Cytrax Solutions

On March 6th 2013, the Federal Communications Commission (FCC) released a report entitled Consensus Cyber Security Controls (download here). It provided details into 20 critical security controls organizations should focus on to protect critical information and services. This is beyond any of the past guidelines ever set out by the US government to contain cyber-security threats. What is really driving this is the new trend of government sponsored global cyber espionage, especially between the US and China and the NSA thinks that “the military could not protect the nation if the critical communications, power and financial sectors were not also protected”. While these used to be seen as soft targets, it is now becoming obvious that damage to them can cripple the nation as we become ever so dependent on interconnected sensitive computers.

What’s changing?

Since the year 2000, majority of security controls were primarily driven by need to become compliant. However, over the past few years, the threats are now becoming real as highlighted in Mandiant report with classic example being Stuxnet attack. This is why several government agencies around the world collaborated to worked on the 20 critical security controls list. This included and not limited to NSA, CIA, FBI and the UK’s Communications-Electronics Security Group (CESG).

What we are now seeing is the government now saying that compliance is just not enough especially with China looming large. As a result, they produced an intensive report on holistic approach to ensuring in-depth security is provided for critical asset.

Here are the 20 Critical Security Controls:

20 Critical Security Controls – Version 4.1 - http://www.sans.org/critical-security-controls/

• Critical Control 1: Inventory of Authorized and Unauthorized Devices
• Critical Control 2: Inventory of Authorized and Unauthorized Software
• Critical Control 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
• Critical Control 4: Continuous Vulnerability Assessment and Remediation
• Critical Control 5: Malware Defenses
• Critical Control 6: Application Software Security
• Critical Control 7: Wireless Device Control
• Critical Control 8: Data Recovery Capability
• Critical Control 9: Security Skills Assessment and Appropriate Training to Fill Gaps
• Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
• Critical Control 11: Limitation and Control of Network Ports, Protocols, and Services
• Critical Control 12: Controlled Use of Administrative Privileges
• Critical Control 13: Boundary Defense
• Critical Control 14: Maintenance, Monitoring, and Analysis of Audit Logs
• Critical Control 15: Controlled Access Based on the Need to Know
• Critical Control 16: Account Monitoring and Control
• Critical Control 17: Data Loss Prevention
• Critical Control 18: Incident Response and Management
• Critical Control 19: Secure Network Engineering
• Critical Control 20: Penetration Tests and Red Team Exercises

The real pain of most security controls has come from Advanced Persistent Threats – APT and this was also addressed in the report.

Substantial evidence exists to demonstrate that four low-cost, low-impact “Quick Wins” are effective in blocking the vast majority of the targeted intrusions known as “Advanced Persistent Threat” that have been responsible for the loss of terabytes of sensitive military and commercial intellectual property. Those four quick wins, generally considered to be the highest-impact, lowest cost security controls to protect important information systems, include:2
1) White listing
2) Application patching within 48 hours of patch release3
3) System patching within 48 hours of patch release4
4) Reduction in the number of users with administrative privileges

Conclusion

I have gone through the guidelines  and I have to say that I was very impressed. If organizations can start following each point within the guidelines, we would finally start taking proactive approach when thinking about  protection against cyber security threats. We need to move away from doing enough to pass auditing to doing all that must be done to ensure end-to-end operations are performed through secure channels.