CIS Controls e Vulnerability Assessment Piergiorgio Venuti

CIS Controls and Vulnerability Assessment: practical guide to adopting best practices

Estimated reading time: 6 minutes

Critical Security Controls, also known as CIS Controls, are a series of cybersecurity actions and technologies developed to protect organizations from common and effective cyber attacks. This article explains what CIS is, the benefits of adopting CIS Controls and how to integrate them into the Vulnerability Assessment process to improve your security posture.

What is CIS (Center for Internet Security)?

The Center for Internet Security (CIS) is a non-profit organization dedicated to improving cyber resilience globally. CIS manages various programs including:

  • The CIS Controls or Critical Security Controls.
  • The MS-ISAC (Multi-State Information Sharing & Analysis Center) to share threat intelligence.
  • CIS Benchmarks for secure computer system configurations.

CIS is supported by governments, private companies, academic institutions and technical communities to develop cybersecurity best practices.

CIS Controls (Critical Security Controls)

The CIS Controls, initially known as the SANS Top 20 Critical Security Contros, were developed by CIS together with high-level cybersecurity experts.

It is a series of actions, policies and security tools prioritized and consolidated into a standard checklist. The goal is to guide organizations to implement the most critical and effective defenses to block known and emerging cyber attacks.

The benefits of adopting CIS Controls include:

  • Pragmatic, high-impact approach – focuses on the highest-value best practices.
  • Evidence-based – derived from the analysis of millions of real attacks.
  • Cross-disciplinary applicability – effective for organizations of all sizes and sectors.
  • Measurable metrics – implementation score to track improvement.
  • Constantly updated – continuously reviewed by experts to reflect the threat landscape.

Evolution of CIS Controls

The first version of Critical Security Controls dates back to 2008. Over the years they have been reviewed and updated regularly to keep them relevant against emerging threats.

The latest release is version 8 (CIS Controls v8) released in 2021, which includes 20 core controls. Here are some of the main new features:

  • Unification of identity and access controls in a single domain.
  • New controls specific to mobile and IoT devices.
  • Increased focus on supply chain attacks and ransomware.
  • Integration of emerging technologies such as microservices and containers.
  • New deployment metrics for more granular measurement.

The 20 Critical Security Controls CIS v8

Below are the 20 domains of CIS Controls ver. 8 grouped into their respective management areas:

Protect critical information and systems

  1. Inventory of authorized and unauthorized devices
  2. Inventory of authorized and unauthorized software
  3. Protect hardware and software configurations on mobile devices, laptops, workstations and servers
  4. Continuous assessment and remediation of vulnerabilities
  5. Protection of the development and delivery stages of the software application

Develop a culture of safety and awareness

  1. Administrative authorization
  2. Maintenance, monitoring and analysis of audit logs

Strengthen defense and simplify security

  1. Defense against malware
  2. Limitation and control of network ports, protocols and services
  3. Data protection
  4. Network protection
  5. Sensitive access control

Use analytics to respond to events

  1. Data protection and security analysis systems
  2. Event detection and response to security incidents

Reduce the attack surface and opportunities for attackers

  1. Implementation of a Zero Trust security architecture
  2. Data protection and access control
  3. Security implementation for network and mobility devices
  4. Device and data center protection on on-premises, hybrid networks and cloud systems

Respond adaptively to restore the situation

  1. Incident response and disaster recovery plans
  2. Exercises to evaluate and improve incident response and disaster recovery plans

CIS Controls Self-Assessment Scanner

To simplify the adoption of CIS Controls, CIS provides a free self-assessment tool, the CIS Controls Self-Assessment Scanner.

This scanner allows you to fill out an online questionnaire on the implementation status of various controls within your organization.

At the end, a report is obtained that assigns an overall score and identifies priority areas for improvement to strengthen defenses based on CIS Controls.

The tool provides a high-level overview but does not directly test the security or effectiveness of the controls. This is why more in-depth activities such as Vulnerability Assessment are necessary.

Integrate CIS Controls into Vulnerability Assessment

Carrying out a periodic Vulnerability Assessment allows you to promptly identify all vulnerabilities and security flaws within the IT infrastructure.

To comprehensively cover attack vectors, the assessment should check both misconfigurations that can violate CIS Controls and technical vulnerabilities in systems.

For example, scanning can:

  • Detect configuration errors that expose sensitive network ports.
  • Identify unnecessary services active on servers and workstations.
  • Find out-of-date and exploit-prone software applications.
  • Uncover accounts with weak passwords or default credentials.
  • Identify operating systems or databases that are obsolete and no longer supported.
  • Analyze security policies and settings in detail.

Therefore, the final Vulnerability Assessment report can include specific remediation indications to resolve these problems, aligning with the violated CIS Controls.

In this way the organization is able to:

