Center for Internet Security

The Center for Internet Security (CIS) is a 501(c)(3) nonprofit organization,[2][3] formed in October, 2000.[1] Its mission is to "identify, develop, validate, promote, and sustain best practice solutions for cyber defense and build and lead communities to enable an environment of trust in cyberspace".[8] The organization is headquartered in East Greenbush, New York, with members including large corporations, government agencies, and academic institutions.[1]

Center for Internet Security
Center for Internet Security logo
FoundedOctober 2000[1]
Type501(c)(3) nonprofit organization[2]
Legal statusActive
Location
Coordinates42°36′44″N 73°41′58″W
Chairman and interim CEO
John C. Gilligan[4][5]
Key people
Steven J. Spano, President and COO; Curtis W. Dukes, Executive Vice President; Board of Directors,[6] Executive Committee[7]
AffiliationsISACA, AICPA, IIA, ISC2, SANS Institute[1]
Websitewww.cisecurity.org

CIS employs a closed crowdsourcing model to identify and refine effective security measures, with individuals developing recommendations that are shared with the community for evaluation through a consensus decision-making process. At the national and international level, CIS plays an important role in forming security policies and decisions by maintaining the CIS Controls and CIS Benchmarks, and hosting the Multi-State Information Sharing and Analysis Center (MS-ISAC).[9]

Program areas

CIS has several program areas, including MS-ISAC, CIS Controls, CIS Benchmarks, CIS Communities, and CIS CyberMarket. Through these program areas, CIS works with a wide range of entities, including those in academia, the government, and both the private sector and general public to increase their online security by providing them with products and services that improve security efficiency and effectiveness.[10][11]

Multi-State Information Sharing and Analysis Center (MS-ISAC)

The Multi-State Information Sharing and Analysis Center (MS-ISAC) is a "round-the-clock cyber threat monitoring and mitigation center for state and local governments" operated by CIS as a partnership with the Office of Cybersecurity and Communications in the United States Department of Homeland Security (DHS).[2] MS-ISAC was established in late 2002, and officially launched in January 2003, by William F. Pelgrin, then Chief Security Officer of the state of New York.[12] Beginning from a small group of participating states in the Northeast, MS-ISAC came to include all 50 U.S. States and the District of Columbia, as well as U.S. Territorial, Tribal, and Local governments. In order to facilitate its expanding scope, in late 2010, MS-ISAC "transitioned into a not-for-profit status under the auspices of the Center for Internet Security." The transition was facilitated by CIS having "an established reputation for providing cybersecurity resources to the public and private sectors".[12][13]

MS-ISAC "helps government agencies combat cyberthreats and works closely with federal law enforcement",[14][15] and is designated by DHS as a key cyber security resource for the nation's State, Local, Territorial, and Tribal (SLTT) governments. The MS-ISAC 24x7 cyber security operations center performs network monitoring, issues early cyber threat warnings and advisories, and performs vulnerability identification and mitigation as well as incident response.[16]

The main objectives of MS-ISAC are described as follows:[17]

  • provide two-way sharing of information and early warnings on cyber security threats
  • provide a process for gathering and disseminating information on cyber security incidents
  • promote awareness of the interdependencies between cyber and physical critical infrastructure as well as between and among the different sectors
  • coordinate training and awareness
  • ensure that all necessary parties are vested partners in this effort

Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC)

The Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), as established by the Election Infrastructure Subsector Government Coordinating Council (GCC), is a critical resource for cyber threat prevention, protection, response and recovery for the nation's state, local, territorial, and tribal (SLTT) election offices. The EI-ISAC is operated by the Center for Internet Security, Inc.

The mission of the EI-ISAC is to improve the overall cybersecurity posture of SLTT election offices, through collaboration and information sharing among members, the U.S. Department of Homeland Security (DHS) and other federal partners, and private sector partners are the keys to success. The EI-ISAC provides a central resource for gathering information on cyber threats to election infrastructure and two-way sharing of information between and among public and private sectors in order to identify, protect, detect, respond and recover from attacks on public and private election infrastructure. And the EI-ISAC comprises representatives from SLTT election offices and contractors supporting SLTT election infrastructure.[18]

