Exhibit D - SANS Consensus Audit Guidelines.pdf

2 Days Left to Save $200 on SANS Pen Test Hackfest 2014

Critical Security Controls

Critical Security Controls for Effective Cyber Defense Over the years, many security standards and requirements frameworks have been developed in attempts to address risks to enterprise systems and the critical data in them. However, most of these efforts have essentially become exercises in reporting on compliance and have actually diverted security program resources from the constantly evolving attacks that must be addressed. In 2008, this was recognized as a serious problem by the U.S. National Security Agency (NSA), and they began an effort that took an "offense must inform defense" approach to prioritizing a list of the controls that would have the greatest impact in improving risk posture against real-world threats. A consortium of U.S. and international agencies quickly grew, and was joined by experts from private industry and around the globe. Ultimately, recommendations for what became the Critical Security Controls (the Controls) were coordinated through the SANS Institute. In 2013, the stewardship and sustainment of the Controls was transferred to the Council on CyberSecurity (the Council), an independent, global non-profit entity committed to a secure and open Internet.

The Critical Security Controls focuses first on prioritizing security functions that are effective against the latest Advanced Targeted Threats, with a strong emphasis on "What Works" - security controls where products, processes, architectures and services are in use that have demonstrated real world effectiveness.

Standardization and automation is another top priority, to gain operational efficiencies while also improving effectiveness. The actions defined by the Controls are demonstrably a subset of the comprehensive catalog defined by the National Institute of Standards and Technology (NIST) SP 800-53. The Controls do not attempt to replace the work of NIST, including the Cybersecurity Framework developed in response to Executive Order 13636. The Controls instead prioritize and focus on a smaller number of actionable controls with high-payoff, aiming for a "must do first" philosophy. Since the Controls were derived from the most common attack patterns and were vetted across a very broad community of government and industry, with very strong consensus on the resulting set of controls, they serve as the basis for immediate high-value action.

Critical Security Controls - Version 5 1: Inventory of Authorized and Unauthorized Devices 2: Inventory of Authorized and Unauthorized Software 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers 4: Continuous Vulnerability Assessment and Remediation 5: Malware Defenses 6: Application Software Security 7: Wireless Access Control 8: Data Recovery Capability 9: Security Skills Assessment and Appropriate Training to Fill Gaps

10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches 11: Limitation and Control of Network Ports, Protocols, and Services 12: Controlled Use of Administrative Privileges 13: Boundary Defense 14: Maintenance, Monitoring, and Analysis of Audit Logs 15: Controlled Access Based on the Need to Know 16: Account Monitoring and Control 17: Data Protection 18: Incident Response and Management 19: Secure Network Engineering 20: Penetration Tests and Red Team Exercises

Home

Critical Security Controls

Guidelines

History

Solution Directory

Vendor Perspective

Critical Security Controls Mapping

• NERC CIP

• NERC CIP (Excel)

• Verizon Vocabulary for

Event Recording and Incident Sharing - VERIS

Critical Security Controls Survey

• Moving From Awareness to Action

Downloads

• The Critical Security Controls for Effective Cyber Defense

Find Training Live Training Online Training Programs Resources Vendor About

Login

Page 1 of 3SANS Institute - Critical Security Controls

10/7/2014http://www.sans.org/critical-security-controls/

This work is licensed under a Creative Commons Attribution-NoDerivs 3.0 Unported License.

To further clarify the Creative Commons license related to the 20 Critical Controls content, (i) All persons are authorized to use the content as a framework in their organization or to sell professional services related to the content (e.g. a consulting engagement to implement the 20 Critical Controls), and (ii) sale of the contents as a framework model is not authorized. Users of the 20 Critical Controls framework are also required to refer to http://www.sans.org/critical-security-controls/ when referring to the 20 Critical Controls in order to ensure that users are employing the most up to date guidance.

You may use the following code to embed the 20 Critical Controls on your site:

<iframe src="http://www.sans.org/critical-security-controls/" width="1000" height="1200" />

Latest Whitepapers

Ninth Log Management Survey Report By Jerry Shenk

Creating a Threat Profile for Your Organization By Stephen Irwin

A Practical Big Data Kill Chain Framework By Brian Nafziger

Last 25 Papers »

Latest Tweets @SANSInstitute

#HackFestSummit = 100% Pentesting Education! Plus a SECRET o [...] October 7, 2014 - 1:45 PM

All #cybersecurity professionals! Visit http://t.co/IMVCBT5S [...] October 7, 2014 - 12:59 PM

.@alanpaller to deliver the keynote at Cyber Defense San Die [...] October 7, 2014 - 12:58 PM

Contact Us

301-654-SANS(7267)

Mon-Fri 9am - 8pm EST/EDT info@sans.org

• Critical Security Controls Poster - Fall 2014

Feedback

Send Comments and Feedback to cca@sans.org

Page 2 of 3SANS Institute - Critical Security Controls

"It has really been an eye opener concerning the depth of security training and awareness that SANS has to offer."

- Michael Hall, Drivesavers

"As a security professional, this info is foundational to do a competent job, let alone be successful."

- Michael Foster, Providence Health and Security

"The perfect balance of theory and hands-on experience."

- James D. Perry II, University of Tennessee

Find Training Live Training Online Training Programs Resources Vendor About Privacy Policy Trademark Usage Policy Credits © 2000-2014 SANS™ Institute

Page 3 of 3SANS Institute - Critical Security Controls