Implementing Zero Trust Controls for Compliance

Compliance Best Practices

Cybersecurity compliance frameworks exist to assist organizations in constructing robust cybersecurity strategies that will keep them ahead of threats.

There is a basic set of technical controls that organizations should implement to increase their security posture and move toward compliance.

1. Access Management Solutions

Organizations need a centralized account and access management solution that can inventory all access accounts, assign each user a unique ID, log all logins, provide role-based access, and enforce least privilege/least access. The account and access management solution should also enforce strong passwords, incorporate an automatic lockout after a specified number of failed login attempts, protect the authentication feedback, and disable identifiers after a period of inactivity.

2. Multi-Factor Authentication

Multi-factor authentication should be implemented and enforced for privileged account logins, for remote access logins, and when logging into any account accessible from the Internet.

3. Privileged Access Management (PAM)

A privileged access management (PAM) solution should be used to protect administrators and other privileged accounts. All privileged activity should be logged in a protected central location. Privileged operating environments are separated from non-privileged, and non-privileged working environments can't access privileged. Privileged operating environments should not be able to access non-privileged operating environments, the internet, email, or other web services. The PAM solution should allow for deactivating privileged accounts after 45 days of inactivity.

4. Remote Access Management Systems

Organizations need a remote access management system that monitors and logs remote access, provides automatic session lockout, controls the execution of privileged commands, uses replay-resistant authentication, and uses patterned session locking to hide the display after a specified condition.

5. Allowlisting

Organizations must implement allowlisting (historically known as whitelisting) that provides an up-to-date software inventory, monitors installed software activity and integrity, logs all executions, and can remove or disable unused, unauthorized, and unsupported software, including operating systems. The allowlisting solution should incorporate application containment to prevent the creation of child processes and control the execution of mobile code, software, libraries, and scripts. Any new software should be first deployed in a sandbox environment and evaluated before permitting it in the organization.

6. Antimalware Solutions

Organizations must implement an antimalware solution that scans endpoints, web pages, and removable media in real-time, incorporates automatic definition updates, and prevents connection to malicious websites.

7. Firewalls

Organizations need to incorporate a firewall solution that uses the least privilege, blocks all unnecessary ports and access to the Internet, logs network activity, and terminates connection after inactivity or the end of a session.

8. Detection/Prevention Solutions

Organizations should implement an intrusion detection/prevention solution, taking both a proactive and reactive approach to their security.

9. Web Filters

Organizations need a web security solution that enforces network-based URL filters or DNS filtering.

10. Email Security

Email security solutions should be implemented to use only supported email clients, block all unnecessary file types at the email gateway, and use DMARC. Ensure that email servers have an active antimalware solution.

11. Microsegmentation

Organizations need a technical solution to microsegment the network virtually or using VLANs.

12. Removable Media

Organizations need to implement a solution to control removable media, including enforcing encryption and limiting access to it.

13. Mobile Device Management

Organizations should implement a mobile device management solution that encrypts mobile devices, controls mobile connections, and supports automatic lockout and remote wipe and lock.

14. Logging Solution

Organizations need a protected central logging solution that ingests and alerts on Windows event logs, application event logs, network logs, data access logs, and user activities uniquely traced to the user. The logs should be reviewed regularly.

15. Patch Management

Organizations need a patch management solution that scans their environment for missing patches, provides reports, and can apply them.

16. Penetration Testing

Organizations need to participate in penetration testing. Tests should be conducted internally and on all externally facing services. Any vulnerabilities found should be remediated.

17. Threat Intelligence Sharing

Organizations should participate in a threat intelligence sharing community in which they exchange information regarding threats and vulnerabilities so they can mitigate threats and vulnerabilities proactively.

18. Data Protection

Organizations need to implement measures to protect data. Data should have granular permissions applied. Only users who require access to specific data to perform job duties should be able to access that data.

19. Securely Discarding Data

Organizations need a system to securely dispose of data before equipment is reused or removed.

20. Encrypting Sensitive Data

Organizations should ensure that sensitive data is encrypted at rest (encrypted hard drives) and in transit (TLS or HTTPS) using a robust encryption algorithm.

21. Backing Up Systems

Organizations need to implement a backup system in which backups are performed regularly, duplicated with copies stored both on and offsite, and routinely tested to ensure the organization always has a working backup available to assist in disaster recovery efforts.

22. Physical Security Controls

Organizations should have adequate physical security controls to protect against unwanted access, such as locks, cameras, and fences. Employees and visitors should be monitored and logged. Assets should be inventoried, discovered, and tracked, and any unauthorized assets should be addressed.