Top 20 Cybersecurity Defenses Proposed

The government-private organization guidelines are expected to become baseline best practices for computer security.
According to Paller, CAG also should serve another purpose: defending against data breach liability litigation. He points to recent data breach lawsuits against RBS and Heartland Payment Systems (15 at last count), and the $20 million data-breach lawsuit settlement that the Department of Veterans Affairs agreed to pay, as a sign that baseline cybersecurity standards need to be established to guide the courts and those charged with information defense.

CAG includes the following controls, the first 15 of which are subject to automated measurement and validation, with the remaining five being less clearly defined actions:

  1. Inventory of Authorized and Unauthorized Hardware
  2. Inventory of Authorized and Unauthorized Software
  3. Secure Configurations for Hardware and Software For Which Such Configurations Are Available
  4. Secure Configurations of Network Devices Such as Firewalls And Routers
  5. Boundary Defense
  6. Maintenance and Analysis of Complete Security Audit Logs
  7. Application Software Security
  8. Controlled Use of Administrative Privileges
  9. Controlled Access Based On Need to Know
  10. Continuous Vulnerability Testing and Remediation
  11. Dormant Account Monitoring and Control
  12. Anti-Malware Defenses
  13. Limitation and Control of Ports, Protocols, and Services
  14. Wireless Device Control
  15. Data Leakage Protection
  16. Secure Network Engineering
  17. Red Team Exercises
  18. Incident Response Capability
  19. Assured Data Backups
  20. Security Skills Assessment and Training to Fill Gaps

Going forward, CAG faces a six-step review process: 30 days of public comment, a pilot test, a CIO Council review, an inspector general review, control automation workshops, and comparison with existing audit regulations.

InformationWeek polled more than 400 business technology professionals to determine which threats they consider the most serious. Download the report here (registration required).

Editors' Choice
Jai Vijayan, Contributing Writer, Dark Reading
Kelly Jackson Higgins 2, Editor-in-Chief, Dark Reading