A couple days ago, The SANS Institute announced the release of a major update (Version 3.0) to the 20 Critical Controls, a prioritized baseline of information security measures designed to provide continuous monitoring to better protect government and commercial computers and networks from cyber attacks. The information security threat landscape is always changing, especially this year with the well publicized breaches. The particular controls have been tested and provide an effective solution to defending against cyber-attacks. The focus is critical technical areas than can help an organization prioritize efforts to protect against the most common and dangerous attacks. Automating security controls is another key area, to help gauge and improve the security posture of an organization.
The update takes into account the information gleaned from law enforcement agencies, forensics experts and penetration testers who have analyzed the various methods of attack. SANS outlines the controls that would have prevented those attacks from being successful. Version 3.0 was developed to take the control framework to the next level. They have realigned the 20 controls and the associated sub-controls based on the current technology and threat environment, including the new threat vectors. Sub-controls have been added to assist with rapid detection and prevention of attacks. The 20 Controls have been aligned to the NSA’s Associated Manageable Network Plan Revision 2.0 Milestones. They have added definitions, guidelines and proposed scoring criteria to evaluate tools for their ability to satisfy the requirements of each of the 20 Controls. Lastly, they have mapped the findings of the Australian Government Department of Defence, which produced the Top 35 Key Mitigation Strategies, to the 20 Controls, providing measures to help reduce the impact of attacks.
The 20 Critical Security Controls are:
- Inventory of Authorized and Unauthorized Devices
- Inventory of Authorized and Unauthorized Software
- Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers
- Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
- Boundary Defense
- Maintenance, Monitoring, and Analysis of Security Audit Logs
- Application Software Security
- Controlled Use of Administrative Privileges
- Controlled Access Based on the Need to Know
- Continuous Vulnerability Assessment and Remediation
- Account Monitoring and Control
- Malware Defenses
- Limitation and Control of Network Ports, Protocols, and Services
- Wireless Device Control
- Data Loss Prevention
- Secure Network Engineering
- Penetration Tests and Red Team Exercises
- Incident Response Capability
- Data Recovery Capability
- Security Skills Assessment and Appropriate Training to Fill Gaps
And of course, F5 has solutions that can help with most, if not all, the 20 Critical Controls.
ps
Resources:
Technorati Tags: F5, SANS, integration, cloud computing, Pete Silva, security, business, education, technology, application delivery, cloud, context-aware, infrastructure 2.0, web, internet
| Connect with Peter: | Connect with F5: |
![o_linkedin[1]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_toXiUOt73l3RCU_bWjeA6AryxI36atFRl-xeu4F6dyAY2Z6oPYdRb_7iqNzoxMABmQsK3tNKH-BRDWtuZTAB4Y4wQww4IKnKnm5WBqKAn-SZ5VLddBVnRQT1lDDEaKvcnRLXuDzt1GRaoWLtLPjYeTmj9L3BN1qp4DOtUKCfZ-boudNDMu=s0-d "o_linkedin[1]") ![o_rss[1]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tEK12ih8gWjWPmVYe6otMrkh4gpCmesrhVHbJIazq_aHhEPNtix-DiupaQO2bzMFIX9yXJ4JmQB8iwmhJhLink0T4synO5tV1E_VcYuzwDJxtoUfBDa8h2-rnYYj7Z2AyI8uXQcsZZ6bhwqwZvoyx3bphmgOm8zziX5U5jpitfrg=s0-d "o_rss[1]") ![o_facebook[1]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uIHK9-WyL9VZrhP2eil_MkvB-oboIWVzPrMQQOxE-m4tXpWrHjm3OkiVgvseTY20RmialSQQcgpDjhmJSzCOeGRgpSnbs-j1Jmc4r2YpN43AsFOpoyB-32CbfXfL7KrPvsT3T7vOAhQW8YqOi4PsEvsakGccpW0wI3MZznQP4DKm2GCE8=s0-d "o_facebook[1]") ![o_twitter[1]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vGI8CjqU465VpW-2N_KEP8EUQ021Qj19b8BsVmgJ5jzMFYz5FB54O07_iGUmv4yiizauypHje3Z9f-MIl0lUYeEBSoyo_tW5bnYblXWswSCOvelbrXyyKoMGKwffkc-nvl2U5ObDe98UZeyaykFuJDV4wAZFHNvnq5zOBRhzvCpq_vS_0=s0-d "o_twitter[1]") | ![o_slideshare[1]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uBouNy3YsPZbZfJX7jm3EewaUXwz-aVoR67PqkVNA_OqZWzdLMysSlpboAYq3mVSojp5GQkANbKMcvujpeDwZPWnJzyJuaiIr3rloyCorDwRgss5BmrwlowytgRywkLPhYOxZaOeA3MkBOJBAWDLSizcziceHYoeSg2YB58x0UTNLbBFPccZ8=s0-d "o_slideshare[1]") ![o_youtube[1]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v2LRTkGpkAGqetI5Hzxt-HUzJKyzJ3ixUampZyHuxU_QWbl5FMbPPMwkkUuP-jqi8T5_XsNnux1T3S7pLVovJELbf--WQcAopkumNq9Vx-kQIlSS5JufakUTZ42CA7zIFWftsFmoqZMwc90KLn0STw4ayubJ4zu6xGXlJvzVuxfnBmfw=s0-d "o_youtube[1]") |
