Guidelines Related to Security in Smart Factories (Part 5) CIS Controls

Jul 22, 2020
Smart Factory Security

[Previous posts]

#1 - Concepts and Management Systems of IEC62443

#2 - System Design and Security Level of IEC62443

#3 - NIST Cyber Security Framework

#4 - NIST SP800


The purpose of this series is to explain typical examples of general-purpose guidelines for ICS and OT security and understand the concepts required for security in smart factories. As a subset of NIST SP800-53 which was introduced in Part 4, Part 5 explains the CIS Controls that correspond to practical guides.


What are CIS Controls?

CIS Controls are a framework focusing on fundamental measures that an organization should take first for cyber security. It is considered as a subset of NIST SP800-53 which has been described previously. Originally, they were prepared by the SANS institute (a non-profit organization established for IT security education) in 2008 and called SANS Top 20 Critical Security Controls. After that, they were transferred to the Center for Internet Security (CIS) (a community for providing the best practices in cyber security) in 2013.

The purpose of CIS Controls is to resolve “Fog of More (chaos due to tremendous numbers of choices)” in various security measures, and the controls aim at being a practical guide for achieving maximum effect with minimum measures, regardless of whether an organization is large or small.


Six Basic Controls

As requirements, they consist of 20 Controls (management measures) and 171 Sub-Controls in total. Controls 1 to 6 are Basics, and it is recommended to start with the following six categories.

1: Inventory and Control of Hardware Assets

2: Inventory and Control of Software Assets

3: Continuous Vulnerability Management

4: Controlled Use of Administrative Privileges

5: Secure Configuration for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers

6: Maintenance, Monitoring, and Analysis of Audit Logs


Table 1: List of Management Measures in CIS Controls (CIS Controls v7.1)



In addition, CIS Controls have been developed on the basis of five concepts.

・Offense informs defense


・Measurements and Metrics

・Continuous diagnostics and mitigation



The characteristics here are “Prioritizing” and “Automating.”

For prioritizing, an “Implementation group” is defined as the organization that uses the controls, and which measures in Sub-Controls can be recommended according to the size (large, middle, and small) of resources in an organization are described.

For example, for automating, specific measures are described in the following,

3.1 Run automated vulnerability scanning tools

5.5 Automated configuration monitoring system

and they are considered as measures for supporting the reliability, extensibility, and consecutive measurement in an organization.


Application to ICS

Furthermore, a guide for application to ICS environments (Implementation Guide for Industrial Control Systems) is provided. In this document, applicability to ICS environments and considerations are described for each Control.

For example, the vulnerability management in #3 describes that automated vulnerability scanning and patch application, which are recommended in Sub-Controls of CIS controls, may not be suitable for ICS environments. There is a note that such processes should be executed only during periodic maintenance and scheduled shutdown, without automating the processes, to eliminate influence on availability.


Key to CIS Controls is the six Basic controls, which are also the same in ICS environments. People who do not have much technical knowledge, less-experienced people, or people who will work on security for the first time are recommended to start with the check of these six items.




-CIS Controls

-CIS Controls ICS Companion Guide



Summary of this series

If the guidelines described from Part 1 to Part 5 in this series are classified, then it can be said that IEC62443 is a comprehensive guideline for the whole industry from the establishment of policies and organizations to the supply chains of systems and devices, and at the same time, it is also said that it is a systematized guideline for preventing the occurrence of incidents as the starting point. On the other hand, the NIST CSF has been developed and revised by separating concepts and practices, on the premise that incidents will occur.

Fig. 1: Position of Each Guideline (Trend Micro)


Guidelines have only been developed as criteria and/or standards. The important thing is to understand the essences of these guidelines, and precisely understand the reality of your organization, and then you will be able to face your real problems.

Trend Micro not only provides solutions for smart factories, but also conducts advanced and realistic research of threats uniquely by focusing on smart factories, and releases research results to the public. We hope that this series will help both security planning and practices in your organization through utilization of such information.




*Related articles:

-Forward-looking security analysis of smart factories <Part 1> Overlooked attack vectors

-Factory Security Problems from an IT Perspective (Part 1): Gap between the objectives of IT and OT

-Fake Company, Real Threats <Part 1> - Building a fake manufacturing system for a sting

-Trend Micro: Smart Factory Security


This website uses cookies for website functionality, traffic analytics, personalization, social media functionality, and advertising. By continuing to browse, you agree to our use of cookies.
Learn moreprivacy policy