CIS Controls and CIS Benchmarks

CIS Controls and CIS Benchmarks provide global standards for internet security, and are a recognized global standard and best practices for securing IT systems and data against attacks.[3] CIS maintains "The CIS Controls", a popular set of 20 security controls "which map to many compliance standards", and are applicable to the Internet of things.[19] Through an independent consensus process, CIS Benchmarks provide frameworks to help organizations bolster their security. CIS offers a variety of free resources,[20] which include "secure configuration benchmarks, automated configuration assessment tools and content, security metrics and security software product certifications".[11]

The CIS Controls advocate "a defense-in-depth model to help prevent and detect malware".[21] A May 2017 study showed that "on average, organizations fail 55% of compliance checks established by the Center for Internet Security", with more than half of these violations being high severity issues.[22] In March 2015, CIS launched CIS Hardened Images for Amazon Web Services, in response to "a growing concern surrounding the data safety of information housed on virtual servers in the cloud".[23] The resources were made available as Amazon Machine Images, for six "CIS benchmarks-hardened systems", including Microsoft Windows, Linux and Ubuntu, with additional images and cloud providers added later.[23] CIS released Companion Guides to CIS Controls, recommendations for actions to counter cybersecurity attacks, with new guides having been released in October and December 2015.[24] In April 2018, CIS launched an information security risk assessment method for to implement CIS Controls, called CIS RAM which is based upon the risk assessment standard by the DoCRA Council.[25]

CIS Benchmarks are a collaboration of the Consensus Community and CIS SecureSuite members (a class of CIS members with access to additional sets of tools and resources).[26] The Consensus Community is made up of experts in the field of IT security who use their knowledge and experience to help the global Internet community. CIS SecureSuite members are made up of several different types of companies ranging in size, including government agencies, colleges and universities, nonprofits, IT auditors and consultants, security software vendors and other organizations. CIS Benchmarks and other tools that CIS provides at no cost allow IT workers to create reports that compares their system security to universal consensus standard. This fosters a new structure for internet security that everyone is accountable for that is shared by top executives, technology professionals and other internet users throughout the globe. Further, CIS provides internet security tools with a scoring feature that rates the configuration security of the system at hand. For example, CIS provides SecureSuite members with access to CIS-CAT Pro, a "cross-platform Java app" which scans target systems and "produces a report comparing your settings to the published benchmarks".[10] This is intended to encourage and motivate users to improve the scores given by the software, which bolsters the security of their internet and systems. The universal consensus standard that CIS employs draws upon and uses the accumulated knowledge of skillful technology professionals. Since internet security professionals volunteer in contributing to this consensus, this reduces costs for CIS and makes it cost effective.[27]

CIS CyberMarket

CIS CyberMarket is a "collaborative purchasing program that serves U.S. State, Local, Tribal, and Territorial (SLTT) government organizations, nonprofit entities, and public health and education institutions to improve cybersecurity through cost-effective group procurement".[28] The intent of the CIS CyberMarket is to combine the purchasing power of governmental and nonprofit sectors to help participants improve their cybersecurity condition at a lower cost than they would have been able to attain on their own. The program assists with the "time intensive, costly, complex, and daunting" task of maintaining cybersecurity by working with the public and private sectors to bring their partners cost-effective tools and services. The combined purchasing opportunities are reviewed by domain experts.[17]

There are three main objectives of the CIS CyberMarket:

  • contribute a trusted environment to improve the condition of the cybersecurity of the previously mentioned entities
  • lower the cost of cybersecurity needs
  • work with companies to bring services and security products to their partners[17]

CIS CyberMarket, like the MS-ISAC, serves government entities and non-profits in achieving greater cyber security. On its "resources" page, multiple newsletters and documents are available free of charge, including the "Cybersecurity Handbook for Cities and Counties".[16]

CIS Communities

CIS Communities are "a volunteer, global community of IT professionals"[3] who "continuously refine and verify" CIS best practices and cybersecurity tools.[29] To develop and structure its benchmarks, CIS uses a strategy in which members of the organization first form into teams. These teams then each collect suggestions, advice, official work and recommendations from a few participating organizations. Then, the teams analyze their data and information to determine what the most vital configuration settings are that would improve internet system security the most in as many work settings as possible. Each member of a team constantly works with their teammates and critically analyzes and critiques a rough draft until a consensus forms among the team. Before the benchmark is released to the general public, they are available for download and testing among the community. After reviewing all of the feedback from testing and making any necessary adjustments or changes, the final benchmark and other relevant security tools are made available to the public for download through the CIS website. This process is so extensive and is so carefully executed that thousands of security professionals across the globe participate in it. According to ISACA, "during the development of the CIS Benchmark for Sun Microsystems Solaris, more than 2,500 users downloaded the benchmark and monitoring tools."[30]

