cis-controls

Purpose

Implement prioritized CIS Controls for cyber defense, focusing on high-impact security controls.

When to Use

• ✅ Security hardening activities
• ✅ Compliance assessments
• ✅ Security baseline establishment
• ✅ Vendor security reviews

Critical CIS Controls

Control 1: Inventory and Control of Enterprise Assets

# Maintain asset inventory
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,Tags[?Key==`Name`].Value|[0],State.Name]' --output table

# Tag all resources
aws ec2 create-tags --resources i-1234567890abcdef0 --tags Key=Application,Value=CIA Key=Environment,Value=Production

Control 2: Inventory and Control of Software Assets

<!-- Track all dependencies in pom.xml -->
<dependencies>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-webmvc</artifactId>
        <version>${spring.version}</version> <!-- Version via parent property -->
    </dependency>
</dependencies>

Control 3: Data Protection

@Service
public class DataProtectionService {
    @Autowired
    private BytesEncryptor encryptor;
    
    public void protectSensitiveData(SensitiveData data) {
        // Encrypt at rest
        data.setEncryptedContent(encryptor.encrypt(data.getPlainContent()));
        
        // Classify data
        data.setClassification(DataClassification.CONFIDENTIAL);
        
        // Set retention period
        data.setRetentionUntil(LocalDate.now().plusYears(7));
        
        dataRepository.save(data);
    }
}

Control 4: Secure Configuration

# application-production.yml - Secure defaults
spring:
  security:
    user:
      name: ${ADMIN_USERNAME}
      password: ${ADMIN_PASSWORD}
  
server:
  port: 8443
  ssl:
    enabled: true
  error:
    include-stacktrace: never

Control 5: Account Management

@Service
public class AccountManagementService {
    
    @Scheduled(cron = "0 0 2 * * *") // Daily at 2 AM
    public void reviewAccounts() {
        // Disable inactive accounts
        List<User> inactiveUsers = userRepository.findInactiveSince(
            LocalDateTime.now().minusDays(90)
        );
        
        inactiveUsers.forEach(user -> {
            user.setEnabled(false);
            auditLog.log("Account disabled due to inactivity: " + user.getUsername());
        });
        
        userRepository.saveAll(inactiveUsers);
    }
}

Control 6: Access Control Management

@PreAuthorize("hasRole('ADMIN')")
public void deleteUser(String userId) {
    // Enforce least privilege
    auditLogger.logPrivilegedAction("DELETE_USER", userId);
    userRepository.deleteById(userId);
}

Control 8: Audit Log Management

@Aspect
@Component
public class AuditLoggingAspect {
    @Around("@annotation(Audited)")
    public Object auditMethod(ProceedingJoinPoint joinPoint) throws Throwable {
        String action = joinPoint.getSignature().getName();
        String user = SecurityContextHolder.getContext().getAuthentication().getName();
        
        auditLog.info("Action: {}, User: {}, Timestamp: {}", 
            action, user, Instant.now());
        
        return joinPoint.proceed();
    }
}

Control 16: Application Software Security

# Security scanning in CI/CD
mvn org.owasp:dependency-check-maven:check
mvn sonar:sonar -Dsonar.qualitygate.wait=true

Implementation Priority

1. IG1 (Implementation Group 1) - Essential for all organizations

   • Controls 1-6: Basic cyber hygiene

2. IG2 - Additional controls for medium-sized organizations

   • Controls 7-16: Enhanced security

3. IG3 - Comprehensive controls for large organizations

   • Controls 17-18: Advanced/specialized

Hack23 ISMS Policy References

CIS Controls Implementation:

• Information Security Policy - Governance (14.1-14.9)
• Asset Register - Control 1 (Asset Management)
• Data Classification Policy - Control 3 (Data Protection)
• Access Control Policy - Control 5-6 (Access Control)
• Vulnerability Management - Control 7 (Vulnerability Management)
• Secure Development Policy - Control 16 (Application Security)
• Incident Response Plan - Control 17 (Incident Response)
• Backup Recovery Policy - Control 11 (Data Recovery)
• Change Management - Control 8 (Audit Logging)
• Risk Assessment Methodology - Control 4 (Secure Configuration)

All Hack23 ISMS Policies: https://github.com/Hack23/ISMS-PUBLIC

CIA Platform Architecture References

• Security Architecture: CIA SECURITY_ARCHITECTURE.md - CIS Controls implementation
• Architecture: CIA ARCHITECTURE.md - System design

References

• CIS Controls v8.1: https://www.cisecurity.org/controls/v8
• CIS Implementation Guide: https://www.cisecurity.org/controls/cis-controls-implementation-guide
• ISO 27001:2022: https://www.iso.org/standard/27001
• NIST CSF 2.0: https://www.nist.gov/cyberframework