Assignment Prompt & Instructions
see attached.
**files (2)**
– ## I.docx
– ## UnitV.pdf
**## I.docx**
You are the security manager for a newly established organization. The chief executive officer (CEO) knows about the six basic CIS controls and wants to know which of the six controls you would establish first. Discuss which of these basic controls you would implement first and why.
**## UnitV.pdf**
SEC 4320, IS Security Capstone 1
Course Learning Outcomes for Unit V
Upon completion of this unit, students should be able to:
1. Compile a vulnerability assessment using the current security posture.
1.1 Integrate the critical security controls into an organization assessment.
4. Propose a security plan for a project solution.
4.1 Prioritize the critical security controls according to the needs of the organization.
5. Construct preventative measures to ensure critical assets are secure.
5.1 Classify the critical security controls utilizing a risk assessment matrix.
Required Unit Resources
In order to access the following resources, click the links below.
Allodi, L., & Massacci, F. (2017, August). Security events and vulnerability data for cybersecurity risk
estimation. Risk Analysis, 37(8), 1606–1627.
https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?dire
ct=true&db=bsu&AN=124586639&site=ehost-live&scope=site
Woods. D., Agrafiotis, I, Nurse, J. R., & Creese, S. (2017). Mapping the coverage of security controls in cyber
insurance proposal forms. Journal of Internet Services and Applications.
https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1
A transcript and closed captioning are available for both videos below once you access them.
CPNI UK. (2012, April 3). 20 critical security controls for cyber defense [Video]. YouTube.
https://c24.page/5ws89v9fdbr4q9pjyk6s4t8wsr
MIS Training Institute. (2018, March 26). The benefits of leveraging the CIS critical security controls [Video].
YouTube. https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx
Unit Lesson
In Unit III, you developed a security framework using the National Institute of Standards and Technology
(NIST) SP 800-53. You also identified the security controls that should be used as a baseline for the
organization security framework. In Unit IV, it was briefly mentioned that critical security controls are
vulnerable to potential threats, and a risk assessment was done based on the results from an assessment
tool (Microsoft Baseline Security Analyzer). A few of the security controls were scanned and analyzed to
generate a vulnerability matrix assessment.
In this unit, we will take an in-depth look at the Center for Internet Security (CIS) Critical Security Controls
(CSC). According to the Center for Internet Security (CIS, n.d.), there are 20 security controls that are critical
to protect and safeguard the critical assets within the information technology infrastructure. Please review the
video Prioritizing the Top 20 Critical Security Controls for more information. A transcript and closed captioning
are available once you access the video.
These 20 critical security controls fall into three categories: basic CIS controls, foundational CIS controls, and
organizational CIS controls as shown below (CIS, n.d.):
UNIT V STUDY GUIDE
IT Tool and Control Assessment
[https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site](https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site)
[https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site](https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site)
[https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1](https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1)
[https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1](https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1)
[https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx](https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx)
[https://c24.page/cpwnu4pyazag452s98udazg97x](https://c24.page/cpwnu4pyazag452s98udazg97x)
SEC 4320, IS Security Capstone 2
UNIT x STUDY GUIDE
Title
Basic CIS controls Foundational CIS controls Organizational CIS controls
Inventory and control of hardware
assets
Email and web browser
protections
Implementation of a security
awareness and training program
Inventory and control of software
assets
Malware defense Application software security
Continuous vulnerability
management
Limitation and control of network
ports, protocols, and services
Incident response and
management
Controlled use of administrative
privileges
Data recovery capabilities Penetration tests and red team
exercises
Secure configuration for hardware
and software on mobile devices,
laptops, workstations, and
servers
Secure configuration for network
devices, such as firewalls,
routers, and switches
Maintenance, monitoring, and
analysis of audit logs
Boundary defense
Data protection
Controlled access based on the
need to know
Wireless access control
Account monitoring and control
The critical security controls shown above support the security professional in designing policies, procedures,
and documentation that will protect the organization in compliance with the CIS.
Which of the critical security controls should you, as a security professional, implement first in your
organization? One look at the CIS critical security control categories should provide the hint of which controls
you should start with. To establish a baseline security framework, you should begin implementing the basic
CIS controls that secure the assets and people in the organization. Many of you have seen some of these
controls already implemented when you were hired to work for an organization. Examples of such controls
that you may have seen are the company’s standard operating procedures (SOP), which provide a step-by-
step set of instructions about the company and have a section on information technology (IT) security
measures. The authorized use policy (AUP) contains specific rules about what can and cannot be done using
organizational equipment, including the use of the Internet.
