Charles River Associates Security Hygiene Snapshot

Unfamiliar Assets

• Identify unmanaged servers, laptops, and desktops
• Identify higher risk software applications
• Identify users endpoints storing PII

Risk Analysis–Vulnerability and Patching

• Identify high risk vulnerabilities
• Confirm application of approved security patches

Uncontrolled access privileges

• Identify administrative privileges and ensure appropriate access across the environment and the ability of a threat actor to move across the estate
• Test insider threat risk by reviewing range of use cases –such as –ability to access cloud storage websites and transfer data remotely, and reviewing attack path (e.g., How can we get from Laptop X to a sensitive zone")

Align with CIS, NIST, ISO/IEC 27001

• Assess tactical compliance and help improve cyber maturity against control frameworks like ISA/IEC 62443, Centre for Internet Security (CIS) Top 20, the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), and ISO/IEC 27001