Category: Uncategorized

[av_textblock fold_type=” fold_height=” fold_more=’Read more’ fold_less=’Read less’ fold_text_style=” fold_btn_align=” textblock_styling_align=” textblock_styling=” textblock_styling_gap=” textblock_styling_mobile=” size=” av-desktop-font-size=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” font_color=” color=” fold_overlay_color=” fold_text_color=” fold_btn_color=’theme-color’ fold_btn_bg_color=” fold_btn_font_color=” size-btn-text=” av-desktop-font-size-btn-text=” av-medium-font-size-btn-text=” av-small-font-size-btn-text=” av-mini-font-size-btn-text=” fold_timer=” z_index_fold=” id=” custom_class=” template_class=” av_uid=’av-m7umftay’ sc_version=’1.0′ admin_preview_bg=”]
CIS Benchmarks are globally recognised guidelines that provide best practices for securely configuring IT systems, software, and networks. Developed by the Centre for Internet Security (CIS), these benchmarks help organisations strengthen their cybersecurity defences and reduce vulnerabilities in their digital assets.

What Are CIS Benchmarks?

CIS Benchmarks are detailed recommendations designed to “harden” IT systems against cyber threats. They cover a wide range of technologies, including operating systems, cloud services, databases, mobile devices, and network equipment. By following these guidelines, organisations can ensure their systems are configured securely and minimise risks associated with misconfigurations or weak security settings.

How Do CIS Benchmarks Work?

Each CIS Benchmark provides step-by-step instructions for securely configuring specific technologies. For example:

• Setting up strong password policies.
• Enforcing multi-factor authentication (MFA).
• Limiting access to sensitive systems.
• Regularly rotating access keys to prevent misuse.

The benchmarks are developed collaboratively by cybersecurity experts from around the world and undergo rigorous reviews to ensure they remain effective against emerging threats.

Levels of CIS Benchmarks

CIS Benchmarks are divided into two levels based on security needs:

1. Level 1: Basic security recommendations that are easy to implement without affecting functionality or business operations. These are suitable for most organisations.
2. Level 2: Advanced security measures designed for environments handling highly sensitive data. These require more expertise and resources but provide stronger protection.

Benefits of CIS Benchmarks

By adopting CIS Benchmarks, organisations can:

• Improve Cybersecurity: Reduce vulnerabilities caused by poor configurations.
• Achieve Compliance: Align with industry regulations like GDPR, PCI DSS, or HIPAA.
• Simplify Security Management: Use expert-vetted guidelines instead of trial-and-error approaches.
• Build Trust: Demonstrate commitment to cybersecurity to customers and stakeholders.

Examples of CIS Benchmark Applications

• Cloud Security: Protecting platforms like AWS, Microsoft Azure, or Google Cloud by following specific benchmarks tailored for cloud environments.
• Operating Systems: Securing Windows, macOS, or Linux systems with recommended configurations to prevent unauthorised access or malware infections.
• Network Devices: Hardening routers and firewalls to safeguard against external attacks.

Why Are CIS Benchmarks Important?

Misconfigured systems are one of the leading causes of cyberattacks. CIS Benchmarks provide a proven framework for addressing these risks effectively, helping organisations stay ahead of cyber threats while maintaining operational efficiency.

Conclusion

CIS Benchmarks offer practical and expert-approved guidelines for securing IT systems across industries. By implementing them, organisations can strengthen their cybersecurity posture, meet compliance requirements, and protect their digital assets from evolving cyber threats—all while ensuring their operations remain smooth and efficient.
[/av_textblock]

[av_textblock fold_type=” fold_height=” fold_more=’Read more’ fold_less=’Read less’ fold_text_style=” fold_btn_align=” textblock_styling_align=” textblock_styling=” textblock_styling_gap=” textblock_styling_mobile=” size=” av-desktop-font-size=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” font_color=” color=” fold_overlay_color=” fold_text_color=” fold_btn_color=’theme-color’ fold_btn_bg_color=” fold_btn_font_color=” size-btn-text=” av-desktop-font-size-btn-text=” av-medium-font-size-btn-text=” av-small-font-size-btn-text=” av-mini-font-size-btn-text=” fold_timer=” z_index_fold=” id=” custom_class=” template_class=” av_uid=’av-m7umftay’ sc_version=’1.0′ admin_preview_bg=”]

So the board of your new employer asks “Is it secure?”, what now?