Depending on your job within the organization, there will be controlled administrative access governing the
equipment and/or applications that an employee is allowed to access. As an example, if you work in shipping
and handling, you will not be granted access to customer billing information. Another example involves
whether or not you have access to the company’s inventory database. If you are the systems administrator,
you will have access to hardware as well as software applications. How much access you will have is
determined by the policy set forth by the organization’s upper management.
At no time should one individual within the organization have access to all hardware and applications. The
security professional’s main job is to ensure the protection of all hardware and applications from potential
security threats. Therefore, an organization’s network documents and people will be monitored for security
compliance, and vulnerability scans will continuously take place within the organization. The remediation or
fixes to vulnerabilities will be done by security and IT personnel within the organization.
As you can see, the basic CIS controls are important to setting the security baseline and framework for the
organization to build upon. Without a solid foundation, the organization will be susceptible to the easiest
threats to the IT infrastructure. As always, there are risks with all the controls used. How much of a risk
impact—whether it be low, medium, or high—will be tolerated is determined by the organization’s upper
management. However, you must first set the baseline of what risk is acceptable based on the controls
implemented in the organization.
Once the basic controls are implemented, then the security posture can evolve with the foundational CIS
controls and then the organizational CIS controls. Please know that if the organization already has a strong
basic security framework in place, then the organization can start with the foundational CIS controls and/or
organizational CIS controls.
SEC 4320, IS Security Capstone 3
UNIT x STUDY GUIDE
Title
So, we come back to the same question. Which of the critical security controls should you, as a security
professional, implement first in your organization? That will depend on the current security climate of the
organization. Even if the organization is well established in its security framework, there is always a chance of
complacency in the security culture. Therefore, there is nothing wrong with going back over the basic CIS
controls to see if the organization has captured all the security controls.
Reference
Center for Internet Security. (n.d.). The 20 CIS controls & resources. https://www.cisecurity.org/controls/cis-
controls-list/
– Course Learning Outcomes for Unit V
– Required Unit Resources
– Unit Lesson
– Reference
**## UnitV.pdf**
SEC 4320, IS Security Capstone 1
Course Learning Outcomes for Unit V
Upon completion of this unit, students should be able to:
1. Compile a vulnerability assessment using the current security posture.
1.1 Integrate the critical security controls into an organization assessment.
4. Propose a security plan for a project solution.
4.1 Prioritize the critical security controls according to the needs of the organization.
5. Construct preventative measures to ensure critical assets are secure.
5.1 Classify the critical security controls utilizing a risk assessment matrix.
Required Unit Resources
In order to access the following resources, click the links below.
Allodi, L., & Massacci, F. (2017, August). Security events and vulnerability data for cybersecurity risk
estimation. Risk Analysis, 37(8), 1606–1627.
https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?dire
ct=true&db=bsu&AN=124586639&site=ehost-live&scope=site
Woods. D., Agrafiotis, I, Nurse, J. R., & Creese, S. (2017). Mapping the coverage of security controls in cyber
insurance proposal forms. Journal of Internet Services and Applications.
https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1
A transcript and closed captioning are available for both videos below once you access them.
CPNI UK. (2012, April 3). 20 critical security controls for cyber defense [Video]. YouTube.
https://c24.page/5ws89v9fdbr4q9pjyk6s4t8wsr
MIS Training Institute. (2018, March 26). The benefits of leveraging the CIS critical security controls [Video].
YouTube. https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx
Unit Lesson
In Unit III, you developed a security framework using the National Institute of Standards and Technology
(NIST) SP 800-53. You also identified the security controls that should be used as a baseline for the
organization security framework. In Unit IV, it was briefly mentioned that critical security controls are
vulnerable to potential threats, and a risk assessment was done based on the results from an assessment
tool (Microsoft Baseline Security Analyzer). A few of the security controls were scanned and analyzed to
generate a vulnerability matrix assessment.
In this unit, we will take an in-depth look at the Center for Internet Security (CIS) Critical Security Controls
(CSC). According to the Center for Internet Security (CIS, n.d.), there are 20 security controls that are critical
to protect and safeguard the critical assets within the information technology infrastructure. Please review the
video Prioritizing the Top 20 Critical Security Controls for more information. A transcript and closed captioning
are available once you access the video.
