The ThreatLocker® Zero Trust Endpoint Protection Platform implements a strict deny-by-default, allow-by-exception security posture to give organizations the ability to set policy-based controls within their environment and mitigate countless cyber threats, including zero-days, unseen network footholds, and malware attacks as a direct result of user error.

With the capabilities of the ThreatLocker® Zero Trust Endpoint Protection Platform implemented into their cybersecurity strategy, organizations in any industry around the world can check off the requirements of most compliance frameworks and sleep better at night knowing they are protected from the most devastating of cyberattacks, such as ransomware.

ThreatLocker has shared a free downloadable asset to equip IT professionals with cybersecurity compliance best practices. This article aims to elaborate on, and provide a basic over of, the asset.

Complexities Across Compliance Frameworks

Cybersecurity compliance frameworks exist to assist organizations in constructing robust cybersecurity strategies that will keep them ahead of threats. However, each framework is often ambiguous, making it challenging to ensure the outlined requirements are met.

To add more complexity to interpreting the demands of this compliance framework brainteaser, individual frameworks are worded differently, even when pointing to the same technology needed.

Compliance Best Practices

Regardless of the compliance framework, there is a basic set of technical controls that organizations should implement to increase their security posture and move toward compliance.

1. Access Management Solutions

Organizations need a centralized account and access management solution that can inventory all access accounts, assign each user a unique ID, log all logins, provide role-based access, and enforce least privilege/least access. The account and access management solution should also enforce strong passwords, incorporate an automatic lockout after a specified number of failed login attempts, protect the authentication feedback, and disable identifiers after a period of inactivity.

2. Multi-Factor Authentication

Multi-factor authentication should be implemented and enforced for privileged account logins, for remote access logins, and when logging into any account accessible from the Internet.

3. Privileged Access Management (PAM)

A privileged access management (PAM) solution should be used to protect administrators and other privileged accounts. All privileged activity should be logged in a protected central location. Privileged operating environments are separated from non-privileged, and non-privileged working environments can’t access privileged. Privileged operating environments should not be able to access non-privileged operating environments, the internet, email, or other web services. The PAM solution should allow for deactivating privileged accounts after 45 days of inactivity.

4. Remote Access Management Systems

Organizations need a remote access management system that monitors and logs remote access, provides automatic session lockout, controls the execution of privileged commands, uses replay-resistant authentication, and uses patterned session locking to hide the display after a specified condition.

5. Allowlisting

Organizations must implement allowlisting (historically known as whitelisting) that provides an up-to-date software inventory, monitors installed software activity and integrity, logs all executions, and can remove or disable unused, unauthorized, and unsupported software, including operating systems. The allowlisting solution should incorporate application containment to prevent the creation of child processes and control the execution of mobile code, software, libraries, and scripts. Any new software should be first deployed in a sandbox environment and evaluated before permitting it in the organization.

6. Antimalware Solutions

Organizations must implement an antimalware solution that scans endpoints, web pages, and removable media in real-time, incorporates automatic definition updates, and prevents connection to malicious websites.

7. Firewalls

Organizations need to incorporate a firewall solution that uses the least privilege, blocks all unnecessary ports and access to the Internet, logs network activity, and terminates connection after inactivity or the end of a session.

8. Detection/Prevention Solutions

Organizations should implement an intrusion detection/prevention solution, taking both a proactive and reactive approach to their security.

9. Web Filters

Organizations need a web security solution that enforces network-based URL filters or DNS filtering.

10. Email Security

Email security solutions should be implemented to use only supported email clients, block all unnecessary file types at the email gateway, and use DMARC. Ensure that email servers have an active antimalware solution.

11. Microsegmentation

Organizations need a technical solution to microsegment the network virtually or using VLANs.

12. Removable Media

Organizations need to implement a solution to control removable media, including enforcing encryption and limiting access to it.

13. Mobile Device Management

Organizations should implement a mobile device management solution that encrypts mobile devices, controls mobile connections, and supports automatic lockout and remote wipe and lock.

14. Logging Solution

Organizations need a protected central logging solution that ingests and alerts on Windows event logs, application event logs, network logs, data access logs, and user activities uniquely traced to the user. The logs should be reviewed regularly.

15. Patch Management

Organizations need a patch management solution that scans their environment for missing patches, provides reports, and can apply them.

16. Penetration Testing

Organizations need to participate in penetration testing. Tests should be conducted internally and on all externally facing services. Any vulnerabilities found should be remediated.

17. Threat Intelligence Sharing

Organizations should participate in a threat intelligence sharing community in which they exchange information regarding threats and vulnerabilities so they can mitigate threats and vulnerabilities proactively.

18. Data Protection

Organizations need to implement measures to protect data. Data should have granular permissions applied. Only users who require access to specific data to perform job duties should be able to access that data.

