Security Controls

First off, I have to give credit for this find to a class mate in another class I'm taking.  It is a document that I felt just had to be shared further.

This is a document posted by SANS: Critical Controls for Effective Cyber Defense, Version 4.1 

The 20 Critical Security Controls are put together by a team of IT professionals led by John Gilligan.  In their words: "Members of the Consortium include NSA, US Cert, DoD JTF-GNO, the Department of Energy Nuclear Laboratories, Department of State, DoD Cyber Crime Center plus the top commercial forensics experts and pen testers that serve the banking and critical infrastructure communities."

 It is a major effort by both government and private organizations to publish and share information concerning some of the controls put in place to block the biggest threats to IT systems. 

The document describes each control, how exploits occur without the control in place, how to implement each control (including possible automation) and finally how to test the effectiveness of each control.  It also lists what they call "quick wins" of implementing the controls.  The descriptions of each of these controls is very detailed and the testing steps are very detailed as well.

Some of the controls discussed are:

Authorized/unauthorized devices and software
Secure configurations for hardware/software on mobile devices
Secure Configurations for network firewalls, routers, and switches
Boundary defense
Data loss prevention
Controlling access by need to know
Secure network engineering
Penetration testing

This document should be mandatory reading for IT security professionals everywhere.  I guarantee, you won't be disappointed is you check it out!

Until next week--cheers!




Sources:

https://www.sans.org/critical-security-controls/

https://www.sans.org/critical-security-controls/cag4-1.pdf