Ransomware Prevention
Cyber Gap Analysis (Ransomware protection)
Enforce MFA, use least privileges or just-enough privilege, and implement Privileged Access Management (PAM) and Privileged Identity Management (PIM).
Patch and update all software, OSs (including network devices) to the latest supported versions.
Ensure you are using the latest protection solutions including EDR or Extended Detection and Response (XDR).
Implement next-generation network protection: firewalls, Intrusion and Detection Prevention (IDP), Intrusion Prevention Systems (IPSs), and so on.
Implement network segmentation.
Restrict the use of scripting to approved users.
Secure your Domain Controllers (DCs).
Block access to malicious sites.
Only allow trusted devices on your network.
Disable the use of macros.
Only allow approved software to be used by your users.
Remove local admin permissions.
Enable advanced filtering for email.
Use Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).
Block Server Message Block (SMB) outbound protocol and remove outdated versions.
Follow best practices to harden your end-user and infrastructure devices.
Protect your cloud environment with best practices, especially public file shares.
Review your remote strategy and ensure outside connections into your environment are secure. If Remote Desktop Protocol (RDP) is needed, ensure best practices are deployed.
For backups, maintain an offline backup or air gap, encrypt all backups, and validate recovery by testing regularly.
Implement and focus attention on a well-defined Vulnerability Management Program (VMP).
Implement a good cybersecurity and awareness program. Train users not to click on links or open attachments unless they are confident they are legitimate.
Build a mature Vendor Risk Management (VRM) program.
Understanding current organization security environment and posture
Understanding critical information security issues faced/facing by organization
Initiating cyber security best practices
Developing modern Cyber Security program with Defense in Depth and Zero Trust
Developing Cyber Security Strategies to mitigate threats
Directing/Managing
Asset Management
High valued assets
Critical assets for operations
Cyber Physical Security Management
Hardware Security Management
IOT/OT/SCADA Security Management
Cyber Security Operations
SIEM
Audit log management
SOC
SOC Playbooks
SOAR
Incident Response
Identifying
Containing
Eradicating
recovering
Security breach management
Ransomware
Data loss
Shadow IT
Cloud Security Management
Cloud Security Architecture
Cloud Security tools
CASB, CWPP, CSPM
Security attacks
Cloud security frameworks
CSA, cloud adoption frameworks
Cloud computing policy
Cloud storage policy
Zero trust on cloud
SecDevOps/DevSecOps/Security Engineering
Shift left with security in DevOps Pipeline
Security Misconfigurations
Security automation
Infrastructure as code
Data Encryption
Symmetric
Asymmetric
Hashing
Encoding
Key exchange
Certificates
Digital signature
Data Privacy
Application Security
Secure Coding and software development
Security Awareness
Security First
Security Situational Awareness
Cryptography, Data Security and Protection
Vulnerability and Patch Management
Build
Audit
Review
Network Security/Perimeter security
Layered security controls
NGFW, NSM, IDS/IPS, Load Balancers, Proxies,
VPN, IPsec
Endpoint Security
End-user Security
EDR, XDR, HIDS,HIPS, EPP, FIM, Sandboxing, whitelist/blocklist
Malware defense
Cyber Security Governance, Risk, Compliance Management
Risk Assessment and Management
Information security Management
Security policies
Business continuity
Disaster Recovery
Cyber Security Maturity Models
Cyber Security Architecture
Zero Trust Model
Zero trust network access
Cyber Security Frameworks and controls
NIST cyber security framework
CIS critical controls
CMMC
NIST SP 800-171
NIST SP 800-53
Cyber Defense architecture and frameworks
MITRE ATT&CK
Cyber Security Standards
Cyber Security Reporting
Cyber Gap Analysis
Cyber Security Strategic Plan
Security workflow and relationships among multiple teams
Cyber Security Budget Management
Cyber Security Team performance, growth, learning
Penetration Testing/Red Team
Bring your own device policies
Remote work policies
Cyber Security product and services SLA's
Developing Non-Disclosure Agreements
Cyber Threat Landscape
Threat actors
Nation state attacks
TTP's
Critical business operations
Stakeholders
Organization business goals and vision
Security metrics
Weekly
Monthly
Quarterly
Preparation:
Offline backups availability and integrity check
Maintain and Audit golden images and build templates
Use of Infrastructure as a code to deploy images
Manage IaC in versions for audit purpose
Storing application source code or executables as backup
Removing and replacing outdated hardware
Using multi cloud solutions and maintaining cloud backups, using immutable storage solutions
Audit cloud environment
Develop and audit incident response, communication and breach notification plan
Develop Cyber incident response playbook
Build and implement Zero Trust Architecture
Prevention and Mitigating:
Develop surface discovery plan and audit attack finding
Monitor deep web notification/credential monitoring services
Periodical vulnerability Scans (review CISA Know vulnerability list)
External
Internal
VPN Infra
Periodical patch management
Assets security
BYOD
All devices on hybrid infrastructure
Protocol, port and service usage metrics
RDP
Have visibility to configuration and change management
Implement MFA
Disable weak protocols
SMB v 1 and v 2
Audit SMB traffic
Implement SMB signing and audit
Blocking external access
SMB
TCP 445
UDP 137
UDP 138
TCP 139
Implement SMB encryption with Universal Naming Convention (UNC) hardening
Log and monitor SMB and RDP traffic
Initial Access:
Implement
Phishing resistant MFA and password less MFA
IAM
PAM
Change default creds
Restrict use of root or system admin users s
Password minimum length and policies
Password rotation
Password management tools
Failed login attempts metrics and audit
Disabling saving passwords to browser using Group Policy
Local Administrator Password solution (LAPS)
LSASS : implement attack surface reduction rule
Windows credential guard
Use Windows PowerShell Remoting, Remote Credential Guard, or RDP with restricted
Admin Mode
Separation of admin and user accounts
Conduct security awareness training
Email attachments known bad
Disable office macros
Disable Windows Script Host (WSH)
Review malware infections
Ex: s QakBot, Bumblebee, and Emotet
Phishing email metrics and BEC scams
How many blocked
How many bypassed
EDR implementation
Windows Defender Application Control (WDAC), AppLocker
Application allow listing
Implement of EDR on cloud
Threat intel and feed into security stack
Security awareness training
Protective DNS
Sandboxed browsers
Monitor
Seo poisoning
Drive by download
Malvertising
Restricting PowerShell usage and alerts
Keywords:
CISA
MSISAC
FBI IC3
NSA
ZTA
References:
Last updated
Was this helpful?