Куда я попал?
Вы попали в сервис, который помогает корпоративным службам безопасности строить свои рабочие процессы:
управление рисками, контроль соответствия требованиям, учет активов,
планирование и сопровождение защитных мер на всем их жизненном цикле, распределение задач и т.д.
Еще SECURITM является платформой для обмена опытом и наработками между участниками сообщества служб безопасности.
Подробнее
Еще SECURITM является платформой для обмена опытом и наработками между участниками сообщества служб безопасности.
Информационные технологии - Методы защиты - Системы менеджмента информационной безопасности - Требования - Приложение А
Международный стандарт ISO № 27001 от 01.10.2013
Для проведения оценки соответствия по документу войдите в систему.
The 20 CIS Controls Resources:
CSC 12.10 Decrypt Network Traffic at Proxy
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However, the organization may use whitelists of allowed sites that can be accessed through the proxy without decrypting the traffic.
Decrypt all encrypted network traffic at the boundary proxy prior to analyzing the content. However, the organization may use whitelists of allowed sites that can be accessed through the proxy without decrypting the traffic.
CSC 13.3 Monitor and Block Unauthorized Network Traffic
Deploy an automated tool on network perimeters that monitors for unauthorized transfer of sensitive information and blocks such transfers while alerting information security professionals.
Deploy an automated tool on network perimeters that monitors for unauthorized transfer of sensitive information and blocks such transfers while alerting information security professionals.
CSC 15.2 Detect Wireless Access Points Connected to the Wired Network
Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access points connected to the wired network.
Configure network vulnerability scanning tools to detect and alert on unauthorized wireless access points connected to the wired network.
CSC 12.8 Deploy NetFlow Collection on Networking Boundary Devices
Enable the collection of NetFlow and logging data on all network boundary devices.
Enable the collection of NetFlow and logging data on all network boundary devices.
CSC 12.6 Deploy Network-Based IDS Sensors
Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization's network boundaries.
Deploy network-based Intrusion Detection Systems (IDS) sensors to look for unusual attack mechanisms and detect compromise of these systems at each of the organization's network boundaries.
CSC 15.10 Create Separate Wireless Network for Personal and Untrusted Devices
Create a separate wireless network for personal or untrusted devices. Enterprise access from this network should be treated as untrusted and filtered and audited accordingly.
Create a separate wireless network for personal or untrusted devices. Enterprise access from this network should be treated as untrusted and filtered and audited accordingly.
CSC 12.1 Maintain an Inventory of Network Boundaries
Maintain an up-to-date inventory of all of the organization's network boundaries.
Maintain an up-to-date inventory of all of the organization's network boundaries.
CSC 9.4 Apply Host-Based Firewalls or Port-Filtering
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.
Apply host-based firewalls or port-filtering tools on end systems, with a default-deny rule that drops all traffic except those services and ports that are explicitly allowed.
CSC 11.2 Document Traffic Configuration Rules
All configuration rules that allow traffic to flow through network devices should be documented in a configuration management system with a specific business reason for each rule, a specific individual’s name responsible for that business need, and an expected duration of the need.
All configuration rules that allow traffic to flow through network devices should be documented in a configuration management system with a specific business reason for each rule, a specific individual’s name responsible for that business need, and an expected duration of the need.
CSC 14.2 Enable Firewall Filtering Between VLANs
Enable firewall filtering between VLANs to ensure that only authorized systems are able to communicate with other systems necessary to fulfill their specific responsibilities.
Enable firewall filtering between VLANs to ensure that only authorized systems are able to communicate with other systems necessary to fulfill their specific responsibilities.
CSC 12.5 Configure Monitoring Systems to Record Network Packets
Configure monitoring systems to record network packets passing through the boundary at each of the organization's network boundaries.
Configure monitoring systems to record network packets passing through the boundary at each of the organization's network boundaries.
CSC 12.9 Deploy Application Layer Filtering Proxy Server
Ensure that all network traffic to or from the Internet passes through an authenticated application layer proxy that is configured to filter unauthorized connections.
Ensure that all network traffic to or from the Internet passes through an authenticated application layer proxy that is configured to filter unauthorized connections.
CSC 9.5 Implement Application Firewalls
Place application firewalls in front of any critical servers to verify and validate the traffic going to the server. Any unauthorized traffic should be blocked and logged.
Place application firewalls in front of any critical servers to verify and validate the traffic going to the server. Any unauthorized traffic should be blocked and logged.
CSC 11.5 Manage Network Devices Using Multi-Factor Authentication and Encrypted Sessions
Manage all network devices using multi-factor authentication and encrypted sessions.
Manage all network devices using multi-factor authentication and encrypted sessions.
CSC 15.7 Leverage the Advanced Encryption Standard (AES) to Encrypt Wireless Data
Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.
Leverage the Advanced Encryption Standard (AES) to encrypt wireless data in transit.
CSC 16.5 Encrypt Transmittal of Username and Authentication Credentials
Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.
Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.
CSC 15.8 Use Wireless Authentication Protocols That Require Mutual, Multi-Factor Authentication
Ensure that wireless networks use authentication protocols such as Extensible Authentication Protocol-Transport Layer Security (EAP/TLS), which requires mutual, multi-factor authentication.
Ensure that wireless networks use authentication protocols such as Extensible Authentication Protocol-Transport Layer Security (EAP/TLS), which requires mutual, multi-factor authentication.
CSC 1.7 Deploy Port Level Access Control
Utilize port level access control, following 802.1x standards, to control which devices can authenticate to the network. The authentication system shall be tied into the hardware asset inventory data to ensure only authorized devices can connect to the network.
