CIS Control 13: Network Monitoring and Defense

Networks form a critical core for our modern-day society and businesses. People, processes, and technologies should be in place for monitoring, detecting, logging, and preventing malicious activities that occur when an enterprise experiences an attack within or against their networks.

Key Takeaways for Control 13

Enterprises should understand that their systems and networks are never perfectly immune to a cyberattack. Enterprises can leverage the safeguards provided by Control 13 to guide the evolution and maturity of their security posture.

Network monitoring and defense should be viewed as a continuous improvement capability that involves the enterprises’ people, processes, and technologies. Enterprises need a well-trained staff to execute the organizations’ network monitoring and defense ecosystem. Monitoring and logging technologies and processes provide both real-time and historical data that can be used to understand what malicious actors are doing and their behaviors. This provides valuable knowledge that can be used by the organization as they continuously improve and mature their security posture.

Detection and prevention technologies are also necessary in today’s environment because many attack techniques move at machine speed, and human reaction can be too slow to defend against an automated attack. Control 13 is designed to help organizations enable and maintain good network monitoring and defense.

Safeguards for Control 13

13.1) Centralize Security Event Alerting

Description: Centralize security event alerting across enterprise assets for log correlation and analysis. Best practice implementation requires the use of a SIEM, which includes vendor-defined event correlation alerts. A log analytics platform configured with security-relevant correlation alerts also satisfies this Safeguard.

Notes: The security function associated with this safeguard is Detect.

13.2) Deploy a Host-Based Intrusion Detection Solution

Description: Deploy a host-based intrusion detection solution on enterprise assets where appropriate and/or supported.

Notes: The security function associated with this safeguard is Detect.

13.3) Deploy a Network Intrusion Detection Solution

Description: Deploy a network intrusion detection solution on enterprise assets where appropriate. Example implementations include the use of a Network Intrusion Detection System (NIDS) or equivalent cloud service provider (CSP) service.

Notes: The security function associated with this safeguard is Detect.

13.4) Perform Traffic Filtering Between Network Segments

Description: Perform traffic filtering between network segments where appropriate.

Notes: The security function associated with this safeguard is Protect.

13.5) Manage Access Control for Remote Assets

Description: Manage access control for assets remotely connecting to enterprise resources. Determine the amount of access to enterprise resources based on whether there’s up-to-date anti-malware software installed, whether the requesting device maintains configuration compliance with the enterprise’s secure configuration process, and whether the device’s operating system and applications are up-to-date.

Notes: The security function associated with this safeguard is Protect.

13.6) Collect Network Traffic Flow Logs

Description: Collect network traffic flow logs and/or network traffic to review and alert upon from network devices.

Notes: The security function associated with this safeguard is Detect.

13.7) Deploy a Host-Based Intrusion Prevention Solution

Description: Deploy a host-based intrusion prevention solution on enterprise assets where appropriate and/or supported. Example implementations include the use of an Endpoint Detection and Response (EDR) client or a host-based IPS agent.

Notes: The security function associated with this safeguard is Protect.

13.8) Deploy a Network Intrusion Prevention Solution

Description: Deploy a network intrusion prevention solution where appropriate. Example implementations include the use of a Network Intrusion Prevention System (NIPS) or equivalent CSP service.

Notes: The security function associated with this safeguard is Protect.

13.9) Deploy Port-Level Access Control

Description: Deploy port-level access control. Port-level access control utilizes 802.1x or similar network access control protocols such as certificates. They may incorporate user and/or device authentication, as well.

Notes: The security function associated with this safeguard is Protect.

13.10) Perform Application Layer Filtering

Description: Perform application layer filtering. Example implementations include a filtering proxy, application layer firewall, or gateway.

Notes: The security function associated with this safeguard is Protect.

13.11) Tune Security Event Alerting Thresholds

Description: Tune security event alerting thresholds monthly or more frequently.

Notes: The security function associated with this safeguard is Detect.

See how simple and effective security controls can create a framework that helps you protect your organization and data from known cyber-attack vectors by downloading this guide.

Read more about the 18 CIS Controls here:

CIS Control 1: Inventory and Control of Enterprise Assets

CIS Control 2: Inventory and Control of Software Assets

CIS Control 3: Data Protection

CIS Control 4: Secure Configuration of Enterprise Assets and Software

CIS Control 5: Account Management

CIS Control 6: Access Control Management

CIS Control 7: Continuous Vulnerability Management

CIS Control 8: Audit Log Management

CIS Control 9: Email and Web Browser Protections

CIS Control 10: Malware Defenses

CIS Control 11: Data Recovery

CIS Control 12: Network Infrastructure Management

CIS Control 13: Network Monitoring and Defense

CIS Control 14: Security Awareness and Skill Training

CIS Control 15: Service Provider Management

CIS Control 16: Application Software Security

CIS Control 17: Incident Response Management

CIS Control 18: Penetration Testing