DevSecOps for the operations team
Q. What are the suggested open source security monitoring tools corresponding to the 20 CIS Critical Security Controls for Effective Cyber Defense?
Cyber security controls | Examples of security techniques |
CSC1: Inventory of Authorized and Unauthorized Devices | Endpoint security, asset management |
CSC2: Inventory of Authorized and Unauthorized Software | Endpoint security, asset management |
CS3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers. | CIS Security Benchmark, OpenSCAP |
CSC4: Continuous Vulnerability Assessment and Remediation | OpenVAS: http://www.openvas.org/ Nmap: https://nmap.org/ OWASP Dependency Check: https://www.owasp.org/index.php/OWASP_Dependency_Check |
CSC 5: Controlled Use of Administrative Privileges | Strong password complexity Auditing logs for root and administrator activities |
CSC 6: Maintenance, Monitoring, and Analysis of Audit Logs | Syslog, event logs, SIEM ELK: https://bitnami.com/stack/elk GrayLog: https:... |
