Solution Provider Poster Sponsors

Through their sponsorship, the technology providers below helped bring this poster to the SANS
community. Sponsorship had no connection with the rankings of product measurement capabilities.

Going Beyond SIEM

CIS Critical Security Controls
Accelerated & Simplified

THE CENTER FOR INTERNET SECURITY (CIS)

C RIT IC AL SEC UR ITY CON TR O LS V6 .0

CSC 19

CSC 20

CSC 1

CSC 2

Incident Response and

Management

Penetration Tests and Red

Team Exercises

Inventory of Authorized and

Unauthorized Devices

Inventory of Authorized and

Unauthorized Software

Protect the organizations information,

as well as its reputation, by developing
and implementing an incident response
infrastructure (e.g., plans, defined roles, training,
communications, management oversight).

Test the overall strength of an

organizations defenses (technology,
processes, and people) by simulating the
objectives and actions of an attacker.

Actively manage (inventory, track, and

correct) all hardware devices on the
network so that only authorized devices
are given access, and unauthorized and
unmanaged devices are identified and
prevented from gaining access.

Actively manage (inventory, track, and

correct) all software on the network so
that only authorized software is installed
and can execute, and unauthorized and
unmanaged software is located and
prevented from installation or execution.

Enterprise-wide, Standards-based Continuous

Monitoring of Automated Security Controls

Maintaining Continuous Compliance

A New Best-Practice Approach

Establish, implement, and actively manage (track,

report on, and correct) the security configuration
of laptops, servers, and workstations using a
rigorous configuration management and change
control process in order to prevent attackers from
exploiting vulnerable services and settings.

Application Software Security

CSC 4

Manage the security lifecycle of all in-house

developed and acquired software in order to
prevent, detect, and correct security weaknesses.

Continuous Vulnerability
Assessment and Remediation
Continuously acquire, assess, and take action
on new information in order to identify
vulnerabilities, and to remediate and minimize
the window of opportunity for attackers.

CSC 17

Security Skills Assessment

and Appropriate Training
to Fill Gaps

The Ransomware Threat:

A How-To Guide on Preparing for and
Detecting an Attack Before Its Too Late

Top 7 Security Controls to Prioritize

Attack Your Attack Surface
How to Reduce Your Exposure to Cyber Attacks
with an Attack Surface Visualization Solution

2016 Internet Security Threat Report

CSC 5

Controlled Use of
Administrative Privileges

Identify the specific knowledge, skills,

and abilities needed to support
defense of the enterprise; develop and
execute an integrated plan to assess,
identify and remediate gaps, through
policy, organizational planning, training,
and awareness programs for all
functional roles in the organization.

Track, control, prevent, and correct the

use, assignment, and configuration of
administrative privileges on computers,
networks, and applications.

CSC 6

CSC 16

Account Monitoring
and Control
Actively manage the lifecycle
of system and application
accounts their creation, use,
dormancy, deletion in order
to minimize opportunities for
attackers to leverage them.

CIS Critical Security Controls:

Technical Control Automation

Products and Strategies for

Continuously Monitoring and
Improving Your Implementation of the
CIS Critical Security Controls
CSCs-Monitoring_v1_7-16

Track, control, prevent, correct,

and secure access to critical
assets (e.g., information, resources,
systems) according to the formal
determination of which persons,
computers, and applications
have a need and right to access
these critical assets based on an
approved classification.

CSC 13

CSC 12

Data Protection

Boundary Defense

Prevent data exfiltration,

mitigate the effects of
exfiltrated data, and
ensure the privacy and
integrity of sensitive
information.

Detect, prevent, and

correct the flow of
information-transferring
networks of different trust
levels with a focus on
security-damaging data.

CSC 11

CSC 10

Secure Configurations for Network Devices

such as Firewalls, Routers, and Switches

Data Recovery
Capability

Establish, implement, and actively manage (track, report on, and

correct) the security configuration of network infrastructure
devices using a rigorous configuration management and change
control process in order to prevent attackers from exploiting
vulnerable services and settings.

