Implementing the CIS Controls
You prioritise the eighteen CIS Controls v8 by implementation group and verify and evidence inventory, configuration, access and logging safeguards on target servers from Kali.
Level 201 · 17 lessons · 15 practice labs
Lessons
The control set
- What the CIS Controls are and where they came from
- Implementation groups: IG1, IG2, IG3
- Controls and safeguards
- Quick task: choose an implementation group
Basic hygiene
- Hardware and software inventory
- Secure configuration
- Account and access management
- Continuous vulnerability management
- Audit log management
- Quick task: verify IG1 safeguards on a server
The other controls
- Data protection and recovery
- Malware and network defences
- Awareness and incident response
- Service providers and penetration testing
- Quick task: an evidence file for five safeguards
Measuring
- Scoring implementation
- Capstone: an IG1 assessment of a small office
Practice labs
- Choose an implementation group: Choose IG1, IG2 or IG3 for six organisation profiles and justify the choice.
- Match the safeguard to its control: Match twenty safeguard statements to their CIS control and implementation group.
- Plan the move from IG1 to IG2: From a growing company's IG1 assessment, select and order the ten priority safeguards for IG2.
- Take the software inventory of a server: List the installed packages and running services on the lab server and compare them with the approved software list.
- Find the device missing from the inventory: Compare the lab network's lease and neighbour table output with the hardware inventory and report unrecorded devices.
- Remove unapproved software and prove it: Remove three unapproved programs from the server and save the before and after inventory output as evidence.
- Check the default accounts: List the passwordless, default and login-capable service accounts on the lab server.
- Verify the secure configuration safeguards: Verify session lock, firewall, unnecessary service and remote management settings on the server against IG1 safeguards.
- Fix dormant and administrator accounts: Disable accounts unused for forty-five days, separate the admin account used for daily work and document the change.
- Verify that logs are collected: Verify on the server that audit logging is on, the clock is synchronised and logs are kept for ninety days.
- Report the patch status: List pending updates on the server, separate the security updates and verify the automatic update setting.
- Prioritise the scan results: Rank the findings in a prepared vulnerability scan report for your own lab server by severity and exposure and write a thirty-day fix plan.
- Prepare an evidence file for a safeguard: Create an evidence file with command output, date and system name for five IG1 safeguards.
- Test the backup and recovery safeguard: Restore a folder on the lab server from backup, verify its integrity and record the time taken.
- An IG1 score for a small office: From two servers and prepared interview notes, score IG1 safeguards for policy, implementation and automation and produce a results table.
About this course
You prioritise the eighteen CIS Controls v8 by implementation group and verify and evidence inventory, configuration, access and logging safeguards on target servers from Kali.
What you will learn
- The control set
- Basic hygiene
- The other controls
- Measuring
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.