These 20 critical security controls fall into three categories: basic CIS controls, foundational CIS controls, and
organizational CIS controls as shown below (CIS, n.d.):
UNIT V STUDY GUIDE
IT Tool and Control Assessment
[https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site](https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site)
[https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site](https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site)
[https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1](https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1)
[https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1](https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1)
[https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx](https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx)
[https://c24.page/cpwnu4pyazag452s98udazg97x](https://c24.page/cpwnu4pyazag452s98udazg97x)
SEC 4320, IS Security Capstone 2
UNIT x STUDY GUIDE
Title
Basic CIS controls Foundational CIS controls Organizational CIS controls
Inventory and control of hardware
assets
Email and web browser
protections
Implementation of a security
awareness and training program
Inventory and control of software
assets
Malware defense Application software security
Continuous vulnerability
management
Limitation and control of network
ports, protocols, and services
Incident response and
management
Controlled use of administrative
privileges
Data recovery capabilities Penetration tests and red team
exercises
Secure configuration for hardware
and software on mobile devices,
laptops, workstations, and
servers
Secure configuration for network
devices, such as firewalls,
routers, and switches
Maintenance, monitoring, and
analysis of audit logs
Boundary defense
Data protection
Controlled access based on the
need to know
Wireless access control
Account monitoring and control
The critical security controls shown above support the security professional in designing policies, procedures,
and documentation that will protect the organization in compliance with the CIS.
Which of the critical security controls should you, as a security professional, implement first in your
organization? One look at the CIS critical security control categories should provide the hint of which controls
you should start with. To establish a baseline security framework, you should begin implementing the basic
CIS controls that secure the assets and people in the organization. Many of you have seen some of these
controls already implemented when you were hired to work for an organization. Examples of such controls
that you may have seen are the company’s standard operating procedures (SOP), which provide a step-by-
step set of instructions about the company and have a section on information technology (IT) security
measures. The authorized use policy (AUP) contains specific rules about what can and cannot be done using
organizational equipment, including the use of the Internet.
Depending on your job within the organization, there will be controlled administrative access governing the
equipment and/or applications that an employee is allowed to access. As an example, if you work in shipping
and handling, you will not be granted access to customer billing information. Another example involves
whether or not you have access to the company’s inventory database. If you are the systems administrator,
you will have access to hardware as well as software applications. How much access you will have is
determined by the policy set forth by the organization’s upper management.
At no time should one individual within the organization have access to all hardware and applications. The
security professional’s main job is to ensure the protection of all hardware and applications from potential
security threats. Therefore, an organization’s network documents and people will be monitored for security
compliance, and vulnerability scans will continuously take place within the organization. The remediation or
fixes to vulnerabilities will be done by security and IT personnel within the organization.
As you can see, the basic CIS controls are important to setting the security baseline and framework for the
organization to build upon. Without a solid foundation, the organization will be susceptible to the easiest
threats to the IT infrastructure. As always, there are risks with all the controls used. How much of a risk
impact—whether it be low, medium, or high—will be tolerated is determined by the organization’s upper
management. However, you must first set the baseline of what risk is acceptable based on the controls
implemented in the organization.
Once the basic controls are implemented, then the security posture can evolve with the foundational CIS
controls and then the organizational CIS controls. Please know that if the organization already has a strong
basic security framework in place, then the organization can start with the foundational CIS controls and/or
organizational CIS controls.
SEC 4320, IS Security Capstone 3
UNIT x STUDY GUIDE
Title
So, we come back to the same question. Which of the critical security controls should you, as a security
professional, implement first in your organization? That will depend on the current security climate of the
organization. Even if the organization is well established in its security framework, there is always a chance of
complacency in the security culture. Therefore, there is nothing wrong with going back over the basic CIS
controls to see if the organization has captured all the security controls.
Reference
Center for Internet Security. (n.d.). The 20 CIS controls & resources. https://www.cisecurity.org/controls/cis-
controls-list/
– Course Learning Outcomes for Unit V
– Required Unit Resources
– Unit Lesson
– Reference
**## I.docx**
You are the security manager for a newly established organization. The chief executive officer (CEO) knows about the six basic CIS controls and wants to know which of the six controls you would establish first. Discuss which of these basic controls you would implement first and why.
