CIS Controls e Vulnerability Assessment Piergiorgio Venuti

CIS Controls and Vulnerability Assessment: practical guide to adopting best practices

Estimated reading time: 6 minutes

Critical Security Controls, also known as CIS Controls, are a series of cybersecurity actions and technologies developed to protect organizations from common and effective cyber attacks. This article explains what CIS is, the benefits of adopting CIS Controls and how to integrate them into the Vulnerability Assessment process to improve your security posture.

What is CIS (Center for Internet Security)?

The Center for Internet Security (CIS) is a non-profit organization dedicated to improving cyber resilience globally. CIS manages various programs including:

  • The CIS Controls or Critical Security Controls.
  • The MS-ISAC (Multi-State Information Sharing & Analysis Center) to share threat intelligence.
  • CIS Benchmarks for secure computer system configurations.

CIS is supported by governments, private companies, academic institutions and technical communities to develop cybersecurity best practices.

CIS Controls (Critical Security Controls)

The CIS Controls, initially known as the SANS Top 20 Critical Security Contros, were developed by CIS together with high-level cybersecurity experts.

It is a series of actions, policies and security tools prioritized and consolidated into a standard checklist. The goal is to guide organizations to implement the most critical and effective defenses to block known and emerging cyber attacks.

The benefits of adopting CIS Controls include:

  • Pragmatic, high-impact approach – focuses on the highest-value best practices.
  • Evidence-based – derived from the analysis of millions of real attacks.
  • Cross-disciplinary applicability – effective for organizations of all sizes and sectors.
  • Measurable metrics – implementation score to track improvement.
  • Constantly updated – continuously reviewed by experts to reflect the threat landscape.

Evolution of CIS Controls

The first version of Critical Security Controls dates back to 2008. Over the years they have been reviewed and updated regularly to keep them relevant against emerging threats.

The latest release is version 8 (CIS Controls v8) released in 2021, which includes 20 core controls. Here are some of the main new features:

  • Unification of identity and access controls in a single domain.
  • New controls specific to mobile and IoT devices.
  • Increased focus on supply chain attacks and ransomware.
  • Integration of emerging technologies such as microservices and containers.
  • New deployment metrics for more granular measurement.

The 20 Critical Security Controls CIS v8

Below are the 20 domains of CIS Controls ver. 8 grouped into their respective management areas:

Protect critical information and systems

  1. Inventory of authorized and unauthorized devices
  2. Inventory of authorized and unauthorized software
  3. Protect hardware and software configurations on mobile devices, laptops, workstations and servers
  4. Continuous assessment and remediation of vulnerabilities
  5. Protection of the development and delivery stages of the software application

Develop a culture of safety and awareness

  1. Administrative authorization
  2. Maintenance, monitoring and analysis of audit logs

Strengthen defense and simplify security

  1. Defense against malware
  2. Limitation and control of network ports, protocols and services
  3. Data protection
  4. Network protection
  5. Sensitive access control

Use analytics to respond to events

  1. Data protection and security analysis systems
  2. Event detection and response to security incidents

Reduce the attack surface and opportunities for attackers

  1. Implementation of a Zero Trust security architecture
  2. Data protection and access control
  3. Security implementation for network and mobility devices
  4. Device and data center protection on on-premises, hybrid networks and cloud systems

Respond adaptively to restore the situation

  1. Incident response and disaster recovery plans
  2. Exercises to evaluate and improve incident response and disaster recovery plans

CIS Controls Self-Assessment Scanner

To simplify the adoption of CIS Controls, CIS provides a free self-assessment tool, the CIS Controls Self-Assessment Scanner.

This scanner allows you to fill out an online questionnaire on the implementation status of various controls within your organization.

At the end, a report is obtained that assigns an overall score and identifies priority areas for improvement to strengthen defenses based on CIS Controls.