Properly back up critical

information with a proven
methodology for timely
recovery.

Defining Continuous Monitoring

National Institute of Standards and Technology (NIST) 800-137 is the U.S.
governments guide to Information Security Continuous Monitoring for Federal
Information Systems and Organizations. It defines continuous monitoring as:
ongoing awareness of information security, vulnerabilities, and threats to
support organizational risk management decisions.The terms continuous
and ongoing in this context mean that security controls and organizational
risks are assessed and analyzed at a frequency sufficient to support riskbased security decisions to adequately protect organization information. Data
collection, no matter how frequent, is performed at discrete intervals.
The SANS simplified version of this is to:

Frequency (FedRAMP) 800-53 Control

CIS Critical Security Control

Continuous and Ongoing

Auditable Events

(6) Maintenance, Monitoring, Analysis of Logs

Component Inventory

(1) Inventory of Devices

Incident Reporting

(19) Incident Response and Management

Vulnerability Scanning

(4) Continuous Vulnerability Assessment & Remediation

Weekly

Audit Review, Report

(6) Maintenance, Monitoring, Analysis of Logs

Monthly

Vulnerability Scanning

(4) Continuous Vulnerability Assessment & Remediation

Securing State Monitoring (6) Maintenance, Monitoring, Analysis of Logs

Flaw Remediation

(3) Secure Configurations

Establish and measure meaningful security metrics

Software/Info Integrity

(2) Software Inventory

Monitor those metrics frequently enough to minimize incident impact

Least Functionality

(9) Limitation & Control of Network Ports, Services

T ake action rapidly, efficiently and effectively to improve overall security

The CIS Critical Security Controls have proven to be an effective starting point for
selecting key security metrics. A frequent question is how frequently is continuous?
NIST 800-137 points to yet another complex document, SP 800-37 Guide for
Applying the Risk Management Framework to Federal Information Systems for a
risk-based methodology for making this decision. But there is an easier way.

1 Inventory of Authorized and

Unauthorized Devices

ID.AM-1

2 Inventory of Authorized and

Unauthorized Software
3 Secure Configuration of
End-User Devices

CSC 9

ID.AM-3

ID.AM-4

ID.AM-2

PR.DS-6

Identify Protect Detect Respond Recover

PR.DS-3

AM
AM
IP

PR.IP-1

4 Continuous Vulnerability
Assessment & Remediation

ID.RA-1 PR.IP-12 DE.CM-8

ID.RA-2

RS.MI-3

5 Controlled Use of
Administrative Privileges

PR.AC-4

PR.PT-3

6 M aintenance, Monitoring, and

Analysis of Audit Logs

PR.PT-1 DE.DP-1 DE.DP-3 DE.DP-5

DE.AE-3 DE.DP-2 DE.DP-4

PR.AT-2

PR.MA-2

RA

9 Limitation & Control of Network

Ports, Protocols, and Service

DE.CM-4
PR.AC-5

10 D ata Recovery Capability

DE.CM-5

PR.AC-5

PR.IP-1

CM

IP

PR.PT-4

PR.AC-5

PR.MA-2 DE.AE-1

13 Data Protection

PR.AC-5

PR.DS-2

PR.DS-5

PR.AC-4
PR.AC-5

PR.DS-1
PR.DS-2

PR.PT-2
PR.PT-2
PR.PT-3

DP
DS
AC

15 W
 ireless Access Control

AC

16 Account Monitoring and Control

17 Security Skills Assessment and
Appropriate Training
18 A pplication Software Security

20 Penetration Tests and

Red Team Exercises

PT

RP

PR.AC-3

Manage (track, control, and correct) the ongoing

operational use of ports, protocols, and services
on networked devices in order to minimize
windows of vulnerability available to attackers.