**## UnitV.pdf**
SEC 4320, IS Security Capstone 1
Course Learning Outcomes for Unit V
Upon completion of this unit, students should be able to:
1. Compile a vulnerability assessment using the current security posture.
1.1 Integrate the critical security controls into an organization assessment.
4. Propose a security plan for a project solution.
4.1 Prioritize the critical security controls according to the needs of the organization.
5. Construct preventative measures to ensure critical assets are secure.
5.1 Classify the critical security controls utilizing a risk assessment matrix.
Required Unit Resources
In order to access the following resources, click the links below.
Allodi, L., & Massacci, F. (2017, August). Security events and vulnerability data for cybersecurity risk
estimation. Risk Analysis, 37(8), 1606–1627.
https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?dire
ct=true&db=bsu&AN=124586639&site=ehost-live&scope=site
Woods. D., Agrafiotis, I, Nurse, J. R., & Creese, S. (2017). Mapping the coverage of security controls in cyber
insurance proposal forms. Journal of Internet Services and Applications.
https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1
A transcript and closed captioning are available for both videos below once you access them.
CPNI UK. (2012, April 3). 20 critical security controls for cyber defense [Video]. YouTube.
https://c24.page/5ws89v9fdbr4q9pjyk6s4t8wsr
MIS Training Institute. (2018, March 26). The benefits of leveraging the CIS critical security controls [Video].
YouTube. https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx
Unit Lesson
In Unit III, you developed a security framework using the National Institute of Standards and Technology
(NIST) SP 800-53. You also identified the security controls that should be used as a baseline for the
organization security framework. In Unit IV, it was briefly mentioned that critical security controls are
vulnerable to potential threats, and a risk assessment was done based on the results from an assessment
tool (Microsoft Baseline Security Analyzer). A few of the security controls were scanned and analyzed to
generate a vulnerability matrix assessment.
In this unit, we will take an in-depth look at the Center for Internet Security (CIS) Critical Security Controls
(CSC). According to the Center for Internet Security (CIS, n.d.), there are 20 security controls that are critical
to protect and safeguard the critical assets within the information technology infrastructure. Please review the
video Prioritizing the Top 20 Critical Security Controls for more information. A transcript and closed captioning
are available once you access the video.
These 20 critical security controls fall into three categories: basic CIS controls, foundational CIS controls, and
organizational CIS controls as shown below (CIS, n.d.):
UNIT V STUDY GUIDE
IT Tool and Control Assessment
[https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site](https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site)
[https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site](https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site)
[https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1](https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1)
[https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1](https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1)
[https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx](https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx)
[https://c24.page/cpwnu4pyazag452s98udazg97x](https://c24.page/cpwnu4pyazag452s98udazg97x)
SEC 4320, IS Security Capstone 2
UNIT x STUDY GUIDE
Title
Basic CIS controls Foundational CIS controls Organizational CIS controls
Inventory and control of hardware
assets
Email and web browser
protections
Implementation of a security
awareness and training program
Inventory and control of software
assets
Malware defense Application software security
Continuous vulnerability
management
Limitation and control of network
ports, protocols, and services
Incident response and
management
Controlled use of administrative
privileges
Data recovery capabilities Penetration tests and red team
exercises
Secure configuration for hardware
and software on mobile devices,
laptops, workstations, and
servers
Secure configuration for network
devices, such as firewalls,
routers, and switches
Maintenance, monitoring, and
analysis of audit logs
Boundary defense
Data protection
Controlled access based on the
need to know
Wireless access control
Account monitoring and control
The critical security controls shown above support the security professional in designing policies, procedures,
and documentation that will protect the organization in compliance with the CIS.
Which of the critical security controls should you, as a security professional, implement first in your
organization? One look at the CIS critical security control categories should provide the hint of which controls
you should start with. To establish a baseline security framework, you should begin implementing the basic
CIS controls that secure the assets and people in the organization. Many of you have seen some of these
controls already implemented when you were hired to work for an organization. Examples of such controls
that you may have seen are the company’s standard operating procedures (SOP), which provide a step-by-
step set of instructions about the company and have a section on information technology (IT) security
measures. The authorized use policy (AUP) contains specific rules about what can and cannot be done using
organizational equipment, including the use of the Internet.