Participating organizations

The organizations that participated in the founding of CIS in October, 2000 include ISACA, the American Institute of Certified Public Accountants (AICPA), the Institute of Internal Auditors (IIA), the International Information Systems Security Certification Consortium (ISC2) and the SANS Institute (System Administration, Networking and Security). CIS has since grown to have hundreds of members with varying degrees of membership, and cooperates and works with a variety of organizations and members at both the national and international levels. Some of these organizations include those in both the public and private sectors, government, ISACs and law enforcement.[1]

References
  1. Kreitner, Clint; Miuccio, Bert. "The Center for Internet Security: Global Security Benchmarks for Computers Connected to the Internet". Information Systems Audit and Control Association (ISACA). Archived from the original on March 12, 2014. Retrieved July 25, 2017.
  2. Rulison, Larry (November 9, 2016). "E. Greenbush group monitored election for hackers". Albany Times Union.
  3. Buonanno, Nicholas (May 22, 2017). "High school students participate in cybersecurity internship". The Record.
  4. Ackerman, Robert K.; Pendleton, Breann (June 28, 2017). "More Than Just Your Regular Cyberthreats". Signal.
  5. "John M. Gilligan". Center for Internet Security. Retrieved July 25, 2017.
  6. "Center for Internet Security Board of Directors". Center for Internet Security. Retrieved July 25, 2017.
  7. "Center for Internet Security Executive Committee". Center for Internet Security. Retrieved July 25, 2017.
  9. Nazli Choucri, Stuart Madnick, and Priscilla Koepke, Institutions for Cyber Security: International Responses and Data Sharing Initiatives, Working Paper CISL# 2016-10 (August 2016) Cybersecurity Interdisciplinary Systems Laboratory (CISL), Sloan School of Management, Massachusetts Institute of Technology.
  10. "Information Security and Policy: About The Center for Internet Security". University of California, Berkeley. Retrieved July 25, 2017.
  11. "CIS Security Benchmarks Tools". George Mason University. Retrieved July 25, 2017.
  12. Lohrmann, Dan (May 30, 2015). "Interview with Retiring MS-ISAC Founder Will Pelgrin and Incoming CIS CEO Jane Lute". Government Technology.
  13. "Multi-State Information Sharing and Analysis Center". Center for Internet Security. Retrieved 2014-03-21.
  14. Nakashima, Ellen (August 29, 2016). "Russian hackers targeted Arizona election system". The Washington Post.
  15. Robert M. Clark and Simon Hakim, Protecting Critical Infrastructure at the State, Provincial, and Local Level: Issues in Cyber-Physical Security, Cyber-Physical Security (August 11, 2016), p. 11.
  16. "Welcome to the MS-ISAC". Center for Internet Security. Retrieved July 25, 2017.
  17. "Center for Internet Security". Center for Internet Security. Retrieved July 25, 2017.
  18. "EI-ISAC® Charter".
  19. Russell, Brian; Van Duren, Drew (2016). Practical Internet of Things Security. p. 83. ISBN 978-1785880292.
  20. Westby, Jody R. (2004). International Guide to Cyber Security. p. 213. ISBN 1590313321.
  21. Shelton, Debbie (December 2016). "A winning pair: governance and automated controls must work in tandem to achieve maximum results". Internal Auditor.
  22. Seals, Tara (May 26, 2017). "Cloud Environments Suffer Widespread Lack of Security Best Practices". Infosecurity Magazine.
  23. Seals, Tara (March 25, 2015). "Center for Internet Security Aims at AWS". Infosecurity Magazine.
  24. Seals, Tara (December 23, 2015). "Center for Internet Security Releases Companion Guides". Infosecurity Magazine.
  25. "CIS RAM FAQ". CIS® (Center for Internet Security, Inc.) website.
  26. "CIS SecureSuite Membership". Retrieved July 25, 2016.
  27. "Center for Internet Security Takes Leading Role in Industry Efforts to Enhance Security Automation". Business Wire. September 12, 2013.
  28. "CIS CyberMarket". Retrieved July 25, 2017.
  29. "CIS Communities". Retrieved July 29, 2017.
  30. "ISACA: Serving IT Governance Professionals". Archived from the original on March 2, 2013. Retrieved March 7, 2014.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.