CIS Control 1: Inventory and Control of Hardware Assets

Home  »  Blog  »  Cyber Security  »  CIS Control...

By Bill Minahan   |   January 22, 2021   |   0 Comments

CIS Control 6

CIS Control 1: Inventory and Control of Hardware Assets

What is CIS Control 1?

CIS Control 1 is the first control within a framework of 20 critical controls. The CIS Controls are a set of actions that protect your organization from the most pervasive cyber attacks. There are 20 total critical controls that prioritize the most essential actions your organization can take in order to gain the highest pay-off results.

CIS Control 1 focuses on actively managing (inventory, track, and correct) all hardware devices on the network so that only authorized devices are given access, and unauthorized or unmanaged devices are found and prevented from gaining access.

This control is split into 6 focused sections relating to network access control, automation, and asset management. The control specifically focuses on the need for awareness of what is connected to your network, as well as the need for internal inventory management and management automation.

Implementing inventory control is not the most glamorous way to improve your security program, however, it is a foundational security control that is a pre-requisite for the additional 19 security controls.

When done right, it reduces insider threat and loss risks, cleans up your IT environment, and provides greater visibility and organization to your network.

Why is this CIS Control critical?

The CIS Controls are based on actionable guidance from today’s biggest threats, formed by the consensus of the world’s leading experts across a variety of sectors.

Bad actors online search for new and unprotected systems and are particularly interested in devices that come and go ff the network. For instance, Bring-Your-Own-Devices (BYOD), mobile devices, and IoT devices.

Not only may these devices be out of synch with security updates but worse still could already be compromised.

Even devices that are not visible from the internet can be used by bad actors who have already gained internal access.

Large, complex enterprises often struggle with managing intricate, fast-changing environments. As a result, it is a weakness that bad actors are known to capitalize on. Therefore, managed control of devices plays a critical role in planning and executing system back up, incident response, and recovery.

How to Implement CIS Control 1

There are several effective ways to implement the Inventory and Control of Hardware Assets control. If you need help with implementation, then please contact us.

Successful implementation will also improve the implementation of other controls, such as network access, asset configuration, and system management.

The following is a list of the sub-controls of CIS Control 1:

 

Sub-Control

Asset Type

Security Function

Control Title

Control Descriptions

1.1 Devices Identify Utilize an Active Discovery Tool  

Utilize an active discovery tool to identify devices connected to the organization’s network and update the hardware asset inventory.

1.2 Devices Identify Use a Passive Asset Discovery Tool  

Utilize a passive discovery tool to identify devices connected to the organization’s network and automatically update the organization’s hardware asset inventory.

1.3 Devices Identify Use DHCP Logging to Update Asset Inventory  

Use Dynamic Host Configuration Protocol (DHCP) logging on all DHCP servers or IP address management tools to update the organization’s hardware asset inventory.

1.4 Devices Identify Maintain Detailed Asset Inventory  

Maintain an accurate and up-to-date inventory of all technology assets with the potential to store as well as process information. This inventory shall include all assets, whether connected to the organization’s network or not.

1.5 Devices Identify Maintain Asset Inventory Information  

Ensure that the hardware asset inventory records the network address, hardware address, machine name, data asset owner, and department for each asset and whether or not the hardware asset has been approved to connect to the network.

1.6 Devices Respond Address Unauthorized Assets  

Ensure that unauthorized assets are either removed from the network, quarantined or the inventory is updated in a timely manner.

1.7 Devices Protect Deploy Port Level Access Control  

Utilize port level access control, following 802.1x standards, to control which devices can authenticate to the network. The authentication system shall be tied into the hardware asset inventory data to ensure only authorized devices can connect to the network.

1.8 Devices Protect Utilize Client Certificates to Authenticate Hardware Assets  

Use client certificates to authenticate hardware assets connecting to the organization’s trusted network.

 

Implementing CIS Controls

If your team is struggling to implement CIS Control 1 and could use the assistance of a third-party security provider, then aNetworks is here to help. Our team of experts can assist with whatever level of service you require from consulting to complete implementation.

If you are interested in learning more about CIS Controls, view our comprehensive list here.

If you are interested, then please contact us below.

Contact Us

Furthermore, if you are looking for more information, then check out our resource center here.

Finally, you can always find us on TwitterLinkedIn, and Facebook.


Category: Cyber Security