To start with, lets unpack what our experience tells us they really mean, and then look at the areas you need to have a good grasp of where you can talk knowledgably about the organisations position.

So, “Is it secure?” they ask, which indicates that they’re not interested in either a technical response or a binary answer – rather the question reflects a broader concern about the organisations overall resilience, risk exposure and readiness to handle potential cyber threats. Therefore I would suggest that the underlying concerns are:

Are We Prepared for Threats? They want to understand whether the organisation’s systems, services, data and operations are adequately protected against current and emerging threats. This means that you need to know how effective standard security measures are, such as firewalls (perimeter & WAF), encryption of sensitive data, and your access controls. You should also know how you are managing critical vulnerabilities and whether they are being identified and addressed/mitigated, and finally, provide confidence that the organisation can detect and respond to breaches swiftly.

What Are the Risks? They want clarity on the specific risks to their organisation, as they will need to understand what assets (eg, customer data, staff data, financial data or intellectual property) are most at risk. The likelihood and potential impact of a cyber-attack, and how prepared the organisation is to mitigate and recover from an incident.

Are We Compliant? With the constant increase in regulatory scrutiny, the board needs assurance that the organisation complies with all the relevant legislation. Non-compliance could lead to legal penalties, reputational damage or financial losses (so make sure you understand the full picture and don’t just assume).

Can We Sustain Business Operations? Cybersecurity is not just about preventing attacks, but also about ensuring the business has sufficient resilience to operate should an incident occur. We would suggest that you need to be able to provide confidence that critical systems have been identified and can remain operational during an attack. Robust incident response plans are in place (ensure they’re up to date), and how quickly the organisation can recover from disruptions.

How Does This Impact our Reputation and Stakeholders? Cybersecurity has the ability to negatively impact the level of trust built up among customers, partners and investors. A breach can erode confidence in the brand, so you need to be able to provide reassurance that appropriate measures are in place to protect the organisations reputation.

Are We Investing Wisely? If you’re lucky enough to have a significant budget, the board will want to ensure that all investment in tools, training and resources align with the wider organisational business goals. Alongside their goals, you will also need to ensure that your own resources are being allocated effectively to address the most critical risks.

Are We Proactive or Reactive? Finally, they want confirmation that cybersecurity efforts are proactive and not reactive, by staying ahead of threats through regular updates, employee training, third-party risk assessments, and fostering a culture of cyber awareness across the organisation.

So in essence, the simple question of “Is it secure?” is shorthand for asking whether the organisation is resilient enough to withstand today’s complex threat landscape while protecting assets, reputation and stakeholders and reflects that cybersecurity is no longer just a technology issue, but also a significant operational risk if left unmanaged.

So in response to the question…

…the CISO must be prepared by being able to give a comprehensive, business focused response that addresses both the technical issues and  operational concerns. The answer must reassure the board while highlighting key areas of focus to maintain and improve the overall security posture. Therefore we would suggest the following strategies on how to respond and our top areas to prioritise initially.

Use Language they Understand (Avoid Technical Jargon) – always frame the response in terms of business risks, impacts and outcomes. For example, instead of discussing firewall configurations, explain how systems are protected against unauthorised access to prevent data breaches which could harm customer trust or disrupt operations.

Provide Evidence – Utilise measurable metrics and proof of security effectiveness, such as compliance scores, summarised vulnerability assessments, incident response readiness and risk management reports as transparency builds trust and confidence.

Highlight Resilience – Explain how the organisation is prepared to handle worse-case scenarios, can recover quickly from incidents, and ensure continuity of operations.

Communicate Proactively – Address emerging threats and evolving risks while outlining strategies for keeping the organisation ahead of the attackers – foresight is always better received than reports on reactive measures.

Collaborate on Risk Acceptance – Engage all members of the board in discussions about acceptable levels of risk and ensure alignment between security measures and business priorities.

We would suggest from our experience that your initial focus areas should consider:

Security Posture Assessment – You should focus on evaluating the organisation’s current security posture using metrics like vulnerability scores, patch management updates, compliance levels, and incident history. Regular reporting on these metrics ensures visibility into potential weaknesses.

Data Protection Strategy – Data security is paramount. You must ensure robust measures like encryption, access controls, segmentation, and monitoring are in place to protect sensitive information while meeting any regulatory or industry requirements.

