Download Consensus Audit Guidelines - Draft 1.0
Twenty Most Important Controls and Metrics for Effective Cyber Defense and Continuous FISMA Compliance
Securing our Nation against cyber attacks has become one of the Nation's highest priorities. To achieve this objective, networks, systems, and the operations teams that support them must vigorously defend against external attacks. Furthermore, for those external attacks that are successful, defenses must be capable of thwarting, detecting, and responding to follow-on attacks on internal networks as attackers spread inside a compromised network.
A central tenet of the US Comprehensive National Cybersecurity Initiative (CNCI) is that "offense must inform defense". In other words, knowledge of actual attacks that have compromised systems provides the essential foundation on which to construct effective defenses. The US Senate Homeland Security and Government Affairs Committee moved to make this same tenet central to the Federal Information Security Management Act in drafting FISMA 2008. That new proposed legislation calls upon Federal agencies to:
"Establish security control testing protocols that ensure that the information infrastructure of the agency, including contractor information systems operating on behalf of the agency, are effectively protected against known vulnerabilities, attacks, and exploitations."
Consensus Audit Guidelines Draft 1.0
* Consensus Audit Guidelines - Introduction (Draft 1.0)
* Critical Control 1: Inventory of authorized and unauthorized hardware.
* Critical Control 2: Inventory of authorized and unauthorized software; enforcement of white lists of authorized software.
* Critical Control 3: Secure configurations for hardware and software on laptops, workstations, and servers.
* Critical Control 4: Secure configurations of network devices such as firewalls, routers, and switches.
* Critical Control 5: Boundary Defense
* Critical Control 6: Maintenance, Monitoring and Analysis of Complete Audit Logs
* Critical Control 7: Application Software Security
* Critical Control 8: Controlled Use of Administrative Privileges
* Critical Control 9: Controlled Access Based On Need to Know
* Critical Control 10: Continuous Vulnerability Testing and Remediation
* Critical Control 11: Dormant Account Monitoring and Control
* Critical Control 12: Anti-Malware Defenses
* Critical Control 13: Limitation and Control of Ports, Protocols and Services
* Critical Control 14: Wireless Device Control
* Critical Control 15: Data Leakage Protection
* Critical Control 16: Secure Network Engineering
* Critical Control 17: Red Team Exercises
* Critical Control 18: Incident Response Capability
* Critical Control 19: Data Recovery Capability
* Critical Control 20: Security Skills Assessment and Appropriate Training To Fill Gaps
