4.6
IG1 IG2 IG3

Securely Manage Enterprise Assets and Software

Asset Type: Network
Security Function: Protect

Description

Securely manage enterprise assets and software. Example implementations include managing configuration through version-controlled-infrastructure-as-code and accessing administrative interfaces over secure network protocols, such as Secure Shell (SSH) and Hypertext Transfer Protocol Secure (HTTPS). Do not use insecure management protocols, such as Telnet (Teletype Network) and HTTP, unless operationally essential.

Implementation Checklist

1
Assess current protection controls in place
2
Configure and deploy required security controls
3
Test control effectiveness in non-production environment
4
Deploy to production and verify functionality
5
Document configuration and operational procedures
6
Select hardening benchmark (CIS Benchmarks, DISA STIGs)
7
Create baseline configuration templates
8
Deploy configurations using automation tools
9
Schedule compliance scanning to detect drift
10
Define access control requirements based on least privilege
11
Implement role-based access control (RBAC)
12
Configure access review and recertification process
13
Monitor and audit privileged access usage

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

Credential Interception via Insecure Management Protocols

Confidentiality

Administrative credentials transmitted over Telnet, HTTP, or unencrypted SNMP are captured by attackers performing network sniffing, granting full administrative control.

Man-in-the-Middle Attack on Management Traffic

Integrity

Attackers intercept and modify management commands sent over insecure protocols, altering device configurations, injecting backdoor accounts, or disrupting services.

Vulnerabilities (When Safeguard Absent)

Use of Insecure Management Protocols

Managing enterprise assets via Telnet, HTTP, or SNMPv1/v2 exposes administrative credentials and commands in plaintext on the network.

No Version-Controlled Infrastructure Configuration

Without version-controlled infrastructure-as-code for managing configurations, unauthorized changes are difficult to detect and impossible to reliably roll back.

Evidence Requirements

Type Evidence Item Collection Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Configuration compliance scan results against approved baseline Scanned monthly
Document Approved baseline configuration documentation Reviewed quarterly
Record Access review/recertification records with sign-off Quarterly
Technical Access control configuration evidence (RBAC settings, group memberships) Reviewed quarterly
Document Governing policy document (current, approved, communicated) Reviewed annually