20 critical controls do improve cybersecurity, but are you using them?

In the last four years the list of 20 Critical Security Controls for cyber defense developed by a consortium of government and private organizations has gained wide acceptance in the security community, but implementation of these prioritized tools and techniques is not yet mature, according to a recent survey.

That does not mean the controls aren’t working, said Ron Gula, CEO of Tenable Network Security, an enterprise vulnerability management company that participates in the consortium.

“In the large enterprises it’s going to take people a year or two to implement a plan” based on the controls, Gula said. “I think it’s in a good place.”

Government, which made up the largest segment of the respondents to the survey, with about 20 percent of the total, probably leads the private sector in using the controls, Gula said. Overall, his company’s government customers are ahead of the curve in adopting standardized, centralized security monitoring and auditing programs, which he said is a key part of defending IT systems. “If you are trying to keep the bad guys out, if you can’t manage that centrally you’re not going to be able to keep them out.”

Agencies’ willingness to use the controls list is not surprising, as they initially were conceived as a framework to shore up federal IT security. The surprise is the degree to which they are being adopted by the private sector as well.

The online survey of 699 security professionals was conducted earlier this year by the SANS Institute, one of the organizations involved in developing the list.

The Critical Security Controls were developed to help make work originally done by the National Security Agency available to civilian agencies and non-government organizations. NSA participated in the effort to take the information public, which was led by SANS, the Center for Internet Security and the Center for Strategic and International Studies. The original list was published in 2009 and has been updated periodically since then.

The goal of the list is to prioritize actions to improve enterprise security posture through a threat-focused approach rather than focusing on regulatory compliance. It offers a lens for focusing activity on areas of highest payback by concentrating on what threats are actually used to exploit security weaknesses.

The list has been misperceived as being in competition with government regulatory requirements such as the Federal Information Security Management Act, or with private-sector requirements such as those of the Payment Card Industry for organizations that handle credit card information. But the list is intended to complement rather than replace other requirements and to ease the job of compliance.

The National Institute of Standards and Technology’s Special Publication 800-53 contains more than 850 security controls that agencies can apply as needed to ensure baseline security under FISMA. But implementing a shorter prioritized list of security controls “sure makes it easier” to fill in gaps in compliance, Gula said.

The critical controls in the current list are not individual rules, tools or settings, but rather broader categories of policies and activities, ranging from inventories of devices to secure network engineering and penetration testing. Few of the controls stand alone, most are interrelated and not all controls will apply to everyone.

Overall, 73 percent of respondents to the survey said they have adopted or are planning to adopt at least some of the controls on the list. But less than 20 percent have a comprehensive plan for implementing the controls. This is not necessarily a problem. “The majority will focus their efforts on near-term implementations of the highest-priority controls and on upgrading existing implementations of some of the lower-level controls,” wrote John Pescatore, the author of the paper presenting the results.

The top barriers to implementing the controls are organizational and training issues, with operational silos and personnel skills gaps cited by about 40 percent of respondents. Although the list of controls is intended help organizations automate security practices, there is little use of automated tools for implementation by respondents, who often are engaged in day-to-day security operations that keep them from upgrading processes.

“It ultimately comes down to resources,” Pescatore wrote. Organizations have to be able to both improve maturity and automation while “fighting fires.” Budget tightening has made getting the needed resources difficult in recent years.

The value of the 20 Critical Security Controls ultimately is whether they help organizations secure their IT enterprises. And that is hard to determine.

“Security managers have historically reported that what they do reduces risks, but have had problems quantifying that reduction,” Pescatore wrote. “That trend continues here, with almost 80 percent of the survey respondents who have implemented the controls believing they have reduced risk, but less than 25 percent able to quantify that improvement in risk posture."