2: Jen Fox (VioPoint) on Critical Security Controls

### Overview In this presentation, Jen Fox, a reviewer for the Critical Security Controls (CSC) and treasurer for her local ISSA chapter, discusses how organizations can tackle overwhelming security control lists by prioritizing implementation through business context. Often faced with frameworks containing over 100 controls, security teams struggle to execute them effectively. Fox walks through the structure of the CIS Critical Security Controls (formerly SANS Top 20) and demonstrates a quantitative prioritization framework based on Quality Function Deployment (QFD) to turn failing baseline assessment scores into practical, tiered roadmaps.

### Key Topics - **CIS Critical Security Controls Overview**: Maintained now by the Center for Internet Security (CIS) and formerly by SANS, the controls represent a practical subset of standards like NIST SP 800-53 and ISO. While framed as 20 control families, they encompass roughly 140 individual sub-controls categorized across system, network, and application layers. - **Foundational Controls**: The first five controls form the bedrock of organizational security: inventory of authorized/unauthorized devices, software inventory, secure configurations, continuous vulnerability assessment and remediation, and controlled use of administrative privileges. - **Binary Gap Assessment**: Conducting an initial assessment using strict binary scoring (1 for fully implemented, 0 for not implemented/partial credit). Initial assessments commonly result in low overall coverage (such as 47%), which management often interprets negatively as an 'F'. - **Quality Function Deployment (QFD) Prioritization**: Applying a structured matrix to evaluate identified gaps against weighted business attributes rather than arbitrary labels like 'quick wins'.

### Technical Details Fox outlines an assessment and prioritization workflow utilizing a 1-3-5 rating scale across specific organizational attributes: 1. **Scoring Initial Baseline**: Each control gap receives a binary score (1 or 0; no partial credit). Results are visualized using radar charts to expose systemic weaknesses across families. 2. **Defining Weighted Business Attributes**: Typical attributes include: - Contribution to a solid security foundation (focus on top 5 controls) - Compliance mandate (PCI DSS, HIPAA, NERC CIP) - Environmental feasibility (e.g., organizational pushback against removing local admin or restricting USBs) - Existing technology in place - Staff training and availability - Cost-effectiveness 3. **Ranking Matrix**: Each gap is evaluated against the attributes using values of 1 (weak/low), 3 (medium), or 5 (strong/high). Multiplying ratings by attribute weights stratifies the controls into clear tiers: - **Top Tier (Immediate)**: High scores (~3.8–4.2+) representing readily actionable items that leverage existing tools and staff. - **Middle Tier (Medium-term)**: Items needing dedicated budget, new technology, or external partners over a 12–18 month horizon (e.g., building a vulnerability management program). - **Bottom Tier (Deferred)**: Controls currently out of reach due to lack of feasibility, tools, or skills.

### Takeaways A baseline assessment takes approximately half a day to interview administrators, followed by an hour with stakeholders to score the matrix. This process depersonalizes debates over 'pet projects' or conflicting opinions, translating security improvements into defensible quantitative data. Rather than reporting a raw failing score, security leaders can present executive leadership with a credible phased plan projecting clear coverage milestones (e.g., increasing coverage from 47% to 81%).