LEARN HOW YOUR MSP CAN USE LIONGARD’S ACTIONABLE ALERTS TO IMPLEMENT CIS CONTROLS.

As cybersecurity remains a core concern for MSPs, it can be daunting to stay on top of the many issues and best practices out there. Fortunately, organizations like the Center for Internet Security (CIS) have put together simplified guidelines to help you protect your business and clients against cyber threats. The CIS team of global experts developed 18 Critical Security Controls with prescriptive actions you can take to mitigate risk. Let’s dive in to see how Liongard can help your team support these CIS Controls.

 The Connection between Liongard and CIS Controls

Liongard provides MSPs with fresh, automated system data, which allows you to monitor customer environments for critical changes and receive alerts when something needs your attention. Liongard’s alerts span critical systems like Office 365, Active Directory, SQL Servers, firewalls, endpoints, and more—and they help support specific CIS Controls.

We’ve gone through our library of alert rules and matched each one to the corresponding CIS Control it supports. In some cases, our alerts overlap to support more than one CIS Control, so we’ve mapped them to the most relevant control in each case.

How to Use Liongard to Implement CIS Controls

Access and download the list of Liongard Actionable Alerts and the CIS Controls they support here.

For your convenience, the information can be sorted by System Inspector, general purpose, or the CIS Control number. The second sheet also includes all of the CIS Controls and reference material. 

From there, it’s easy to set up alerts in Liongard to monitor these CIS Controls:

Step 1: Select relevant alert rules for your MSP and/or customers (Use our library of alerts or customize your own.)
Step 2: Turn the rules on in a Template and decide which Environments to apply it to. It’s easy to start with a controlled test using a few rules and one customer Environment.
Step 3: When an alert rule’s threshold is met, an automated alert will be delivered to your destination of choice (Roar, PSA, and/or email), where your team can take the necessary action.

For more help on any of this, you can register for one of our free monthly Liongard Learning Q&A webinars.

Additionally, know that you can also run reports on Liongard data to audit the systems you are managing. For certain tasks like auditing firmware versions of firewalls, it may be easier to run a report in Liongard and create project work to get started. 

Examples of Liongard Rules that Support CIS Controls

The following are just a few examples of Liongard alert rules that MSPs have found useful in supporting specific CIS Controls:

You can view the full set of CIS Control-aligned Actionable Alerts here.

CIS Control #1: Inventory and Control of Enterprise Assets

Approximately 40 Actionable Alerts support this control, including:

Active Directory Servers or Workstations at or near End of Support
Windows Workstation Drives with Less Than 15% Freespace
Devices Added/Removed from a Network

CIS Control #2: Inventory and Control of Software Assets

Approximately 50 Actionable Alerts support this control, including:

AWS Change to Buckets List or Volume List
M365 Unassigned Licenses
TLS/SSL (Auto-Renewing) Certificate Expiration
Windows Server and Windows Workstation Upcoming Machine Warranty Expiration

CIS Control #4: Secure Configuration of Enterprise Assets and Software

Approximately 80 Actionable Alerts support this control, including:

Changes to Firewall Software Version
Changes to Firewall Configuration
Windows Server password Policy Modified
Windows Workstation Guest Account not Disabled

CIS Control #5: Account Management

Approximately 70 Actionable Alerts support this control, including:

Active Directory (Privileged) User with Stale Password
Google G Suite/Workspace (Privileged) Users Added/Removed/Modified
M365 Changes to Privileged/Active Mail/Enabled Users
Windows Server (Local Privileged) User Added/Deleted

CIS Control #6: Access Control Management

Approximately 55 Actionable Alerts support this control, including:

AWS Change to Security Groups or Roles List
Fortinet Fortigate Access Profiles or Groups Added/Removed Modified
M365 Exposure to Accounts with Weak Passwords

CIS Control #9: Email and Web Browser Protections

Approximately 15 Actionable Alerts support this control, including:

Internet Domain Changes to A/MX/NS/SPF Records
Internet Domain Email Forgery Exposures
M365 Internal or External Mail Forwarding Rule Added/Removed Modified

CIS Control #10: Malware Defenses

Approximately 9 Actionable Alerts support this control, including:

Webroot Infected Device Detected
Windows Workstation Change to Antivirus List
Windows Workstation Windows Defender Threats
SentinelOne Systems with Active Threats

Liongard is rooted in security and transparency best practices to maximize peace of mind for our employees, our MSP partners and their customers. If you’re interested in other security frameworks, we’ve also mapped how Liongard can help support NIST’s Cybersecurity Framework and functions here.

The post Cybersecurity: Using Liongard To Support CIS Controls appeared first on Liongard.