The Critical Controls for Effective Cyber Defense are a recommended set of best practices for cyber defense that provide specific and actionable ways to stop today’s most pervasive attacks. They were developed by a consortium of hundreds of security experts from across the public and private sectors. The Controls are derived from the most common attack patterns and serve as a very strong basis for high-value action.
The Controls prioritize and focus on actionable controls with high-payoff, aiming for a “must do first” philosophy.
- Inventory of authorized and unauthorized devices
- Inventory of authorized and unauthorized software
- Security configurations for hardware and software
- Continuous vulnerability assessment and remediation
- Malware defenses
- Application software security
- Wireless access control
- Data recovery capability
- Security skills assessment and appropriate training
- Secure configurations for network devices such as firewalls, routers and switches
- Limitation and control of network ports, protocols and services
- Controlled use of administrative privileges
- Boundary defense
- Maintenance, monitoring and analysis of audit logs
- Controlled access based on need-to-know
- Account monitoring and control
- Data protection
- Incident response management
- Secure network engineering
- Penetration tests and red team exercises
ACE IT Solutions’ security services, offered in partnership with IBM, are designed to help businesses build and maintain their security programs. Our security services provide practical and affordable ways to implement and automate many of the 20 CSCs. Businesses that are planning or already have implemented security monitoring can leverage our SIEM solution to assist with the 20 CSCs.