Refer to the following Vulnerability Management & Security Hygiene insights and assessments and how they're mapped to CIS v7 and CIS v8 controls for Control Insights :
Confirmed Vulnerabilities Detected confirmed vulnerabilities were not fixed for over one month. This indicates that continuous vulnerability management is ineffective and may be failing
The ratio of events of type [Confirmed Vulnerability in Exposed Third Party Product] present for at least 1 month(s) by type [Open Port] is above 10.0%
Assessment
Observations
CIS v8 Controls
CIS v7 Controls
Controls
7 Continuous Vulnerability Management
17 Incident Response Management
18 Penetration Testing
Safeguards
7.1 Establish and Maintain a Vulnerability Management Process
7.2 Establish and Maintain a Remediation Process
7.3 Perform Automated Operating System Patch Management
7.4 Perform Automated Application Patch Management
7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets
7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets
7.7 Remediate Detected Vulnerabilities
17.1 Designate Personnel to Manage Incident Handling
17.2 Establish and Maintain Contact Information for Reporting Security Incidents
17.3 Establish and Maintain an Enterprise Process for Reporting Incidents
17.4 Establish and Maintain an Incident Response Process
17.6 Define Mechanisms for Communicating During Incident Response
18.1 Establish and Maintain a Penetration Testing Program
18.2 Perform Periodic External Penetration Tests
18.3 Remediate Penetration Test Findings
18.4 Validate Security Measures
18.5 Perform Periodic Internal Penetration Tests
Controls
33 Continuous Vulnerability Management
19 Incident Response and Management
20 Penetration Tests and Red Team Exercises
Safeguards:
3.1 Run Automated Vulnerability Scanning Tools
3.2 Perform Authenticated Vulnerability Scanning
3.4 Deploy Automated Operating System Patch Management Tools
3.5 Deploy Automated Software Patch Management Tools
19.1 Document Incident Response Procedures
19.2 Assign Job Titles and Duties for Incident Response
19.3 Designate Management Personnel to Support Incident Handling
19.5 Maintain Contact Information For Reporting Security Incidents
20.1 Establish a Penetration Testing Program
20.2 Conduct Regular External and Internal Penetration Tests
20.3 Perform Periodic Red Team Exercises
20.4 Include Tests for Presence of Unprotected System Information and Artifacts
20.5 Create Test Bed for Elements Not Typically Tested in Production
20.6 Use Vulnerability Scanning and Penetration Testing Tools in Concert
No Confirmed Vulnerabilities for 1 Month The lack of confirmed vulnerabilities for over a month indicates effective continuous vulnerability management.
The ratio of events of type [Confirmed Vulnerability in Exposed Third Party Product] present for at least 1 month(s) by type [Open Port] is below 2.5%
Assessment
Observations
CIS v8 Controls
CIS v7 Controls
Controls
7 Continuous Vulnerability Management
17 Incident Response Management
18 Penetration Testing
Safeguards
7.1 Establish and Maintain a Vulnerability Management Process
7.2 Establish and Maintain a Remediation Process
7.3 Perform Automated Operating System Patch Management
7.4 Perform Automated Application Patch Management
7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets
7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets
7.7 Remediate Detected Vulnerabilities
17.1 Designate Personnel to Manage Incident Handling
17.2 Establish and Maintain Contact Information for Reporting Security Incidents
17.3 Establish and Maintain an Enterprise Process for Reporting Incidents
17.4 Establish and Maintain an Incident Response Process
17.6 Define Mechanisms for Communicating During Incident Response
18.1 Establish and Maintain a Penetration Testing Program
18.2 Perform Periodic External Penetration Tests
18.3 Remediate Penetration Test Findings
18.4 Validate Security Measures
18.5 Perform Periodic Internal Penetration Tests
Controls
3 Continuous Vulnerability Management
19 Incident Response and Management
20 Penetration Tests and Red Team Exercises
Safeguards
3.1 Run Automated Vulnerability Scanning Tools
3.4 Deploy Automated Operating System Patch Management Tools
3.5 Deploy Automated Software Patch Management Tools
19.1 Document Incident Response Procedures
19.2 Assign Job Titles and Duties for Incident Response
19.3 Designate Management Personnel to Support Incident Handling
19.4 Devise Organization-wide Standards for Reporting Incidents
