The cyber threat landscape is evolving at an astronomical rate; we are living in the age where the four key pillars of cybersecurity – Confidentiality, Integrity, Availability and Assurance of Information systems are no longer considered a nice to have but are a metric for business resilience and operational existence of businesses across the globe.

In this blog we set out to see how choosing the correct security controls framework can go a long way in establishing a secure foundation, which then allows Enterprise security designers/decision makers to make more informed solution choices while selecting the controls and vendor architectures.

Organizations are increasingly finding themselves caught in the “security war of more” where Governance, Risk and Compliance regimes, compounded by vendor solution fragmentation, have resulted in tick-box security. At times this has left organizations with either overlapping security capabilities or completely missing critical security controls. Adversaries continue to take advantage of this industry predicament as depicted by the 4 billion records lost through data breaches and malware attacks in 2019 (Source: Verizon).

In order to win this battle, a structured and homogenous approach must be constructed across the industry. This is where security frameworks come into the picture. Security control frameworks plays a pivotal role that can sit as a foundation across multiple law and compliance regimes to provide key capabilities for an organization. The CIS (Center for Internet Security) CSC (Critical Security Control) framework provides just that — the fundamental underpinnings of a strong organizational cyber defense. This blog is a continuation of the CIS whitepaper published here where we introduce CIS Controls and McAfee product capabilities. CIS CSC provides a path for an organization to get started on its cyber defense program; it provides an option for organizations who do not know where to get started and organizations at mid-maturity level to augment their capabilities to “Optimize and Execute” on their Cybersecurity needs. CIS, provides a list of Critical Security Controls that have been cherry picked to be most effective against most common attacks. It offers layered protection via a defense in depth approach to cybersecurity and has been developed using firsthand experiences of cyber defenders across various industry verticals such as retail, manufacturing, healthcare, government, etc. The CIS CSC controls are based on a risk metric; each control is weighted based on the likelihood and impact of an incident posing a significant threat to an Enterprise. It draws from the foundational elements of risk management and continuous protection by not only protecting against the initial compromise but also looking into detecting and protecting against existing adversary activity within an environment. This offers flexibility for an organization to make a start on CIS CSC implementation irrespective of its security lifecycle.

Architecting Enterprise Cyber Defense with CIS

This section highlights how the CIS controls secure an Enterprise using its layered defense in depth approach moving from the basic controls, which are mostly focused on endpoints, to the Enterprise boundary and then combining it through the People, Process and Technology triad at the organizational level.

McAfee’s Solution Architecture Aligned with CIS CSC Principles

The CSC controls leverage 6 key principles and McAfee solutions & services address these principles effectively

1.Offense Informs Defense 

It considers real world adversary Tactics, Techniques and Procedures (TTP’s) such as the ones used in the MITRE ATT&CK Matrix and establishes controls that have successfully defended against such adversary TTP’s. Thus, each control offers tested capabilities that can be relied upon.

McAfee products such as MVISION EDR, ESM and common threat intelligence services such as GTI are continuously adapting to the latest adversarial tactics to detect and protect against both known and unknown threats and implement the MITRE ATT&CK matrix to analyze and apply context to detected IOC’s. MVISION Insights bring the Enterprise threat landscape into context by providing industry specific intelligence on existing or developing attack campaigns.

2.Prioritization 

Organizations are grappling with a wide variety of attack surfaces as well as challenges around resources, so it is important for any Enterprise to establish priority on its defensive efforts, aka – “We need to contain the fire which has the potential to burn down the house first before saving the garden”

McAfee solution architect teams have access to a wide variety of tools including CIS control assessment capabilities. This allows us to explore customer challenges within their Cloud, Endpoint or Enterprise perimeter and help identify gaps and risks in customer environments. The McAfee Professional Services team can deliver Security Operations (SecOps) maturity assessments and assist customers to develop, fine tune and build their SecOps capabilities. McAfee products also have built in assessment capabilities mapping your Enterprise security maturity to similar industry peers, i.e. the Cloud Security Advisor (CSA) within MVISION Cloud. The CSA allows you to map your cloud security maturity journey with guided recommendations.

