Home Tags Posts tagged with "expertos en ciberseguridad"

expertos en ciberseguridad

Controles de seguridad CIS ¿Qué son y como debería utilizarlos?

CIS Critical security controls, What are they and how you should use them?


Cybersecurity has an extensive field, and it may seem that many inside the security of the information will never be able to “complete” it, but this no longer has to be the case.

Regardless of the Budget, it may seem impossible for many organizations to protect completely from every attack vectors, and the cyber risk can be challenging. Of course, most organizations have security budgets that are far from limitless. How should we line up its limited security resources for better protection against cyberattacks?

Here is where the CIS controls kicks in, also known as the 20 main CIS security controls.

What are CIS security controls?

CIS controls were created to answer a simple question, “What must a typical organization do to defend against known attacks?”

Controls are a set of 20 better practices measures that organizations can take to protect against cyberattacks. While focusing in a few highly efficient controls, organizations can drastically reduce cyber risks without breaking their budget.

CIS controls are effective for most organizations because they focus on most common attack vectors (the ones with the highest risks). These main threats are identified by some of the most reliable reports in the industry, like the Annual Report of Data Breach investigations from Verizon, and checked by a wide spectrum of cybersecurity experts.

Instead of individual organizations having to interpret and act these trends by themselves, CIS controls provides a guide of better actionable practices on how to protect against recent threats. Each year, controls are updated to reflect most of the important current threats.

CIS controls use for security and compliance

The advantages of CIS security controls are obvious. Controls represents the path of less resistance to protect against the most common cyber threats. Nevertheless, controls also have a great benefit for any organization that must comply with the industry framework. Why?, because for most, if not everyone, of the main compliances framework are closely lined up to CIS controls, as well as CIS reference points.

As a result, lining up with CIS resources can be considered a top priority for any organization that needs to minimize cyber risks while keeping compliance.

0 comment
0 FacebookTwitterPinterestLinkedinTumblrRedditStumbleuponWhatsappTelegramLINEEmail
Cómo reducir su superficie de ataque con el endurecimiento del sistema

How to reduce your attack surface with system hardening


In most cases, new digital assets such as servers and operative systems, comes in a non configured status. When you install an asset, everything is predetermined. All the app services are activated and all the ports are open. At the same time, mosto f the new assetsare not completely updated, they often require multiple software and firmware updates. Here is where the System hardening comes in.

System hardening is the process of configuring an asset according to the top security practices to reduce it’s vulnerability from cyberattacks. The process means to reduce the “surface attack” of the asset, disabling services, user accounts and unnecessary ports.

The purpose of System hardening is simple. The less the Surface attack of an asset is, that is to say less points of entry, the harder will be for a hacker to obtain a unauthorized access.

Establishment of a system reinforcement baseline

One of the most important steps in system hardening is to establish a baseline. This requires an initial evaluation of the “hardness” of the system in front of an established better practice frame.

In a recent publishing, we discussed about the function and importance of reference points from Center for Internet Security (CIS). The reference points of CIS are a set of configuration standards for better practices developed in consensus with a wide range of cybersecurity experts.

With over 100 comparable evaluations avalilable for a wide range of common commercial technologies the CIS comparable evaluations are the worldwide accepted standard for secure configuration. This makes them an ideal option for system hardening.

A baseline identification requires a manual evaluations or assisted by assets and system solutions to see how close they line up with relevant CIS reference points. This initial evaluation, along with clear documentation of any area in which the configuration does not reach a reference point, becomes a baseline.

Why is System hardening so important?

The system reinforcement is an essential function both for security and compliance.

From a security point of view, System hardening is an essential precursor of protective technologies like firewalls and EDR’s. If a system is not reinforced enough, meaning that is not configured and kept according to the best cybersecurity practices, it will never be safe, no matter how much you spend on cybersecurity technologies.

Make sure that every system stay “hardened” at all times by providing an alert and a clear remediation guide each time there is a non-compliance problem.

0 comment
0 FacebookTwitterPinterestLinkedinTumblrRedditStumbleuponWhatsappTelegramLINEEmail