come with preconfigured settings that are usually insecure or not properly configured with security in mind. Use the leverage provided by multiple frameworks such as CIS Benchmarks or NIST NCP to find out if your organization needs to augment or adjust any baselines to become better aligned with the policies your organization is trying to adhere to.

Throughout the CIS Controls, many controls will play off one another, or some may need data from previous controls to get a better understanding of what is secure and what is not. An example is Control 4, which deals with the secure configuration of enterprise assets and software, for which controls 1 and 2 establish the data for what assets and software an organization has.

Remember to go with a layered approach to cybersecurity. Implementing and managing firewalls is a cornerstone of cybersecurity, but putting all your eggs in one basket and hoping you can catch or stop every threat is not realistic. Having multiple layers of security can improve your effectiveness at slowing, delaying, or hindering a threat until it can be completely neutralized.

Safeguards for Control 4

4.1) Establish and Maintain a Secure Configuration Process

Description: Establish and maintain a secure configuration process for enterprise assets (end-user devices, including portable and mobile; non-computing/IoT devices and servers) and software (operating systems and applications). Review and update documentation annually or when significant enterprise changes occur, that could impact this Safeguard.

Notes: The security function associated with this safeguard is Govern. This safeguard can be implemented by leveraging other benchmarks and checklists such as CIS Benchmarks or NIST NCP (National Checklist Program). With CIS benchmarks and NIST NCP, you can augment or adjust the baselines to satisfy your enterprise security policy.

4.2) Establish and Maintain a Secure Configuration Process for Network Infrastructure

Description: Establish and maintain a secure configuration process for network devices. Review and update documentation annually or when significant enterprise changes occur, that could impact this Safeguard.

Notes: The security function associated with this safeguard is Govern. As with Safeguard 4.1, network devices also need hardening. The benchmarks and tools mentioned earlier can be augmented and adjusted to fit this field as well.

4.3) Configure Automatic Session Locking on Enterprise Assets

Description: Configure automatic session locking on enterprise assets after a defined period of inactivity. For general-purpose operating systems, the period must not exceed 15 minutes. For mobile end-user devices, the period must not exceed 2 minutes.

Notes: The security function associated with this safeguard is Protect. Enabling automatic session lockouts helps prevent unauthorized access to devices. I reiterate this because most operating systems have this policy disabled or not defined.

4.4) Implement and Manage a Firewall on Servers

Description: Implement and manage a firewall on servers where supported. Example implementations include a virtual firewall, an operating system firewall, or a third-party firewall agent.

Notes: The security function associated with this safeguard is Protect. Firewalls are a cybersecurity foundation for many enterprises. With that said, it's never a good idea to put all your eggs in one basket when dealing with cybersecurity. A good analogy is to look at how you defend a castle. You have a mote, high walls, and an inner wall; this represents layers. Good cybersecurity practice is to layer your security, so if one instance of security is breached, you have several other layers to fall back on as protection.

4.5) Implement and Manage a Firewall on End-User Devices

Description: Implement and manage a host-based firewall or port-filtering tool on end-user devices with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed

Notes: The security function associated with this safeguard is Protect. As stated above it safeguard 4.4, firewalls can be the first line of defense against penetration attacks, but it is also good to implement several other cybersecurity defenses on top of an End-Users firewall.

4.6) Securely Manage Enterprise Assets and Software

Description: Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled infrastructure-as-code and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.

Notes: The security function associated with this safeguard is Protect. It is important to use secure and encrypted protocols when managing assets and software. You should also have your software in the latest patches for security benefits. It doesn't matter how secure you think your endpoints are with outdated software; it can leave the door open for potential attacks.

4.7) Manage Default Accounts on Enterprise Assets and Software

Description: Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts. Example implementations can include disabling default accounts or making them unusable.

Notes: The security function associated with this safeguard is Protect. There is no need for an administrator or root account to be active unless there is a need for recovery. Administrative accounts are highly privileged, and if an attacker has access to them, they are now able to create other users; this is why having them either deactivated or, if needed, having a strong, unique password attached.

4.8) Uninstall or Disable Unnecessary Services on Enterprise Assets and Software

Description: Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file-sharing service, web application module, or service function

Notes: The security function associated with this safeguard is Protect. Not all system components and services are needed for functionality. For example, many vulnerabilities have been linked to RDP in its default configuration. There are several improvements that can be made to make RDP more secure, or you can just disable the service.

4.9) Configure Trusted DNS Servers on Enterprise Assets

Description: Configure trusted DNS servers on enterprise assets. Example implementations include configuring assets to use enterprise-controlled DNS servers and/or reputable externally accessible DNS servers.

Notes: The security function associated with this safeguard is Protect. A key component of the internet, DNS, is of vast importance and should be properly secured. There are several frameworks that implement this, one such framework is by SANS Institute for DNS defense. They recommend:

Patches and Latest Builds
Split internal and External DNS
Disable Recursion
Single-Purpose DNS Server
Diverse Location of DNS Servers
Restrict Zone Transfers
Authenticate Zone Transfers
Restrict Dynamic Updates
Restrict Access
Restrict external access to the DNS servers by using queries for clients with public IP addresses.

4.10) Enforce Automatic Device Lockout on Portable End-User Devices

Description: Enforce automatic device lockout following a predetermined threshold of local failed authentication attempts on portable end-user devices where supported. For laptops, do not allow more than 20 failed authentication attempts; for tablets and smartphones, no more than 10 failed authentication attempts. Example implementations include Microsoft® InTune Device Lock and Apple® Configuration Profile maxFailedAttempts.

Notes: The security function associated with this safeguard is Protect. Similar to safeguard 4.3, having a threshold for attempts on local devices is important in helping prevent unauthorized access.

4.11) Enforce Remote Wipe Capability on Portable End-User Devices

Description: Remotely wipe enterprise data from enterprise-owned portable end-user devices when deemed appropriate, such as lost or stolen devices, or when an individual no longer supports the enterprise.

Notes: The security function associated with this safeguard is Protect. This safeguard, I feel, has been more prominent as of late. Remoting wiping of end-user devices has always been around, but with the state of employment, many companies are switching to remote work; thus, company devices are being moved more often. Having the capability to remotely wipe a device if it becomes lost or stolen will keep your company's data more secure.

4.12) Separate Enterprise Workspaces on Mobile End-User Devices

Description: Ensure separate enterprise workspaces are used on mobile end-user devices where supported. Example implementations include using an Apple® Configuration Profile or Android™ Work Profile to separate enterprise applications and data from personal applications and data.

Notes: The security function associated with this safeguard is Protect. Keeping your personal workspace and enterprise workspace separated on your platforms is important because it lowers the risk of attackers being able to leverage what you do with personal usage to access the enterprise network.

Get Foundational Security with the CIS Controls Monitoring

Use CIS Controls to establish solid protection against the most common attacks and use Tripwire to provide coverage for the controls.

Learn More