Los 20 Controles criticos de seguridad segun SANS

SANS Institute - Twenty Critical Controls for Effective Cyber Defense: Consensus Audit Guidelines (Version 2.0, Mayo 2009)

These 20 critical security controls were agreed upon by knowledgeable individuals from the groups listed above. The list includes 15 controls that can be validated at least in part in an automated manner and five that must be validated manually. It is important to note that the 20 control categories are not presented in order of priority. The process of gathering these specific controls and subcontrols focused on identifying the highest priority defenses and represent a subset of controls found in other audit guidelines and documents. Each of the 20 categories is important and offers high-priority techniques for thwarting real-world attacks.

• - Critical Control 1: Inventory of Authorized and Unauthorized Devices


• - Critical Control 2: Inventory of Authorized and Unauthorized Software


• - Critical Control 3: Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers


• - Critical Control 4: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches


• - Critical Control 5: Boundary Defense


• - Critical Control 6: Maintenance, Monitoring, and Analysis of Audit Logs


• - Critical Control 7: Application Software Security


• - Critical Control 8: Controlled Use of Administrative Privileges


• - Critical Control 9: Controlled Access Based on Need to Know


• - Critical Control 10: Continuous Vulnerability Assessment and Remediation


• - Critical Control 11: Account Monitoring and Control


• - Critical Control 12: Malware Defenses


• - Critical Control 13: Limitation and Control of Network Ports, Protocols, and Services


• - Critical Control 14: Wireless Device Control


• - Critical Control 15: Data Loss Prevention


• - Critical Control 16: Secure Network Engineering


• - Critical Control 17: Penetration Tests and Red Team Exercises


• - Critical Control 18: Incident Response Capability


• - Critical Control 19: Data Recovery Capability


• - Critical Control 20: Security Skills Assessment and Appropriate Training to Fill Gaps
  

Printer Friendly Version