According to Paller, CAG also should serve another purpose: defending against data breach liability litigation. He points to recent data breach lawsuits against RBS and Heartland Payment Systems (15 at last count), and the $20 million data-breach lawsuit settlement that the Department of Veterans Affairs agreed to pay, as a sign that baseline cybersecurity standards need to be established to guide the courts and those charged with information defense.
CAG includes the following controls, the first 15 of which are subject to automated measurement and validation, with the remaining five being less clearly defined actions:
- Inventory of Authorized and Unauthorized Hardware
- Inventory of Authorized and Unauthorized Software
- Secure Configurations for Hardware and Software For Which Such Configurations Are Available
- Secure Configurations of Network Devices Such as Firewalls And Routers
- Boundary Defense
- Maintenance and Analysis of Complete Security Audit Logs
- Application Software Security
- Controlled Use of Administrative Privileges
- Controlled Access Based On Need to Know
- Continuous Vulnerability Testing and Remediation
- Dormant Account Monitoring and Control
- Anti-Malware Defenses
- Limitation and Control of Ports, Protocols, and Services
- Wireless Device Control
- Data Leakage Protection
- Secure Network Engineering
- Red Team Exercises
- Incident Response Capability
- Assured Data Backups
- Security Skills Assessment and Training to Fill Gaps
Going forward, CAG faces a six-step review process: 30 days of public comment, a pilot test, a CIO Council review, an inspector general review, control automation workshops, and comparison with existing audit regulations.
InformationWeek polled more than 400 business technology professionals to determine which threats they consider the most serious. Download the report here (registration required).