AN

IP

DE.AE-1

12 B oundary Defense

19 Incident Response and

Management

AE

AC

PR.IP-4

11 Secure Configuration of
Network Devices

Limitation and Control

of Network Ports,
Protocols, and Services

MI

PT

PR.IP-1
PR.PT-2

CM

AC

PR.IP-4
PR.AT-1
PR.AT-2
PR.AC-1

PR.AT-3

PR.AT-4

PR.AC-4

PR.AT-5

CM

AT
IP

PR.PT-3

PR.IP-10 DE.CM-1-7 RS.AN-1-4 RC.RP-1

DE.AE-2 RS.RP-1 RS.MI-1-2 RC.IM-1-2
DE.AE-4 RS.CO-1-5 RS.IM-1-2 RC.CO-1-3
DE.AE-5

AE

RP

IM

IM

Collecting Meaningful Security Data Monitoring the Right Stuff

A simpler approach: The GSA Federal Risk and Authorization Program (FedRAMP) has established
continuous monitoring guidelines for certifying and monitoring cloud services as being secure
enough for unclassified use by federal government agencies. FedRAMP defines which security controls
should be monitored monthly, weekly, or on an ongoing basis (as frequently as possible, or driven
by changes.)

Security monitoring has no value on its own unless it leads to meaningful action to prevent or reduce damage from cyber
attacks. More prevention, faster detection, and more accurate response require measuring different CIS Critical Security
Controls to reduce vulnerabilities, detect and mitigate attacks, and optimize incident response and restoration. SANS has
mapped the Critical Controls across the CyberDefense lifecycle.
C Y B E R

C IS C RI T IC A L
S E C UR I TY
CO N TRO L S

Control the installation, spread, and execution

of malicious code at multiple points in
the enterprise, while optimizing the use of
automation to enable rapid updating of
defense, data gathering, and corrective action.

Cybersecurity Framework (CSF) Core

NIST Core Framework

14 Controlled Access Based on

Need to Know

Malware Defenses

Controlled Access
Based on the
Need to Know

CIS Critical Security Controls

(V6.0)

8 M alware Defense

CSC 8

CSC 14

The chart below maps the Center for Internet Security (CIS) Critical Security Controls (Version 6.0) into the most relevant NIST CSF
(Version 1.0) Core Functions and Categories. If you are using the NIST CSF, the mapping (thanks to James Tarala) lets you use the
Critical Security Controls to prioritize measuring and monitoring the most important core NIST Framework elements.

Collect, manage, and analyze audit

logs of events that could help detect,
understand, or recover from an attack.

Minimize the attack surface and

the opportunities for attackers to
manipulate human behavior through
their interaction with web browsers
and email systems.

Track, control, prevent, and correct

the security use of wireless local
area networks (LANS), access
points, and wireless client systems.

Like all frameworks, the NIST CSF does not specify any priority of security controls or recommend sequences of actions. That
is where the Critical Security Controls shine they map directly to the CSF core requirements and provide a realistic and
community-driven risk management approach for making sure your security program will be both effective and efficient against
real-world threats.

7 E mail and Web Browser

Protections

Email and Web Browser

Protections

Wireless Access Control

In February 2015, the President issued Executive Order (EO) 13636, Improving Critical Infrastructure Cybersecurity, directing National
Institute of Standards and Technology (NIST) to develop a voluntary framework based on existing standards. This has become known
as the NIST Cybersecurity Framework or CSF. At the time this poster was produced (Summer 2016) Version 1.0 was the latest version,
but NIST has announced that revisions based on community comments would be released in 2017.

