Automating Critical Security Controls for Threat Remediation and Compliance

Editor's Notes

• #2: Trends like the increased use of cloud computing by businesses and their vendors introduce new complexities in reducing risk and assessing security across the supply chain. Demonstrating continuous risk reduction and compliance with internal policies and external regulations, fixing violations and configuration drift, centrally managing exceptions, and documenting progress are all common challenges. The Center for Internet Security’s (CIS) Critical Security Controls (CSCs) were selected and prioritized by leading security experts to stop today’s most common and serious cyber threats. By implementing these controls, organizations can improve their security posture and reduce the risk of threats to critical assets, data, and network infrastructure. In this webcast, SANS Senior Analyst John Pescatore and Tim White, Director of Product Management for Qualys Policy Compliance (PC), will discuss how you can achieve continuous security and compliance, and leverage Qualys solutions to address all 20 CSCs.   The presentation will encompass: An overview of the CIS Critical Security Controls, including ongoing updates Success patterns organizations have demonstrated for using the controls to their advantage How an automation  can reduce the staffing load to determine whether controls are in place and effective How to prioritize remediation efforts Real-world examples of recent attacks that leveraged misconfigured systems 
• #19: The attack vector uses WMI and psexec to spread using the infected user’s permissions. If the user has administrative rights over other systems, those systems can also become infected. It is highly recommended that administrative permissions be restricted for workstation users. A common misconfiguration is to add “Domain Users” or “Authenticated Users” to the “Administrators” group to quickly grant all workstation users administrative access to their workstation. This allows the users to access other workstations with full administrative permissions. In this type of situation, the malware can spread without the need for a software vulnerability. Group Policy can be used to remove these groups and ensure that they are not added. There have also been reports that a variant of Petya also attempts to obtain the local administrative password. In this case, that password could potentially be used to further spread to other systems with the same local admin password. It is recommended that all systems have different local admin passwords, through the use of a tool such as Microsoft’s LAPS. SCA can be used to ensure that systems are configured securely and are hardened according to CIS bechmarks. SCA hosts number of controls which can be used to identify members of the local Administrators group across Windows workstations and servers. Additionally, SCA helps in assessing the Windows 'User Account control' (UAC) configurations through number of UAC controls to make sure UAC is configured so that the trojans such as Petya are shown the standard UAC request for privilege escalation and won’t be able to run any further.
• #20: Audit != Compliance, compliance ongoing Stitch in time saves nine Transparent, Repeatable Process Scale to ALL Assets Audit Efficiency Metrics = Enforceability
• #21: Control Criticality Buckets – Critical, Mandatory, Important, Low, Informational Talk about Risk Formulas – go off on a tangent here and discuss how everything ends up “average” “critical” Remediation takes time – set exceptions for less critical controls/systems, but set an expiration Build Security Controls Into Your Processes! Demo: Criticality Criticality Levels Control Customization Policy Customization Demo: Dashboards Policy Summary Template customization PCI DSS v3 Compliance Report Scorecard Template Scorecard Report Edit Report Schedule Show Notifications