CIS IG1 Safeguard 6.5: Require MFA for Administrative Access by Heath Gieson This final article in the MFA mini‑series focuses on the accounts that hold the highest level of trust within an environment. The previous safeguards address where and how access occurs. This safeguard focuses on who holds the keys. Administrative accounts have the ability to create users, modify security settings, disable controls, and access sensitive systems. When an attacker gains administrative access, the...
by Tim Marley We have spent the last two weeks in the CIS Controls series talking about data management and data inventory. Knowing what you are...
by Heath Gieson It usually starts the same way. An alert comes in overnight. Maybe it is an email from a security vendor. Maybe it lands in a shared...
by Tim Marley Last week we talked about data management at a high level. The operating model, the responsibility, the reality that organizations are...
by Heath Gieson For healthcare organizations, cybersecurity and compliance are no longer just IT concerns—they are material financial risks...
by Tim Marley Over the course of my career, and particularly in the last five to ten years, the topic of data management comes up frequently....
Most organizations assume that corporate devices only run approved software. In reality, that assumption is often wrong. Users are inherently...
Most security conversations focus on what software exists in an environment. CIS Control 2.2 pushes the conversation one step further by asking a...
One of the themes we keep hitting in the CIS IG1 series is simple: you can’t protect what you don’t know you have. That’s true for hardware—and it’s...
When we kicked off this series with Control 1.1: Establish and Maintain a Detailed Enterprise Asset Inventory, we focused on the Identify security...