Incident Response Preparedness – Developing and testing an incident response plan is critical for handling breaches effectively. This includes detailing recovery times, containment strategies, and communication protocols for stakeholders during crises.

Employee Awareness – Cybersecurity training programmes should be prioritised to equip employees with knowledge about phishing attacks, ransomware risks, and best practices for safeguarding company data, and most importantly, how to report them. Human error remains one of the biggest vulnerabilities.

By addressing these areas strategically and communicating effectively with the board, you can instil confidence in the organisation’s cybersecurity capabilities while ensuring alignment with broader business goals.

By engaging with Somniac Security, our experienced team can help you build and maintain trust with your board by supporting you and your team to develop and implement your cybersecurity strategy.  Contact us at info@somniacsecurity.com today to help safeguard your business against tomorrow’s challenges!
[/av_textblock]

[av_textblock fold_type=” fold_height=” fold_more=’Read more’ fold_less=’Read less’ fold_text_style=” fold_btn_align=” textblock_styling_align=” textblock_styling=” textblock_styling_gap=” textblock_styling_mobile=” size=” av-desktop-font-size=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” font_color=” color=” fold_overlay_color=” fold_text_color=” fold_btn_color=’theme-color’ fold_btn_bg_color=” fold_btn_font_color=” size-btn-text=” av-desktop-font-size-btn-text=” av-medium-font-size-btn-text=” av-small-font-size-btn-text=” av-mini-font-size-btn-text=” fold_timer=” z_index_fold=” id=” custom_class=” template_class=” av_uid=’av-m7umftay’ sc_version=’1.0′ admin_preview_bg=”]
The MITRE ATT&CK Framework is a globally recognised resource that helps organisations understand and defend against cyber threats. It is essentially a detailed “playbook” of the tactics, techniques, and procedures (TTPs) that cybercriminals use to attack systems. By studying this framework, organisations can improve their defences, detect threats more effectively, and respond swiftly to cyber incidents.

What Does MITRE ATT&CK Stand For

The name **ATT&CK** stands for:

• Adversarial Tactics
• Techniques
• Common Knowledge

It focuses on how attackers behave during different stages of a cyberattack, offering insights into their methods and objectives.

How Does MITRE ATT&CK Work?

The framework organises information into a structured “matrix” that maps out the various stages of an attack lifecycle. It highlights:

1. Tactics: These are the goals attackers aim to achieve during an attack, such as gaining initial access, evading defences, or stealing data. There are 14 tactics in total, covering every phase of an attack.
2. Techniques: These describe specific methods attackers use to achieve their goals. For instance, techniques might include phishing emails to gain access or using malware to maintain control over a system.
3. Sub-Techniques: These provide even more detailed examples of how attackers execute their techniques.

Why Is MITRE ATT&CK Important?

The framework is based on real-world observations of cyberattacks, making it highly practical and reliable. It helps organisations:

• Understand Threats: By showing how attackers operate, organisations can anticipate potential risks.
• Improve Defences: Security teams can identify gaps in their systems and implement targeted measures to address them.
• Enhance Threat Detection: The framework provides guidance on spotting suspicious activity linked to specific tactics and techniques.
• Streamline Incident Response: During a cyberattack, teams can use the framework to quickly identify the attacker’s methods and take appropriate action.

Who Uses MITRE ATT&CK?

MITRE ATT&CK is widely used by cybersecurity professionals across industries, including businesses, governments, and security providers. It’s particularly valuable for:

• Threat Hunting: Actively searching for signs of malicious activity in systems.
• Vulnerability Management: Prioritising which weaknesses to fix based on how attackers might exploit them.
• Incident Response: Analysing attacks to understand what happened and prevent future incidents.

Benefits of MITRE ATT&CK

1. Comprehensive Insight: It provides a detailed understanding of attacker behaviour across various platforms (e.g., enterprise systems, mobile devices).
2. Proactive Defence: Organisations can use it to predict and prepare for potential attacks rather than just reacting after the fact.
3. Common Language: It standardises how cybersecurity professionals describe threats, improving communication and collaboration.

In Summary

The MITRE ATT&CK Framework is like a guidebook for understanding how cybercriminals think and act. By using this resource, organisations can strengthen their cybersecurity strategies, detect threats earlier, and respond more effectively to attacks—all while staying ahead of evolving cyber risks.

Contact Somniac at info@somniacsecurity.com today to help safeguard your business against tomorrow’s challenges.
[/av_textblock]