A group of federal agencies and private organizations, including the National Security Agency and the Department of Homeland Security, has released a set of guidelines defining the top 20 things organizations should do to prevent cyberattacks.
The Consensus Audit Guidelines (CAG) describe the 20 key actions, referred to as security controls, that organizations should take to defend their computer systems. The controls are expected to become baseline best practices for computer security, following further public- and private-sector review.
CAG is being led by John Gilligan, formerly the CIO for both the U.S. Air Force and the U.S. Department of Energy, and a member of the Obama transition team dealing with IT in the Department of Defense and various intelligence agencies.
"We are in a war, a cyberwar," Gilligan said on a media conference call. "And the federal government is one of many large organizations that are being targeted. Our ability at present to detect and defend against these attacks is really quite weak in many cases."
Borrowing an analogy he attributed to an unnamed federal CIO, Gilligan said, "We're bleeding badly and we really need triage and we need to focus on things that will keep this patient alive."
The CAG initiative represents part of a larger effort, backed by the Center for Strategic and International Studies (CSIS) in Washington, D.C., to implement recommendations from the CSIS Commission report on Cybersecurity for the 44th Presidency.
"This will definitely make the federal government a harder target," said James Lewis, a senior fellow at CSIS, during the conference call.
"This is the best example of risk-based security I have ever seen," said Alan Paller, director of research at the SANS Institute, in a statement. "The team that was brought together represents the nation's most complete understanding of the risk faced by our systems. In the past, cybersecurity was driven by people who had no clue of how the attacks are carried out. They created an illusion of security. The CAG will turn that illusion to reality."
According to Paller, CAG also should serve another purpose: defending against data breach liability litigation. He points to recent data breach lawsuits against RBS and Heartland Payment Systems (15 at last count), and the $20 million data-breach lawsuit settlement that the Department of Veterans Affairs agreed to pay, as a sign that baseline cybersecurity standards need to be established to guide the courts and those charged with information defense.
CAG includes the following controls, the first 15 of which are subject to automated measurement and validation, with the remaining five being less clearly defined actions:
- Inventory of Authorized and Unauthorized Hardware and Inventory of Authorized and Unauthorized Software
- Secure Configurations for Hardware and Software For Which Such Configurations Are Available
- Secure Configurations of Network Devices Such as
- Firewalls And Routers
- Boundary Defense
- Maintenance and Analysis of Complete Security Audit Logs
- Application Software Security
- Controlled Use of Administrative Privileges
- Controlled Access Based On Need to Know
- Continuous Vulnerability Testing and Remediation
- Dormant Account Monitoring and Control
- Anti-Malware Defenses
- Limitation and Control of Ports, Protocols, and Services
- Wireless Device Control
- Data Leakage Protection
- Secure Network Engineering
- Red Team Exercises
- Incident Response Capability
- Assured Data Backups
- Security Skills Assessment and Training to Fill Gaps
Going forward, CAG faces a six-step review process: 30 days of public comment, a pilot test, a CIO Council review, an inspector general review, control automation workshops, and comparison with existing audit regulations.
InformationWeek polled more than 400 business technology professionals to determine which threats they consider the most serious. Download the report here (registration required).