19.5 Maintain Contact Information For Reporting Security Incidents
19.7 Conduct Periodic Incident Scenario Sessions for Personnel
19.8 Create Incident Scoring and Prioritization Schema
20.1 Establish a Penetration Testing Program
20.2 Conduct Regular External and Internal Penetration Tests
20.3 Perform Periodic Red Team Exercises
20.6 Use Vulnerability Scanning and Penetration Testing Tools in Concert
Poor Security Hygiene The lack of basic security hygiene issues indicates effective processes to detect, respond, and remediate security issues are in place
The ratio of events of type [Cleartext Credential Transmission, Inadvisable Service Exposed on Open Port, Unnecessarily Exposed Port, Unauthenticated Service] by type [Open Port] is below 1.0%
Assessment
Observations
CIS v8 Controls
CIS v7 Controls
Controls
7 Continuous Vulnerability Management
17 Incident Response Management
18 Penetration Testing
Safeguards
7.1 Establish and Maintain a Vulnerability Management Process
7.2 Establish and Maintain a Remediation Process
7.3 Perform Automated Operating System Patch Management
7.4 Perform Automated Application Patch Management
7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets
7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets
7.7 Remediate Detected Vulnerabilities
17.1 Designate Personnel to Manage Incident Handling
17.2 Establish and Maintain Contact Information for Reporting Security Incidents
17.3 Establish and Maintain an Enterprise Process for Reporting Incidents
17.4 Establish and Maintain an Incident Response Process
17.6 Define Mechanisms for Communicating During Incident Response
18.1 Establish and Maintain a Penetration Testing Program
18.2 Perform Periodic External Penetration Tests
18.3 Remediate Penetration Test Findings
18.4 Validate Security Measures
18.5 Perform Periodic Internal Penetration Tests
Controls
3 Continuous Vulnerability Management
19 Incident Response and Management
20 Penetration Tests and Red Team Exercises
Safeguards
3.1 Run Automated Vulnerability Scanning Tools
3.2 Perform Authenticated Vulnerability Scanning
3.4 Deploy Automated Operating System Patch Management Tools
3.5 Deploy Automated Software Patch Management Tools
3.7 Utilize a Risk-Rating Process
19.1 Document Incident Response Procedures
19.2 Assign Job Titles and Duties for Incident Response
19.3 Designate Management Personnel to Support Incident Handling
19.4 Devise Organization-wide Standards for Reporting Incidents
19.5 Maintain Contact Information For Reporting Security Incidents
20.1 Establish a Penetration Testing Program
20.2 Conduct Regular External and Internal Penetration Tests
20.3 Perform Periodic Red Team Exercises
20.4 Include Tests for Presence of Unprotected System Information and Artifacts
20.5 Create Test Bed for Elements Not Typically Tested in Production
20.6 Use Vulnerability Scanning and Penetration Testing Tools in Concert
20.7 Ensure Results from Penetration Test are Documented Using Open, Machine-readable Standards
20.8 Control and Monitor Accounts Associated with Penetration Testing
No Vulnerabilities in Network Devices The lack of vulnerabilities in network devices indicates effective control, patching, and mismanagement of network devices.
The fraction of endpoints from category [Networking Device] detected with [Confirmed Vulnerability in Exposed Third Party Product] is above 1.0%
Assessment
Observations
CIS v8 Controls
CIS v7 Controls
Controls
4 Secure Configuration of Enterprise Assets and Software
12 Network Infrastructure Management
Safeguards
12.1 Ensure Network Infrastructure is Up-to-Date
12.2 Establish and Maintain a Secure Network Architecture
12.3 Securely Manage Network Infrastructure
Controls
11 Secure Configuration for Network Devices, such as Firewalls, Routers and Switches
Safeguards
11.1 Maintain Standard Security Configurations for Network Devices
11.2 Document Traffic Configuration Rules
11.3 Use Automated Tools to Verify Standard Device Configurations and Detect Changes
11.4 Install the Latest Stable Version of Any Security-Related Updates on All Network Devices
11.5 Manage Network Devices Using Multi-Factor Authentication and Encrypted Sessions
11.6 Use Dedicated Machines For All Network Administrative Tasks
11.7 Manage Network Infrastructure Through a Dedicated Network
Basic Security Hygiene Issues The presence of basic security hygiene issues indicates the processes to detect, respond, and remediate security issues are ineffective and may be failing.