Depending on your job within the organization, there will be controlled administrative access governing the
equipment and/or applications that an employee is allowed to access. As an example, if you work in shipping
and handling, you will not be granted access to customer billing information. Another example involves
whether or not you have access to the company’s inventory database. If you are the systems administrator,
you will have access to hardware as well as software applications. How much access you will have is
determined by the policy set forth by the organization’s upper management.
At no time should one individual within the organization have access to all hardware and applications. The
security professional’s main job is to ensure the protection of all hardware and applications from potential
security threats. Therefore, an organization’s network documents and people will be monitored for security
compliance, and vulnerability scans will continuously take place within the organization. The remediation or
fixes to vulnerabilities will be done by security and IT personnel within the organization.
As you can see, the basic CIS controls are important to setting the security baseline and framework for the
organization to build upon. Without a solid foundation, the organization will be susceptible to the easiest
threats to the IT infrastructure. As always, there are risks with all the controls used. How much of a risk
impact—whether it be low, medium, or high—will be tolerated is determined by the organization’s upper
management. However, you must first set the baseline of what risk is acceptable based on the controls
implemented in the organization.
Once the basic controls are implemented, then the security posture can evolve with the foundational CIS
controls and then the organizational CIS controls. Please know that if the organization already has a strong
basic security framework in place, then the organization can start with the foundational CIS controls and/or
organizational CIS controls.
SEC 4320, IS Security Capstone 3
UNIT x STUDY GUIDE
Title
So, we come back to the same question. Which of the critical security controls should you, as a security
professional, implement first in your organization? That will depend on the current security climate of the
organization. Even if the organization is well established in its security framework, there is always a chance of
complacency in the security culture. Therefore, there is nothing wrong with going back over the basic CIS
controls to see if the organization has captured all the security controls.
Reference
Center for Internet Security. (n.d.). The 20 CIS controls & resources. https://www.cisecurity.org/controls/cis-
controls-list/
– Course Learning Outcomes for Unit V
– Required Unit Resources
– Unit Lesson
– Reference
**## I.docx**
You are the security manager for a newly established organization. The chief executive officer (CEO) knows about the six basic CIS controls and wants to know which of the six controls you would establish first. Discuss which of these basic controls you would implement first and why.
**## UnitV.pdf**
SEC 4320, IS Security Capstone 1
Course Learning Outcomes for Unit V
Upon completion of this unit, students should be able to:
1. Compile a vulnerability assessment using the current security posture.
1.1 Integrate the critical security controls into an organization assessment.
4. Propose a security plan for a project solution.
4.1 Prioritize the critical security controls according to the needs of the organization.
5. Construct preventative measures to ensure critical assets are secure.
5.1 Classify the critical security controls utilizing a risk assessment matrix.
Required Unit Resources
In order to access the following resources, click the links below.
Allodi, L., & Massacci, F. (2017, August). Security events and vulnerability data for cybersecurity risk
estimation. Risk Analysis, 37(8), 1606–1627.
https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?dire
ct=true&db=bsu&AN=124586639&site=ehost-live&scope=site
Woods. D., Agrafiotis, I, Nurse, J. R., & Creese, S. (2017). Mapping the coverage of security controls in cyber
insurance proposal forms. Journal of Internet Services and Applications.
https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1
A transcript and closed captioning are available for both videos below once you access them.
CPNI UK. (2012, April 3). 20 critical security controls for cyber defense [Video]. YouTube.
https://c24.page/5ws89v9fdbr4q9pjyk6s4t8wsr
MIS Training Institute. (2018, March 26). The benefits of leveraging the CIS critical security controls [Video].
YouTube. https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx
Unit Lesson
In Unit III, you developed a security framework using the National Institute of Standards and Technology
(NIST) SP 800-53. You also identified the security controls that should be used as a baseline for the
organization security framework. In Unit IV, it was briefly mentioned that critical security controls are
vulnerable to potential threats, and a risk assessment was done based on the results from an assessment
tool (Microsoft Baseline Security Analyzer). A few of the security controls were scanned and analyzed to
generate a vulnerability matrix assessment.
In this unit, we will take an in-depth look at the Center for Internet Security (CIS) Critical Security Controls
(CSC). According to the Center for Internet Security (CIS, n.d.), there are 20 security controls that are critical
to protect and safeguard the critical assets within the information technology infrastructure. Please review the
video Prioritizing the Top 20 Critical Security Controls for more information. A transcript and closed captioning
are available once you access the video.