Maintenance, Monitoring,
and Analysis of Audit Logs

CSC 7

CSC 15

Monitoring and
Measuring the
CIS Critical
Security Controls

CSC 3

Secure Configurations for Hardware

and Software on Mobile Devices,
Laptops, Workstations, and Servers

CSC 18

Securing the Enterprise

The CIS Critical Security Controls Are the

Core of the NIST Cybersecurity Framework

Resource
Hardening
Hardware and Software
Inventory
CSC1 & CSC2

Secure Configurations
CSC3, CSC9, CSC11
& CSC15

Vulnerability Assessment
& Application Security

D E F E N S E

Privilege and
Access Management
Admin Privileges
CSC5

Controlled Access
CSC14

L I F E C YC L E

Attack
Detection/Mitigation
Malware Defenses
CSC7 & CSC8

Boundary Defense

Account Managing
CSC16

CSC4 & CSC18

People and Processes

The Critical Security Controls include a number of security areas that focus
on people and processes and are applicable across the entire lifecycle:

CSC12

Compromise Detection,
Response, Recovery,
and Reporting
Data Recovery
CSC10

Audit
CSC6

Data Protection
CSC13

Incident Response
CSC19

CSC17 Security Skills Assessment and Training

CSC20 Penetration Testing and Red Team Exercises

The values you measure

should include both
quantity and time
how quickly you detect
new misconfigurations,
vulnerabilites, attacks,
etc. is just as important
as how many there
are. Similarly, business
damage is minimized
(and often prevented) if
intrusion detection and
mitigation processes
can move rapidly.

PREVENTION METRICS
What percentage
When did I
When did I
of known attacks
last assess
last update the
am I vulnerable to?
this?
attack list?

TIME
T0 Time attack
entered network
T1 Time attack
detected
T2 Time response
action determined
T3 Time action initiated
REACTION/RESOLUTION
METRICS
How long to detect an incident?
How long to to investigate/resolve?

QUANTITY
Q1 Quantity of
unblocked attacks
Q2 Quantity of
detected attacks
Q3 Quantity of
actions required
Q4 Quantity of
actions initiated

P R O V E N

S O L U T I O N S

T O

Monitor and Measure

T H E

C I S

C R I T I C A L

S E C U R I T Y

C O N T R O L S

CIS CRITICAL SECURITY CONTROLS

SOLUTION PROVIDERS

SANS surveyed industry vendors in

March 2016, using the Center for Internet

Rapid7

Security (CIS) document A Measurement

Splunk

Companion to the CIS Critical Security

Tenable

Controls (Version 6) dated October

2015 as the baseline. The heat map

IBM Big Fix

shaded areas represent totalling the

AlienVault

number of measurements a vendor said

YES to and divided by the total number

Skycure

of measurements listed for that Critical

IBM QRadar

Control. SANS did not independently test

the products. Products change frequently,

Tripwire CCM

and the information represented on this

Imperva

poster is current as of May 2016. Check with

the vendors to get the latest information.

Tripwire Enterprise
Beyond Security

Product Matrix Heat Map Key

Tripwire Connect/SI Hub

Tripwire Log Center
Belarc

100% 99-80% 79-60% 59-40% 39-20% 19-1%

0%

How to use this chart:

There are two factors to keep in mind when
evaluating products for monitoring and
measuring your implementation of the CIS
Critical Security Controls:
1) No single product measures all
sub-controls defined in the CIS Critical
Security Controls.

Skybox Security
Cisco StealthWatch
EIQ Networks
Lumeta
Uplevel Security
Tripwire IP 360
Infoblox

2) Your gap assessment probably found

that you are already using some
security (or IT operations) products to
measure some of the Controls.

Avecto

Driven by your gap assessment and

implementation plan, decide which CIS
Critical Security Controls require enhanced
measuring and monitoring capabilities.

Invincea

Use the Proven Solutions Heat Map to select

those products that cover all or most of
your needs and then evaluate and compare
those products to best meet the security
demands of your business or mission.

FireEye EX

FireEye TAP
HexisCyber
FireEye NX
FireEye IA
FireEye ETP
FireEye HX
FireEye PX

10

11

12

13

14

15

16

17

18

19

20

TOT