The tool provides a high-level overview but does not directly test the security or effectiveness of the controls. This is why more in-depth activities such as Vulnerability Assessment are necessary.

Integrate CIS Controls into Vulnerability Assessment

Carrying out a periodic Vulnerability Assessment allows you to promptly identify all vulnerabilities and security flaws within the IT infrastructure.

To comprehensively cover attack vectors, the assessment should check both misconfigurations that can violate CIS Controls and technical vulnerabilities in systems.

For example, scanning can:

  • Detect configuration errors that expose sensitive network ports.
  • Identify unnecessary services active on servers and workstations.
  • Find out-of-date and exploit-prone software applications.
  • Uncover accounts with weak passwords or default credentials.
  • Identify operating systems or databases that are obsolete and no longer supported.
  • Analyze security policies and settings in detail.

Therefore, the final Vulnerability Assessment report can include specific remediation indications to resolve these problems, aligning with the violated CIS Controls.

In this way the organization is able to:

  • Measure the actual level of compliance with CIS best practices.
  • Prioritize corrective actions based on risk.
  • Monitor progress in implementing key defenses.
  • Demonstrate commitment to following standards validated by the IT community.
  • The Vulnerability Assessment becomes an even more valuable tool by integrating the checks with the CIS Controls as a reference framework.
  • Hardening of systems via CIS Controls
  • CIS Controls provide operational guidance to protect IT systems through “hardening” best practices, i.e. strengthening security.
  • Here are some examples of hardening activities led by CIS Controls:
  • Remove unnecessary software – uninstall non-essential components, features and services according to Check 2.
  • Closing ports and services – block network ports, disable obsolete and unused services by applying Checks 9 and 11.
  • Periodic updates – keep operating systems, software and firmware fully patched as indicated in Check 4.
  • Minimize users and privileges – assign the minimum administrative privileges required by the user’s role as per Check 6.
  • Data Protection – encrypt sensitive data both in transit and at rest by implementing Control 10.
  • Multi-factor authentication – require multiple credentials to access critical assets as Control 12 dictates.
  • Network segmentation – logically separate sensitive environments and data flows as recommended by Control 11.
  • Log collection and retention – collect, centralize and maintain system, application and security event logs for Control 7.
  • By regularly verifying compliance with these best practices during Vulnerability Assessment, organizations can maintain a robust security posture for their critical assets.
  • Continuous Automated Infrastructure Penetration Testing – Breach and Attack Simulation (BAS)
  • To maintain compliance with CIS Controls and an understanding of security risks, it is essential to perform Vulnerability Assessment frequently and continuously.
  • Benefits of an ongoing VA program include:
  • Real-time visibility – proactively monitor exposure to new threats as systems and applications change.
  • Speed of intervention – immediate identification of new gaps to be resolved according to CIS Controls.
  • Progressive improvement – tracking progress over time towards complete coverage of critical controls.
  • Dynamic risk management – evaluating the impact of internal and external changes on exposure to attacks.
  • Proof of Diligence – demonstration of concrete commitment to following recognized best practice frameworks.
  • By outsourcing ongoing Vulnerability Assessment to qualified managed service providers, companies and organizations can benefit from specialized skills and advanced technologies to effectively integrate CIS Controls into their security program.
  • Conclusion
  • The CIS Critical Security Controls constitute a solid foundation of cybersecurity best practices developed by high-profile experts.
  • By integrating them into the Vulnerability Assessment process, organizations can concretely evaluate their compliance with these validated standards and identify priority areas for improvement.
  • A continuous program of checks allows you to monitor the security status over time and guide hardening and risk mitigation activities in line with the CIS Controls recommendations.
  • By taking a proactive approach, you can respond more quickly to evolving threats, reducing your attack surface and strengthening your overall cybersecurity posture.