These 20 critical security controls fall into three categories: basic CIS controls, foundational CIS controls, and
organizational CIS controls as shown below (CIS, n.d.):
UNIT V STUDY GUIDE
IT Tool and Control Assessment
[https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site](https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site)
[https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site](https://libraryresources.columbiasouthern.edu/login?url=http://search.ebscohost.com/login.aspx?direct=true&db=bsu&AN=124586639&site=ehost-live&scope=site)
[https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1](https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1)
[https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1](https://jisajournal.springeropen.com/articles/10.1186/s13174-017-0059-y#Abs1)
[https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx](https://c24.page/26cy2qmjqgfzdqwf998mbf4ssx)
[https://c24.page/cpwnu4pyazag452s98udazg97x](https://c24.page/cpwnu4pyazag452s98udazg97x)
SEC 4320, IS Security Capstone 2
UNIT x STUDY GUIDE
Title
Basic CIS controls Foundational CIS controls Organizational CIS controls
Inventory and control of hardware
assets
Email and web browser
protections
Implementation of a security
awareness and training program
Inventory and control of software
assets
Malware defense Application software security
Continuous vulnerability
management
Limitation and control of network
ports, protocols, and services
Incident response and
management
Controlled use of administrative
privileges
Data recovery capabilities Penetration tests and red team
exercises
Secure configuration for hardware
and software on mobile devices,
laptops, workstations, and
servers
Secure configuration for network
devices, such as firewalls,
routers, and switches
Maintenance, monitoring, and
analysis of audit logs
Boundary defense
Data protection
Controlled access based on the
need to know
Wireless access control
Account monitoring and control
The critical security controls shown above support the security professional in designing policies, procedures,
and documentation that will protect the organization in compliance with the CIS.
Which of the critical security controls should you, as a security professional, implement first in your
organization? One look at the CIS critical security control categories should provide the hint of which controls
you should start with. To establish a baseline security framework, you should begin implementing the basic
CIS controls that secure the assets and people in the organization. Many of you have seen some of these
controls already implemented when you were hired to work for an organization. Examples of such controls
that you may have seen are the company’s standard operating procedures (SOP), which provide a step-by-
step set of instructions about the company and have a section on information technology (IT) security
measures. The authorized use policy (AUP) contains specific rules about what can and cannot be done using
organizational equipment, including the use of the Internet.
Depending on your job within the organization, there will be controlled administrative access governing the
equipment and/or applications that an employee is allowed to access. As an example, if you work in shipping
and handling, you will not be granted access to customer billing information. Another example involves
whether or not you have access to the company’s inventory database. If you are the systems administrator,
you will have access to hardware as well as software applications. How much access you will have is
determined by the policy set forth by the organization’s upper management.
At no time should one individual within the organization have access to all hardware and applications. The
security professional’s main job is to ensure the protection of all hardware and applications from potential
security threats. Therefore, an organization’s network documents and people will be monitored for security
compliance, and vulnerability scans will continuously take place within the organization. The remediation or
fixes to vulnerabilities will be done by security and IT personnel within the organization.
As you can see, the basic CIS controls are important to setting the security baseline and framework for the
organization to build upon. Without a solid foundation, the organization will be susceptible to the easiest
threats to the IT infrastructure. As always, there are risks with all the controls used. How much of a risk
impact—whether it be low, medium, or high—will be tolerated is determined by the organization’s upper
management. However, you must first set the baseline of what risk is acceptable based on the controls
implemented in the organization.
Once the basic controls are implemented, then the security posture can evolve with the foundational CIS
controls and then the organizational CIS controls. Please know that if the organization already has a strong
basic security framework in place, then the organization can start with the foundational CIS controls and/or
organizational CIS controls.
SEC 4320, IS Security Capstone 3
UNIT x STUDY GUIDE
Title
So, we come back to the same question. Which of the critical security controls should you, as a security
professional, implement first in your organization? That will depend on the current security climate of the
organization. Even if the organization is well established in its security framework, there is always a chance of
complacency in the security culture. Therefore, there is nothing wrong with going back over the basic CIS
controls to see if the organization has captured all the security controls.
Reference
Center for Internet Security. (n.d.). The 20 CIS controls & resources. https://www.cisecurity.org/controls/cis-
controls-list/
– Course Learning Outcomes for Unit V
– Required Unit Resources
– Unit Lesson
– Reference