3.Metrics 

Any security effort needs to provide clear quantitative and qualitative benefits that allows for Business Owners to understand a business’s cyber risk profile and establishing clear needs and wants. The metrics establish linguistic homogeneity across Business Owners, System Owners and external entities. By scoring the missing and existing controls and processes within an organization a clear security baseline score can be calculated which, in turn, can establish the security maturity of the organization.

• McAfee ePO – Provides several security dashboards that collect metrics from various ePO extensions. ePO Protection Workspace, for example, gives a single pane of glass view across your device to cloud risk and threat metrics. Various built in dashboards further leverage ePO extensions such as Policy Auditor and Application Control for establishing metrics around your software inventory and endpoint system integrity, thus providing metrics around CIS Controls 2 and 5.
• McAfee ESM – Provides content packs that open normalized views of key metrics such as network or endpoint threat events and offers a way to easily visualize risk metrics associated with these assets and closely aligns to metric requirements around CIS 6, 16 and 19.
• McAfee MVISION Cloud – MVISION Cloud provides key metrics around risks across your cloud SaaS, PaaS, IaaS, CaaS , FaaS as well as risks originating from unsanctioned cloud services, thus closely aligning with metric requirements for CIS 1,2,16 and 18 (Refer to CIS and Cloud Infrastructure for further details)

4.Continuous Diagnostics and Mitigation 

Cyber threats are evolving continuously so Cybersecurity should be a continuous effort. Any implementation of security controls requires continuous validation in the context of the business processes, tools and people involved within the organization and CIS controls introduce mechanisms for effective continuous monitoring and risk reduction.

McAfee ePO, ESM, NSP and MVISION platforms, along with various SIA partner solutions, provide continuous monitoring, diagnostics and response capabilities for cyberthreats. For example, our integrated reference architecture for Shadow IT protection uses MVISION Cloud’s shadow IT cloud risk registry to discover potentially risky Enterprise Cloud services and then utilizes service groups to update network defense such as the McAfee Web Gateway, or other 3rd party web filtering solutions, to block and protect users against those services. Similarly, we have integrated reference architectures that provide continuous risk detection and mitigation for Industrial Control Systems (ICS), Phishing , Threat Intelligence based containment and many more, details of which are available through the Cyber Defense architecture workshops.

5.Automation 

Security automation is key in achieving scalability around threat detection, protection and response. Rapidly evolving IT environments such as Cloud and BYOD access require automated monitoring and continuous security event correlation and behavior analysis.

McAfee ESM, MVISION EDR, ATD and TIE, along with a combination of integrations with Threat intelligence platforms such as MISP, ThreatQ and Security orchestration tools such as Swimlane, provide an architecture that can provide adaptive security to a constantly evolving threat landscape.

6.Continuous Risk Mitigation 

The CIS controls can provide the pillars for supporting many of the well-known risk management frameworks such as the NIST RMF as documented in SP800-37.

CIS Controls Within Cloud Infrastructure

This section highlights the mapping and use cases for CIS within the public cloud infrastructure. The CIS controls in context of public, private and hybrid cloud infrastructures are largely applicable; the challenges appear around the shared responsibility model within the public cloud infrastructure, where consumers must relinquish control over the underlying infrastructure and rely upon the Cloud Service Provider (CSP) for securing the infrastructure.

CIS and System Hardening

CIS benchmarks provide guidance on hardening of assets from device to the Cloud across over 140 technologies. These best practice guidelines allow organizations to configure these devices in the most secure configuration possible. The benchmarks also provide several pre-configured tools for baseline configuration analysis and continuous monitoring of the baselines to track any deviations. The CIS CAT tool can be used to perform post implementation analysis for further confirmation and measurements against an organization’s implementation of the CIS controls.