19. Securely Discarding Data

Organizations need a system to securely dispose of data before equipment is reused or removed.

20. Encrypting Sensitive Data

Organizations should ensure that sensitive data is encrypted at rest (encrypted hard drives) and in transit (TLS or HTTPS) using a robust encryption algorithm.

21. Backing Up Systems

Organizations need to implement a backup system in which backups are performed regularly, duplicated with copies stored both on and offsite, and routinely tested to ensure the organization always has a working backup available to assist in disaster recovery efforts.

22. Physical Security Controls

Organizations should have adequate physical security controls to protect against unwanted access, such as locks, cameras, and fences. Employees and visitors should be monitored and logged. Assets should be inventoried, discovered, and tracked, and any unauthorized assets should be addressed.

23. Security Awareness Training

Organizations need to implement a role-based security awareness training solution, either produced in-house or purchased from a third-party provider.

24. Written Policies

Organizations must have written policies that employees read and sign to enforce each of the above technical controls.

Mapping Requirements Across Compliance Frameworks

Although compliance frameworks each have their own set of specific criteria, they share the common goal of helping organizations build robust cyber defense strategies to protect against cyberattacks and the resulting data loss. Protecting this hot commodity is essential as attackers seek to exploit valuable data.

Companies with a strong security posture, like those using the ThreatLocker® Endpoint Protection Platform, are already well on their way to achieving compliance with any framework. Add the ThreatLocker® Endpoint Protection Platform to your security strategy to help build a successful blueprint for compliance and achieve world-class protection against cyber threats.

ThreatLocker has curated a downloadable guidebook, “The It Professional’s Blueprint for Compliance”, that maps the parallel requirements of numerous compliance frameworks, including:

• NIST SP 800-171
• NIST Cybersecurity Framework (CSF)
• The Center for Internet Security (CIS) Critical Security Controls (CSC)
• The Essential Eight Maturity Model
• Cyber Essentials
• The Health Insurance Portability and Accountability Act (HIPAA)

The eBook presents a mapped table for each of the above 24 compliance best practices mapped across the, also above, six compliance frameworks.

The tables that reside within the chapters of this asset have been designed to provide detailed examples of what you can implement into your environment to check off the parallel requirements in each framework, from controls, to policies, to cybersecurity awareness training.

Download your free copy today

Companies with a strong security posture, like those using the ThreatLocker® Zero Trust Endpoint Protection Platform, are already well on their way to achieving compliance with any framework. Add the ThreatLocker® Zero Trust Endpoint Protection Platform to your security strategy to help build a successful blueprint for compliance and achieve world-class protection against cyber threats.

Learn more about ThreatLocker®

Jan 08, 2024NewsroomCyber Security / Zero Trust

Digital expansion inevitably increases the external attack surface, making you susceptible to cyberthreats. Threat actors increasingly exploit the vulnerabilities stemming from software and infrastructure exposed to the internet; this ironically includes security tools, particularly firewalls and VPNs, which give attackers direct network access to execute their attacks. In fact, Gartner identified attack surface expansion as a major trend to watch.

So, it is not surprising that External Attack Surface Management (EASM) is a growing priority for organizations. But traditional castle-and-moat-based security architectures are ineffective at protecting enterprises against today’s sophisticated attacks, which increasingly leverage AI and as-a-service models to maximize speed and damage.

Zero trust security is the best way to minimize the attack surface, prevent compromise, eliminate lateral movement, and stop data loss.

Register here and join Apoorva Ravikrishnan, Senior Manager of Product Marketing, to learn:

• The most prominent trends in today’s attack landscape
• How attackers discover and exploit infrastructure as part of their attack sequence
• How to leverage zero trust security to minimize your attack surface

Why attend?

This will not be the first time you might have come across a webinar on minimizing the attack surface. Shadow IT, public cloud web apps, increased usage of open source code, unsecured servers running RDP/VNC/SSH/Telnet/SNMP, IoT systems with legacy services, TLS/SSL misconfigurations, and vulnerable remote access systems like VPNs – all increase the attack surface. In truth, many of you would be thinking about reducing your attack surface daily. However, this is an excellent opportunity to hear about how even security tools such as VPNs and Firewalls increase your attack surface and what you can do about it.

• Understand how to take control of your digital footprint to reduce your external attack surface.
• Get to know why traditional security architecture is not built for digital transformation.
• Understand more about User-to-App segmentation for granular access and risk reduction.
• Get actionable insights from Zscaler – the world’s largest security cloud and a pioneer in Zero Trust architecture.

Tap into our security expertise to learn more about leveraging Zero Trust to minimize attack surfaces and keep your data, applications, and users secure. Register for the webinar here.