  • Measure the actual level of compliance with CIS best practices.
  • Prioritize corrective actions based on risk.
  • Monitor progress in implementing key defenses.
  • Demonstrate commitment to following standards validated by the IT community.
  • The Vulnerability Assessment becomes an even more valuable tool by integrating the checks with the CIS Controls as a reference framework.
  • Hardening of systems via CIS Controls
  • CIS Controls provide operational guidance to protect IT systems through “hardening” best practices, i.e. strengthening security.
  • Here are some examples of hardening activities led by CIS Controls:
  • Remove unnecessary software – uninstall non-essential components, features and services according to Check 2.
  • Closing ports and services – block network ports, disable obsolete and unused services by applying Checks 9 and 11.
  • Periodic updates – keep operating systems, software and firmware fully patched as indicated in Check 4.
  • Minimize users and privileges – assign the minimum administrative privileges required by the user’s role as per Check 6.
  • Data Protection – encrypt sensitive data both in transit and at rest by implementing Control 10.
  • Multi-factor authentication – require multiple credentials to access critical assets as Control 12 dictates.
  • Network segmentation – logically separate sensitive environments and data flows as recommended by Control 11.
  • Log collection and retention – collect, centralize and maintain system, application and security event logs for Control 7.
  • By regularly verifying compliance with these best practices during Vulnerability Assessment, organizations can maintain a robust security posture for their critical assets.
  • Continuous Automated Infrastructure Penetration Testing – Breach and Attack Simulation (BAS)
  • To maintain compliance with CIS Controls and an understanding of security risks, it is essential to perform Vulnerability Assessment frequently and continuously.
  • Benefits of an ongoing VA program include:
  • Real-time visibility – proactively monitor exposure to new threats as systems and applications change.
  • Speed of intervention – immediate identification of new gaps to be resolved according to CIS Controls.
  • Progressive improvement – tracking progress over time towards complete coverage of critical controls.
  • Dynamic risk management – evaluating the impact of internal and external changes on exposure to attacks.
  • Proof of Diligence – demonstration of concrete commitment to following recognized best practice frameworks.
  • By outsourcing ongoing Vulnerability Assessment to qualified managed service providers, companies and organizations can benefit from specialized skills and advanced technologies to effectively integrate CIS Controls into their security program.
  • Conclusion
  • The CIS Critical Security Controls constitute a solid foundation of cybersecurity best practices developed by high-profile experts.
  • By integrating them into the Vulnerability Assessment process, organizations can concretely evaluate their compliance with these validated standards and identify priority areas for improvement.
  • A continuous program of checks allows you to monitor the security status over time and guide hardening and risk mitigation activities in line with the CIS Controls recommendations.
  • By taking a proactive approach, you can respond more quickly to evolving threats, reducing your attack surface and strengthening your overall cybersecurity posture.

Useful links:



More Articles…

Categories …


RSS darkreading

RSS Full Disclosure

  • BACKDOOR.WIN32.DUMADOR.C / Remote Stack Buffer Overflow (SEH) April 19, 2024
    Posted by malvuln on Apr 19Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: Contact: malvuln13 () gmail com Media: Threat: Backdoor.Win32.Dumador.c Vulnerability: Remote Stack Buffer Overflow (SEH) Description: The malware runs an FTP server on TCP port 10000. Third-party adversaries who can reach the server can send a specially […]
  • SEC Consult SA-20240418-0 :: Broken authorization in Dreamehome app April 19, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Apr 19SEC Consult Vulnerability Lab Security Advisory < 20240418-0 > ======================================================================= title: Broken authorization product: Dreamehome app vulnerable version:
  • MindManager 23 - full disclosure April 19, 2024
    Posted by Pawel Karwowski via Fulldisclosure on Apr 19Resending! Thank you for your efforts. GitHub - pawlokk/mindmanager-poc: public disclosure Affected application: MindManager23_setup.exe Platform: Windows Issue: Local Privilege Escalation via MSI installer Repair Mode (EXE hijacking race condition) Discovered and reported by: Pawel Karwowski and Julian Horoszkiewicz (Eviden Red Team) Proposed mitigation:...
  • CVE-2024-31705 April 14, 2024
    Posted by V3locidad on Apr 14CVE ID: CVE-2024-31705 Title : RCE to Shell Commands" Plugin / GLPI Shell Command Management Interface Affected Product : GLPI - 10.X.X and last version Description: An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input. […]
  • SEC Consult SA-20240411-0 :: Database Passwords in Server Response in Amazon AWS Glue April 14, 2024
    Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Apr 14SEC Consult Vulnerability Lab Security Advisory < 20240411-0 > ======================================================================= title: Database Passwords in Server Response product: Amazon AWS Glue vulnerable version: until 2024-02-23 fixed version: as of 2024-02-23 CVE number: - impact: medium homepage: found:...
  • [KIS-2024-03] Invision Community <= 4.7.16 (toolbar.php) Remote Code Execution Vulnerability April 11, 2024
    Posted by Egidio Romano on Apr 10------------------------------------------------------------------------------ Invision Community
  • [KIS-2024-02] Invision Community <= 4.7.15 (store.php) SQL Injection Vulnerability April 11, 2024
    Posted by Egidio Romano on Apr 10-------------------------------------------------------------------- Invision Community
  • Multiple Issues in concretecmsv9.2.7 April 11, 2024
    Posted by Andrey Stoykov on Apr 10# Exploit Title: Multiple Web Flaws in concretecmsv9.2.7 # Date: 4/2024 # Exploit Author: Andrey Stoykov # Version: 9.2.7 # Tested on: Ubuntu 22.04 # Blog: Verbose Error Message - Stack Trace: 1. Directly browse to edit profile page 2. Error should come up with verbose stack trace […]
  • OXAS-ADV-2024-0001: OX App Suite Security Advisory April 11, 2024
    Posted by Martin Heiland via Fulldisclosure on Apr 10Dear subscribers, We&apos;re sharing our latest advisory with you and like to thank everyone who contributed in finding and solving those vulnerabilities. Feel free to join our bug bounty programs for OX App Suite, Dovecot and PowerDNS at YesWeHack. This advisory has also been published at […]
  • / Insecure Permissions (In memory IPC) April 11, 2024
    Posted by malvuln on Apr 10Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2024 Original source: Contact: malvuln13 () gmail com Media: Threat: Vulnerability: Insecure Permissions (In memory IPC) Family: Razy Type: PE32 MD5: 0eb4a9089d3f7cf431d6547db3b9484d SHA256: 3d82fee314e7febb8307ccf8a7396b6dd53c7d979a74aa56f3c4a6d0702fd098 Vuln ID: MVID-2024-0678...