The ratio of events of type [Cleartext Credential Transmission, Inadvisable Service Exposed on Open Port, Unnecessarily Exposed Port, Unauthenticated Service] by type [Open Port] is above 2.0%
Assessment
Observations
CIS v8 Controls
CIS v7 Controls
Controls
7 Continuous Vulnerability Management
17 Incident Response Management
18 Penetration Testing
Safeguards
7.1 Establish and Maintain a Vulnerability Management Process
7.2 Establish and Maintain a Remediation Process
7.3 Perform Automated Operating System Patch Management
7.4 Perform Automated Application Patch Management
7.5 Perform Automated Vulnerability Scans of Internal Enterprise Assets
7.6 Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets
7.7 Remediate Detected Vulnerabilities
17.1 Designate Personnel to Manage Incident Handling
17.2 Establish and Maintain Contact Information for Reporting Security Incidents
17.3 Establish and Maintain an Enterprise Process for Reporting Incidents
17.4 Establish and Maintain an Incident Response Process
17.6 Define Mechanisms for Communicating During Incident Response
18.1 Establish and Maintain a Penetration Testing Program
18.2 Perform Periodic External Penetration Tests
18.3 Remediate Penetration Test Findings
18.4 Validate Security Measures
18.5 Perform Periodic Internal Penetration Tests
Controls
3 Continuous Vulnerability Management
19 Incident Response and Management
20 Penetration Tests and Red Team Exercises
Safeguards
3.1 Run Automated Vulnerability Scanning Tools
3.2 Perform Authenticated Vulnerability Scanning
3.3 Protect Dedicated Assessment Accounts
3.4 Deploy Automated Operating System Patch Management Tools
3.5 Deploy Automated Software Patch Management Tools
3.7 Utilize a Risk-Rating Process
19.1 Document Incident Response Procedures
19.2 Assign Job Titles and Duties for Incident Response
19.3 Designate Management Personnel to Support Incident Handling
19.4 Devise Organization-wide Standards for Reporting Incidents
19.5 Maintain Contact Information For Reporting Security Incidents
20.1 Establish a Penetration Testing Program
20.2 Conduct Regular External and Internal Penetration Tests
20.3 Perform Periodic Red Team Exercises
20.4 Include Tests for Presence of Unprotected System Information and Artifacts
20.6 Use Vulnerability Scanning and Penetration Testing Tools in Concert
Vulnerabilities in Network Devices The presence of vulnerabilities in network devices indicates ineffective control, patching, and mismanagement of network devices
The fraction of endpoints from category [Networking Device] detected with [Confirmed Vulnerability in Exposed Third Party Product] is above 5.0%
Assessment
Observations
CIS v8 Controls
CIS v7 Controls
Controls
4 Secure Configuration of Enterprise Assets and Software
12 Network Infrastructure Management
Safeguards
12.1 Ensure Network Infrastructure is Up-to-Date
12.2 Establish and Maintain a Secure Network Architecture
12.3 Securely Manage Network Infrastructure
Controls
11 Secure Configuration for Network Devices, such as Firewalls, Routers and Switches
Safeguards
11.1 Maintain Standard Security Configurations for Network Devices
11.2 Document Traffic Configuration Rules
11.3 Use Automated Tools to Verify Standard Device Configurations and Detect Changes
11.4 Install the Latest Stable Version of Any Security-Related Updates on All Network Devices
11.5 Manage Network Devices Using Multi-Factor Authentication and Encrypted Sessions
11.6 Use Dedicated Machines For All Network Administrative Tasks
11.7 Manage Network Infrastructure Through a Dedicated Network
April 1, 2025: Published.
Comments
Please sign in to leave a comment.