Utilize port level access control, following 802.1x standards, to control which devices can authenticate to the network. The authentication system shall be tied into the hardware asset inventory data to ensure only authorized devices can connect to the network.
CSC 12.7 Deploy Network-Based Intrusion Prevention Systems
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each of the organization's network boundaries.
Deploy network-based Intrusion Prevention Systems (IPS) to block malicious network traffic at each of the organization's network boundaries.
CSC 14.3 Disable Workstation to Workstation Communication
Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally and compromise neighboring systems, through technologies such as Private VLANs or micro segmentation.
Disable all workstation-to-workstation communication to limit an attacker's ability to move laterally and compromise neighboring systems, through technologies such as Private VLANs or micro segmentation.
CSC 12.4 Deny Communication Over Unauthorized Ports
Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only authorized protocols are allowed to cross the network boundary in or out of the network at each of the organization's network boundaries.
Deny communication over unauthorized TCP or UDP ports or application traffic to ensure that only authorized protocols are allowed to cross the network boundary in or out of the network at each of the organization's network boundaries.
CSC 12.3 Deny Communications With Known Malicious IP Addresses
Deny communications with known malicious or unused Internet IP addresses and limit access only to trusted and necessary IP address ranges at each of the organization's network boundaries,.
Deny communications with known malicious or unused Internet IP addresses and limit access only to trusted and necessary IP address ranges at each of the organization's network boundaries,.
CSC 9.2 Ensure Only Approved Ports, Protocols, and Services Are Running
Ensure that only network ports, protocols, and services listening on a system with validated business needs are running on each system.
Ensure that only network ports, protocols, and services listening on a system with validated business needs are running on each system.
CSC 11.4 Install the Latest Stable Version of Any Security-Related Updates on All Network Devices
Install the latest stable version of any security-related updates on all network devices.
Install the latest stable version of any security-related updates on all network devices.
CSC 12.2 Scan for Unauthorized Connections Across Trusted Network Boundaries
Perform regular scans from outside each trusted network boundary to detect any unauthorized connections which are accessible across the boundary.
Perform regular scans from outside each trusted network boundary to detect any unauthorized connections which are accessible across the boundary.
CSC 15.3 Use a Wireless Intrusion Detection System
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless access points connected to the network.
Use a wireless intrusion detection system (WIDS) to detect and alert on unauthorized wireless access points connected to the network.
CSC 11.1 Maintain Standard Security Configurations for Network Devices
Maintain documented security configuration standards for all authorized network devices.
Maintain documented security configuration standards for all authorized network devices.
CSC 1.6 Address Unauthorized Assets
Ensure that unauthorized assets are either removed from the network, quarantined, or the inventory is updated in a timely manner.
Ensure that unauthorized assets are either removed from the network, quarantined, or the inventory is updated in a timely manner.
CSC 7.4 Maintain and Enforce Network-Based URL Filters
Enforce network-based URL filters that limit a system's ability to connect to websites not approved by the organization. This filtering shall be enforced for each of the organization's systems, whether they are physically at an organization's facilities or not.
Enforce network-based URL filters that limit a system's ability to connect to websites not approved by the organization. This filtering shall be enforced for each of the organization's systems, whether they are physically at an organization's facilities or not.
CSC 9.3 Perform Regular Automated Port Scans
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports are detected on a system.
Perform automated port scans on a regular basis against all systems and alert if unauthorized ports are detected on a system.
CSC 13.5 Monitor and Detect Any Unauthorized Use of Encryption
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.
Monitor all traffic leaving the organization and detect any unauthorized use of encryption.
CSC 14.4 Encrypt All Sensitive Information in Transit
Encrypt all sensitive information in transit.
Encrypt all sensitive information in transit.
CSC 7.9 Block Unnecessary File Types
Block all email attachments entering the organization's email gateway if the file types are unnecessary for the organization's business.
Block all email attachments entering the organization's email gateway if the file types are unnecessary for the organization's business.
NIST Cybersecurity Framework:
DE.AE-1: A baseline of network operations and expected data flows for users and systems is established and managed
PR.DS-5: Protections against data leaks are implemented
PR.DS-2: Data-in-transit is protected
PR.PT-4: Communications and control networks are protected
PR.AC-3: Remote access is managed
PR.AC-5: Network integrity is protected (e.g., network segregation, network segmentation)
Связанные защитные меры
| Название | Дата | Влияние | ||
|---|---|---|---|---|
|
Community
1
9
/ 13
|
Блокировка доступа к несанкционированным сетевым папкам в локальной сети
Постоянно
Автоматически
Техническая
Превентивная
12.11.2021
|
12.11.2021 | 1 9 / 13 | |
|
Community
1
2
/ 5
|
Ограничение (блокировка) доступа к некорпоративным облачным сервисам
Постоянно
Автоматически
Превентивная
Техническая
09.11.2021
|
09.11.2021 | 1 2 / 5 | |
|
Community
1
2
/ 5
|
Обнаружение записи рабочей информации в некорпоративные облачные сервисы
По событию
Автоматически
Техническая
09.11.2021
|
09.11.2021 | 1 2 / 5 | |
|
Community
3
12
/ 17
|
Выделение периферийного оборудования и IP телефонов в отдельную сеть (сегментация сети)
Разово
Вручную
Техническая
29.07.2021
|
29.07.2021 | 3 12 / 17 | |
|
Community
10
/ 5
|
Проведение тестирования на проникновение
Ежеквартально
Вручную
Техническая
Детективная
02.06.2021
|
02.06.2021 | 10 / 5 |