In Safeguard 11.2, we talked about making sure backups happen automatically and frequently enough to meet the needs of the business. Once those copies exist, however, another question immediately follows. How are you protecting them? CIS Safeguard 11.3, Protect Recovery Data, addresses that question. The basic expectation is that recovery data should receive protections equivalent to the original data. If sensitive information requires encryption, restricted access, or other safeguards in...
Access Should Be Granted Intentionally By Tim Marley As we move into CIS Control 6, Access Control Management, we're going to spend the next...
by Heath Gieson CIS IG1 Safeguard 5.4 states that administrator privileges should be restricted to dedicated administrator accounts, and that...
by Heath Gieson Years ago, I worked with a client to implement multi‑factor authentication across their organization. As part of the project,...
CIS IG1 Safeguard 5.2: Why Unique Passwords Still Matter in a Multi-Factor World By Heath Gieson CIS Safeguard 5.2 is deceptively simple on the...
Security Complexity Is an Operational Risk by Heath Gieson Most organizations do not set out to create a complex security environment. It usually...
As we move into CIS Control 5, Account Management, we're going to spend a few weeks working through the individual safeguards. We're starting with...
by Heath Gieson Manage Default Accounts on Enterprise Assets and Software As we continue through the CIS IG1 controls, a consistent pattern keeps...
Why More Updates Are Coming — and Why That’s a Good Thing Over the next several weeks, organizations are likely to notice something familiar but...
When the Management Plane Becomes the Attack Plane by Heath Gieson A few years ago, I was sitting in a conference room with an executive team after...
