In Safeguard 7.1, we discussed the difference between running a vulnerability scanner and operating a vulnerability management program. A scan may identify weaknesses, but the organization still needs a documented process that explains what happens next. That brings us to CIS Safeguard 7.2: Establish and Maintain a Remediation Process. The safeguard calls for a documented, risk-based remediation strategy that is reviewed at least monthly. The phrase “risk-based” matters. Most organizations...
Require MFA for Externally‑Exposed Applications This article is part of our ongoing CIS IG1 series focused on practical, high‑impact security...
CIS IG1 Control 6.2 – Establish an Access Revoking Process by Heath Gieson If access granting is where intent is established, access revoking...
Access Should Be Granted Intentionally By Tim Marley As we move into CIS Control 6, Access Control Management, we're going to spend the next...
by Heath Gieson CIS IG1 Safeguard 5.4 states that administrator privileges should be restricted to dedicated administrator accounts, and that...
by Heath Gieson Years ago, I worked with a client to implement multi‑factor authentication across their organization. As part of the project,...
CIS IG1 Safeguard 5.2: Why Unique Passwords Still Matter in a Multi-Factor World By Heath Gieson CIS Safeguard 5.2 is deceptively simple on the...
Security Complexity Is an Operational Risk by Heath Gieson Most organizations do not set out to create a complex security environment. It usually...
As we move into CIS Control 5, Account Management, we're going to spend a few weeks working through the individual safeguards. We're starting with...
by Heath Gieson Manage Default Accounts on Enterprise Assets and Software As we continue through the CIS IG1 controls, a consistent pattern keeps...
