CIS Control 6 merges some aspects of CIS Control 4 (admin privileges) and CIS Control 14 (access on a need-to-know basis) into a single access control management group. Access control management is a critical component in maintaining information and system security, restricting access to assets based on role and need. It is important to grant, refuse, and remove access in a standardized, timely, and repeatable way across an entire organization.
Privileged accounts, such as administrators, should be protected with multi-factor authentication. Enforcing and maintaining access control policies can be made significantly less painful with automated tools. In the same vein as protecting data assets, users and service accounts are also assets that need to be protected.
Many of the Safeguards in Control 6 are foundational, and even the smallest organizations should implement them. Organizations with more resources or assets that are subject to regulatory and compliance oversight or who may face threats from sophisticated adversaries should strive to implement centralized role-based access control measures.
CIS Benchmarks, which are available for many product families, are best-practice security configuration guides that are mapped to the controls and walk you through configuration remediation step-by-step.
Key Takeaways for Control 6
An access control management plan should at least implement processes to:
- Ensure that access is granted and revoked in a systematic and preferably automated way.
- Enable multi-factor authentication for all users with privileged or remote access as well as externally exposed or third-party applications.
A more comprehensive plan should incorporate centralization, automation, a maintained inventory, and role-based access.
Safeguards for Control 6
6.1) Establish an Access Granting Process
Description: Establish and follow a process, preferably automated, for granting access to enterprise assets upon new hire, rights grant, or role change of a user.
Notes: The security function for this safeguard is Govern. Protecting enterprise assets and ensuring that users are provided appropriate access in a regulated manner. Every organization should implement this Safeguard.
6.2) Establish an Access-Revoking Process
Description: Establish and follow a process, preferably automated, for revoking access to enterprise assets through disabling accounts immediately upon termination, rights revocation, or role change of a user. Disabling accounts instead of deleting accounts may be necessary to preserve audit trails.
Notes: The security function for this safeguard is Govern. enterprise assets by ensuring that user access is deprovisioned in a regulated manner. Every organization should implement this Safeguard.
6.3) Require MFA for Externally-Exposed Accounts
Description: Require all externally exposed or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this Safeguard.
Notes: The security function for this safeguard is Protect accounts by requiring at least a second authorization mechanism. Every organization should implement this Safeguard.
6.4) Require MFA for Remote Network Access
Description: Require MFA for remote network access.
Notes: The security function for this safeguard is Protect enterprise assets by requiring users accessing the network remotely to have multi-factor authentication. Every organization should implement this Safeguard
6.5) Require MFA for Administrative Access
Description: Require MFA for all administrative access accounts, where supported, on all enterprise assets, whether managed on-site or through a third-party provider.
Notes The security function for this safeguard is Protect enterprise assets by requiring privileged users, such as administrator accounts, using multi-factor authentication. Every organization should implement this Safeguard.
6.6) Establish and Maintain an Inventory of Authentication and Authorization Systems
Description: Establish and maintain an inventory of the enterprise’s authentication and authorization systems, including those hosted on-site or at a remote service provider. Review and update the inventory at a minimum of annually or more frequently.
Notes: The security function for this safeguard is Identify. In larger or more complex organizations, authentication and authorization systems should be maintained and inventoried on a systematic and regular basis. Organizations that have regulatory compliance burdens or store and process sensitive client data should implement this Safeguard.
6.7) Centralize Access Control
Description: Centralize access control for all enterprise assets through a directory service or SSO provider, where supported.
Notes: The security function for this safeguard is to Protect enterprise assets by ensuring that access controls are centralized, making them easier to automate and maintain. Organizations that have increased operational complexity have regulatory compliance burdens, or store and process sensitive client data should implement this Safeguard.
6.8) Define and Maintain Role-Based Access Control
Description: Define and maintain role-based access control through determining and documenting the access rights necessary for each role within the enterprise to successfully carry out its assigned duties. Perform access control reviews of enterprise assets to validate that all privileges are authorized on a recurring schedule at a minimum annually or more frequently.
Notes: The security function for this safeguard is Govern. The ability to govern enterprise assets by ensuring access rights are role-based and maintained in a standardized and reliable manner. Organizations with assets that are subject to regulatory and compliance oversight, as well as those targeted by sophisticated adversaries such as APTs, should implement this Safeguard.
See how simple and effective security controls can create a framework that helps you protect your organization and data from known cyber-attack vectors by downloading the CIS Controls guide here.
Read more about the 18 CIS Controls here:
CIS Control 1: Inventory and Control of Enterprise Assets
CIS Control 2: Inventory and Control of Software Assets
CIS Control 3: Data Protection
CIS Control 4: Secure Configuration of Enterprise Assets and Software
CIS Control 5: Account Management
CIS Control 6: Access Control Management
CIS Control 7: Continuous Vulnerability Management
CIS Control 8: Audit Log Management
CIS Control 9: Email and Web Browser Protections
CIS Control 10: Malware Defenses
CIS Control 12: Network Infrastructure Management
CIS Control 13: Network Monitoring and Defense
CIS Control 14: Security Awareness and Skill Training
CIS Control 15: Service Provider Management
CIS Control 16: Application Software Security
Zero Trust and the Seven Tenets
Understand the principles of Zero Trust in cybersecurity with Tripwire's detailed guide. Ideal for both newcomers and seasoned professionals, this resource provides a practical pathway to implementing Zero Trust, enhancing your organization's security posture in the ever-evolving digital landscape.
