CSC 5: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

Establish, implement, and actively manage (track, report on, correct) the security configuration of mobile devices, laptops, servers, and workstations using a rigorous configuration management and change control process in order to prevent attackers from exploiting vulnerable services and settings.

Why is this control critical?

As delivered by manufacturers and resellers, the default configurations for operating systems and applications are normally geared towards ease-of-deployment and ease-of-use – not security. Basic controls, open services and ports, default accounts or passwords, older (vulnerable) protocols, and pre-installation of unneeded software can be exploitable in their default state. Developing configuration settings with good security properties is a complex task beyond the ability of individual users, requiring analysis of potentially hundreds or thousands of options in order to make good choices (the Procedures and Tools section below provides resources for secure configurations). Even if a strong initial configuration is developed and installed, it must be continually managed to avoid security “decay” as software is updated or patched, new security vulnerabilities are reported, and configurations are “tweaked” to allow the installation of new software or support new operational requirements. If not, attackers will find opportunities to exploit both network accessible services and client software.

Who should deploy this control?

Answer: Everyone

The Center for Internet Security has broken down all of the Critical Security Controls in a way that allows organizations of all types to implement the security defenses that are right for them.

Before we dig into the details of CIS CSC 4 let's quickly explore the CSC Implementation Groups.

Implementation Groups

CIS-Controls-IG-061719-1

Control Details

Sub-Control Security Function

output-onlinepngtools (1)

IG1

output-onlinepngtools (3)

IG2

output-onlinepngtools (2)

IG3

 NIST CSF
5.1 Protect ⬤ ⬤ ⬤ PR.IP-1
 

Establish Secure Configurations

Maintain documented, standard security configuration standards for all authorized operating systems and software.
5.2 Protect   ⬤ ⬤ PR.IP-1
 

Maintain Secure Images

Maintain secure images or templates for all systems in the enterprise based on the organization's approved configuration standards. Any new system deployment or existing system that becomes compromised should be imaged using one of those images or templates.
5.3 Protect   ⬤ ⬤ PR.IP-1
 

Securely Store Master Images

Store the master images and templates on securely configured servers, validated with integrity monitoring tools, to ensure that only authorized changes to the images are possible.
5.4 Protect   ⬤ ⬤  
 

Deploy System Configuration Management Tools

Deploy system configuration management tools that will automatically enforce and redeploy configuration settings to systems at regularly scheduled intervals.
5.5 Detect   ⬤ ⬤ DE.CM-8
 

Implement Automated Configuration Monitoring Systems

Utilize a Security Content Automation Protocol (SCAP) compliant configuration monitoring system to verify all security configuration elements, catalog approved exceptions, and alert when unauthorized changes occur.

Procedures and Tools

Rather than start from scratch developing a security baseline for each software system, organizations should start from publicly developed, vetted, and supported security benchmarks, security guides, or checklists. Excellent resources include:
  • The CIS Benchmarks™ Program (https://www.cisecurity.org/cis-benchmarks/)
  • The NIST National Checklist Program (https://nvd.nist.gov/ncp/repository)
Organizations should augment or adjust these baselines to satisfy local policies and requirements, but deviations and rationale should be documented to facilitate later reviews or audits. For a complex enterprise, the establishment of a single security baseline configuration (for example, a single installation image for all workstations across the entire enterprise) is sometimes not practical or deemed unacceptable. It is likely that you will need to support different standardized images, based on the proper hardening to address risks and needed functionality of the intended deployment. For example, a web server in the demilitarized zone (DMZ) versus an email or other application server in the internal network. The number of variations should be kept to a minimum in order to better understand and manage the security properties of each, but organizations then must be prepared to manage multiple baselines. Commercial and/or free configuration management tools can then be employed to measure the settings of operating systems and applications of managed machines to look for deviations from the standard image configurations. Typical configuration management tools use some combination of an agent installed on each managed system, or agentless inspection of systems by remotely logging in to each managed machine using administrator credentials. Additionally, a hybrid approach is sometimes used whereby a remote session is initiated, a temporary or dynamic agent is deployed on the target system for the scan, and then the agent is removed.

System Entity Relationship Diagram

Screen Shot 2019-11-20 at 1.02.03 PM

About the CIS Controls

The CIS Controls™ are a prioritized set of actions that collectively form a defense-in-depth set of best practices that mitigate the most common attacks against systems and networks. 

CIS holds trademarks and copyright on all control materials however the controls are free to use in your organization and can be downloaded directly from CIS at:

https://www.cisecurity.org/controls/

Last updated 2020-1-31.

How FortMesa Works

FortMesa Diagram (3)

FortMesa combines data from your systems with security best practices into a comprehensive security architecture, then tasks individuals with action.

Try it free 7-day free trial.

 

Learn more about CIS Critical Security Controls

and other cybersecurity knowledge:

🕮 View Resource Library