Ensure Security Contact Information is Registered Rule
This rule ensures the registration of security contact information.
| Rule | Ensure security contact information is registered |
| Framework | cis_v130 |
| Severity | ✔ Medium |
Ensure Security Contact Information is Registered for CIS_v1.3.0
Overview
The Center for Internet Security (CIS) benchmark version 1.3.0 includes a guideline ensuring that security contact information is correctly registered within an organization's systems or applications. This is a critical security control that allows for prompt contact in case of security incidents, alerts, or other relevant communications.
Detailed Description
Maintaining up-to-date security contact information is vital for an organization's security posture. It ensures that your IT security team can be reached quickly to mitigate the impact of any security breach or incident. The absence of this information can lead to delayed responses and potentially more damage to your systems and reputation.
Importance of Security Contacts:
- Facilitates prompt response to security incidents.
- Ensures that security notifications and information reach the right personnel.
- Helps to manage and maintain the organization's security infrastructure efficiently.
Troubleshooting and Remediation Steps
Troubleshooting:
- Verify if security contact information is up-to-date.
- Ensure that registration of contact information complies with CIS benchmark requirements.
- Check if all critical systems have a registered security contact.
- Confirm that security contacts are reachable and their information reflects current organizational roles.
Remediation:
Step 1: Identification of Security Contacts
Gather a list of all potential points of contacts within your security team. This should include names, roles, and contact information like email addresses, phone numbers, and physical office locations if applicable.
Step 2: Registration of Contact Information
For each system or application, register the security contact information. This typically involves accessing the administrative settings or security configurations and inputting the contact details where designated.
Step 3: Verification
After registration, verify the accuracy of the information. You can perform a test by sending a notification to the security contacts to ensure they receive it as expected.
Step 4: Documentation
Document the process and keep a record of the contact information that has been registered. This will be useful for audits and any future changes in security teams.
Step 5: Regular Updates
Make it a policy to regularly check and update the contact information. This could be tied to quarterly security reviews or any change in security staff.
Necessary Codes or CLI Commands
There are no universal codes or CLI commands applicable as the registration of security contact information will vary greatly depending on the system or application in use. However, for illustration, if the system in question is an Azure subscription, the following Azure CLI commands could be used:
# Login to Azure az login # Set the account subscription az account set --subscription "<Your_Subscription_ID>" # Update the security contact information az security contact create --name "<Contact_Name>" --email "<Email_Address>" --phone "<Phone_Number>" --alert-notifications "On" --alerts-admins "On"
Ensure that you replace
<Your_Subscription_ID><Contact_Name><Email_Address><Phone_Number>Conclusion
By systematically ensuring that security contact information is registered and kept current, an organization can strengthen its responsiveness to potential security risks. Following best practices and CIS benchmarks in this area are part of foundational security hygiene and should be enforced as a continuous process rather than a one-time activity. This is not just crucial for effective incident response, but also for maintaining compliance with prevailing security standards and regulations.