Deploy a Network Intrusion Prevention Solution
Description
Deploy a network intrusion prevention solution, where appropriate. Example implementations include the use of a Network Intrusion Prevention System (NIPS) or equivalent CSP service.
Implementation Checklist
Tool Recommendations
Next-generation firewall platform with application-aware policies, threat prevention, URL filtering, and SD-WAN
Palo Alto Networks · Appliance + subscription
Cloud-native secure web gateway with inline inspection, URL filtering, sandboxing, and DLP for web traffic
Zscaler · Per-user subscription
Enterprise firewall with application visibility, IPS, malware defense, and encrypted traffic analytics
Cisco · Appliance + subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Network-Level Exploit Delivery Targeting Vulnerable Services
IntegrityAn attacker exploits a known vulnerability in an exposed network service by sending crafted packets that a firewall permits as legitimate traffic, succeeding because no network intrusion prevention system inspects payload content.
Automated Worm Propagation Across Network Boundaries
AvailabilityA network worm exploits a vulnerability in a common protocol and propagates across VLANs and subnets, as no inline network intrusion prevention system exists to detect and drop exploit traffic.
SQL Injection Attack Traversing Network to Database Tier
ConfidentialityAn attacker sends SQL injection payloads through the network to a backend database server, and without an inline NIPS to inspect and block malicious query patterns, the attack succeeds.
Vulnerabilities (When Safeguard Absent)
No Inline Network Traffic Blocking for Exploit Payloads
Without a NIPS, known exploit signatures and malicious payloads traversing the network cannot be automatically dropped, allowing successful exploitation even when attack patterns are well-documented.
Network-Level Attacks Not Prevented in Real Time
Absence of network intrusion prevention means attacks are only detected after the fact rather than blocked inline, giving attackers time to complete exploitation before any response occurs.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |