How CIS Helps Ensure Cybersecurity for the Larger Ecosystem
It's October once again, and you know what that means – it's Cybersecurity Awareness Month! The theme for this year's campaign is "See Yourself in Cyber." Cybersecurity is all about people, according to the Cybersecurity & Infrastructure Security Agency (CISA). Everyone can take simple steps to strengthen their cybersecurity posture at work, home, and school. They can also share these steps with others to foster discussions around cybersecurity more broadly.
Creating Confidence in the Connected World
Participating in Cybersecurity Awareness Month holds special significance for the Center for Internet Security (CIS). As a community-driven nonprofit, we're committed to creating confidence in the connected world through a variety of tools and best practices. Here are five CIS resources that our experts would like to call out for this year's Cybersecurity Awareness Month.
Eugene Kipniss
Director of Strategic Enablement
The Nationwide Cybersecurity Review (NCSR) allows U.S. State, Local, Tribal, and Territorial (SLTT) governments to measure and track their cybersecurity maturity year over year. This no-cost self-assessment is based on the NIST Cybersecurity Framework. It provides reporting that allows organizations to compare their maturity to similar peers in an anonymized fashion as well as to identify areas of high priority and basic cybersecurity that need to be improved. The results are also available in a format that maps maturity scores to available low- and no-cost resources. The SLTT community can use these capabilities to better understand areas where they need to improve their cybersecurity maturity and how they can approach those improvements.
Adam Montville
Chief Product Architect
The CIS SecureSuite API accelerates the adoption of CIS Benchmarks for our product vendors so that the latest content is available on day one. On the same day that a CIS Benchmark is published, its content becomes available to our entire Membership in a variety of formats. Many of these include machine-readable formats that can be applied in the organization immediately. We are working to shorten the amount of time it takes for policy to be applied in the organization.
Phyllis Lee
Sr. Director, CIS Critical Security Controls
The CIS Critical Security Controls (CIS Controls) are a prioritized set of activities that enterprises can perform on their networks to defend against top threats. What we offer is not just a list of best cybersecurity practices – it’s about the ecosystem around the CIS Controls to help all enterprises, regardless of size, implement a cybersecurity program. Towards this end, we provide guidance for implementing the CIS Controls that shows compliance against other frameworks. We also offer tools to measure your implementation.
Aaron Piper
Sr. Cybersecurity Engineer, CIS Critical Security Controls
The CIS Controls Self Assessment Tool (CIS CSAT) enables organizations to work as a team to assess how well they are implementing the CIS Safeguards by Implementation Group and/or by selecting which CIS Controls/Safeguards apply to them. CSAT helps organizations apply resources where they are needed most by identifying specific areas that need improvement and tracking their progress over time as they enhance their cybersecurity. Other features such as the ability to upload evidence and policy files to each CIS Safeguard, view summary graphs and statistics on an assessment dashboard, export assessment slides and spreadsheets, scope which CIS Safeguards are in your assessment, see industry averages, and view mappings to other frameworks all help save time over more manual assessment methods such as spreadsheets.
Randy Rose
Sr. Director of Security Operations & Intel
My teams help ensure cybersecurity for the larger ecosystem through proactive and real-time cybersecurity defense and incident response. My organization has five teams: Cyber Threat Intelligence (CTI), Cyber Threat Liaison (CTL), Security Operations Center (SOC), Cyber Incident Response Team (CIRT), and the Vulnerability Management Program (VMP). CTI studies threat actors, specifically their intent and capabilities. They use this analysis to identify patterns in their behavior and make recommendations proactively so the nation’s SLTT governments can defend themselves going forward. CTL works with our federal partners at CISA to translate SLTT priorities up and federal priorities down as well as conduct analysis of potential incidents in SLTT environments based on information derived from classified sources. Our SOC is a 24x7x365 real-time incident monitoring and communications center that watches network and host traffic as well as notifies entities of potential intrusions as they occur. CIRT provides post-mortem support, including incident response, digital forensics, log analysis, and malware analysis, for entities that have suffered an incident and that need help mitigating and recovering. And finally, VMP helps organizations proactively identify weaknesses in their environment and conduct network penetration assessments to test the security and make recommendations on improving defenses.
Cybersecurity Awareness Month...Every Month
Through the use of NCSR, the CIS SecureSuite API, the CIS Controls, and the security operations & intel teams operating under Randy Rose, organizations can prioritize their cybersecurity for Cybersecurity Awareness Month. Using those and other CIS resources, organizations can then review and grow their cybersecurity maturity over time. Doing so will lay a foundation for practicing cybersecurity continuously and effectively celebrating Cybersecurity Awareness Month every month.
