Secure configuration hardens software and its underlying systems so attackers cannot easily exploit default or weak settings. It reduces unnecessary exposure by replacing defaults with approved settings, limiting access, and disabling functions the system does not need. section 7.4.5
A practical secure-configuration baseline includes:
- Change default administrator passwords before deployment. section 7.4.5
- Create gold images containing approved and vetted security settings, so newly created systems begin from a consistent baseline. section 7.4.5
- Turn off unused ports and apply least privilege to access controls. section 7.4.5
- Use regular security scanning and auditing to monitor vulnerabilities and review security practices and compliance. section 7.4.5
A repeatable deployment baseline
Before deploying a new system, an organization can build it from a gold image, replace administrative defaults, disable unused ports, and restrict access to necessary privileges. Repeated scanning and auditing then identify drift or newly exposed weaknesses for investigation. section 7.4.5
Table 1.2 CIS TOP 18 Controls Version 8
| # |
CIS Critical Security Control (v8) |
Purpose |
| 1 |
Inventory and control of enterprise assets |
Know every device that touches the network and manage it continuously to eliminate blind spots. |
| 2 |
Inventory and control of software assets |
Track and authorize all software so only approved, secure applications can run. |
| 3 |
Data protection |
Safeguard sensitive data in motion and at rest, preventing unauthorized disclosure or alteration. |
| 4 |
Secure configuration of enterprise assets and software |
Harden systems and applications with proven baseline configurations to reduce the attack surface. |
| 5 |
Account management |
Establish and maintain the full lifecycle of user and service accounts to prevent abuse. |
| 6 |
Access control management |
Enforce leastprivilege and role-based access so users can reach only what they truly need. |
| 7 |
Continuous vulnerability management |
Identify, prioritize, and repair vulnerabilities relentlessly to stay ahead of exploits. |
| 8 |
Audit log management |
Collect, protect, and analyze logs to detect anomalies and support investigations. |
| 9 |
Email and web browser protections |
Harden email and browsing pathways (i.e., common entry points) to block phishing and driveby attacks. |
| 10 |
Malware defenses |
Deploy antimalware at multiple layers to prevent, detect, and respond to malicious code. |
| 11 |
Data recovery |
Ensure reliable, protected backups and tested recovery procedures to restore data after incidents. |
| 12 |
Network infrastructure management |
Secure, maintain, and segment network devices to limit lateral movement and exposure. |
| 13 |
Network monitoring and defense |
Continuously inspect network traffic for suspicious activity and respond in near real time. |
| 14 |
Security awareness and skills training |
Educate workforce regularly so human behavior reinforces—rather than undermines—security controls. |
| 15 |
Service provider management |
Govern and monitor third-party providers to ensure they meet your security expectations. |
| 16 |
Application software security |
Build and maintain software securely through coding standards, testing, and remediation. |
| 17 |
Incident response management |
Prepare, detect, contain, and recover from security incidents swiftly and methodically. |
| 18 |
Penetration testing |
Validate the effectiveness of all controls by emulating real-world attacker techniques. |
Use the CIS Top 18 table to place secure configuration within a prioritized set of practical cybersecurity controls and compare it with asset, account, access, and monitoring controls. section 1.5.2