Useful links:



More Articles…

Categories …


RSS darkreading

RSS Full Disclosure

  • SEC Consult SA-20231123 :: Uninstall Key Caching in Fortra Digital Guardian Agent Uninstaller November 27, 2023
    Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Nov 27SEC Consult Vulnerability Lab Security Advisory < 20231123-0 > ======================================================================= title: Uninstall Key Caching product: Fortra Digital Guardian Agent Uninstaller (Data Loss Prevention) vulnerable version: Agent:
  • SEC Consult SA-20231122 :: Multiple Vulnerabilities in m-privacy TightGate-Pro November 27, 2023
    Posted by SEC Consult Vulnerability Lab, Research via Fulldisclosure on Nov 27SEC Consult Vulnerability Lab Security Advisory < 20231122-0 > ======================================================================= title: Multiple Vulnerabilities product: m-privacy TightGate-Pro vulnerable version: Rolling Release, servers with the following package versions are vulnerable: tightgatevnc < 4.1.2~1 rsbac-policy-tgpro
  • Senec Inverters Home V1, V2, V3 Home & Hybrid Use of Hard-coded Credentials - CVE-2023-39169 November 27, 2023
    Posted by Phos4Me via Fulldisclosure on Nov 27Sent through the Full Disclosure mailing list Web Archives & RSS:
  • [SYSS-2023-019] SmartNode SN200 - Unauthenticated OS Command Injection November 27, 2023
    Posted by Maurizio Ruchay via Fulldisclosure on Nov 27Advisory ID: SYSS-2023-019 Product: SmartNode SN200 Analog Telephone Adapter (ATA) & VoIP Gateway Manufacturer: Patton LLC Affected Version(s):
  • CVE-2023-46307 November 27, 2023
    Posted by Kevin on Nov 27running on the remote port specified during setup
  • CVE-2023-46307 November 27, 2023
    Posted by Kevin on Nov 27While conducting a penetration test for a client, they were running an application called etc-browser which is a public GitHub project with a Docker container. While fuzzing the web server spun up with etcd-browser (which can run on any arbitrary port), the application had a Directory Traversal vulnerability that is […]
  • Survey on usage of security advisories November 27, 2023
    Posted by Aurich, Janik on Nov 27Dear list members, we are looking for voluntary participants for our survey, which was developed in the context of a master thesis at the University of Erlangen-Nuremberg. The goal of the survey is to determine potential difficulties that may occur when dealing with security advisories. The focus of the […]
  • [CVE-2023-46386, CVE-2023-46387, CVE-2023-46388, CVE-2023-46389] Multiple vulnerabilities in Loytec products (3) November 27, 2023
    Posted by Chizuru Toyama on Nov 27[+] CVE : CVE-2023-46386, CVE-2023-46387, CVE-2023-46388, CVE-2023-46389 [+] Title : Multiple vulnerabilities in Loytec L-INX Automation Servers [+] Vendor : LOYTEC electronics GmbH [+] Affected Product(s) : LINX-151, Firmware 7.2.4, LINX-212, firmware 6.2.4 [+] Affected Components : L-INX Automation Servers [+] Discovery Date :...
  • [CVE-2023-46383, CVE-2023-46384, CVE-2023-46385] Multiple vulnerabilities in Loytec products (2) November 27, 2023
    Posted by Chizuru Toyama on Nov 27[+] CVE : CVE-2023-46383, CVE-2023-46384, CVE-2023-46385 [+] Title : Multiple vulnerabilities in Loytec LINX Configurator [+] Vendor : LOYTEC electronics GmbH [+] Affected Product(s) : LINX Configurator 7.4.10 [+] Affected Components : LINX Configurator [+] Discovery Date : 01-Sep-2021 [+] Publication date : 03-Nov-2023 [+]...
  • Senec Inverters Home V1, V2, V3 Home & Hybrid Exposure of the Username to an Unauthorized Actor - CVE-2023-39168 November 12, 2023
    Posted by Phos4Me via Fulldisclosure on Nov 12Sent through the Full Disclosure mailing list Web Archives & RSS: